GenZAgents for supply-chain software — AI BOM evidence and EU CRA

EU CRA + AI in software supply chain

EU Cyber Resilience Act enters force 2027 with vulnerability reporting from late 2026. Manufacturers must evidence secure development practices including AI assistance. The receipt feed captures which AI assisted which commits, which features, which versions. CRA Article 13(3) traceability requirement is satisfied by the receipt-based AIBOM.

AI bill of materials vs software bill of materials

SBOM lists software dependencies (which open-source libraries are in your binary). AIBOM is the analog: which AI providers + models contributed to your product code. Required by emerging procurement standards + practically required by CRA scrutiny. The receipt feed rolls up cleanly: "v2.4 of our product had AI contributions from claude-3-5-sonnet (61%), gpt-4o (24%), gemini-2.0-flash (12%), human-only (3%) by line count".

Procurement evidence

Your customers' procurement teams are starting to ask for AIBOMs. Without one: lost deals or extra friction. With: a one-click export from the receipt dashboard. Standard procurement artifact going forward; first-mover advantage to organisations that ship it cleanly today.

Vulnerability handling (CRA Article 13)

When a vulnerability is reported in your AI-assisted code, the receipts let you trace its origin — which engineer, which AI model, which commit. The forensic chain matches what CRA Article 13(3) is looking for: traceability of the development process.

Operational scenario: ERP customisation

Supply-chain SaaS vendor uses AI extensively in feature development. Each commit's receipt logs the AI assistance + the engineer. Customers procuring the SaaS get the AIBOM as part of due diligence. The vendor differentiates as "AI-transparent" — increasingly a procurement advantage.

Operational scenario: API + plugin marketplaces

Supply-chain platform with third-party plugins. Each plugin's AI involvement is logged via receipts. The marketplace can label plugins as "AI-assisted vendor-verified" — buyers see the AIBOM before integrating. Trust signal for the plugin ecosystem.

Common questions

Is AIBOM a formally recognised standard?▾

Not yet — it's emerging. The CRA and various procurement frameworks reference it conceptually; we expect formal standardisation in 2-3 years. Early adopters get the procurement advantage now.

Does the receipt audit cover open-source AI models too?▾

Yes — receipts log model_name. Open-source models (Llama, Mistral, etc.) show up the same way as Claude / GPT. The runtime field shows where it ran (vLLM, Ollama, etc.).

Can we tie AIBOM to specific software releases?▾

Yes — receipts can tag a release SHA / version. The dashboard rolls up "AI contributions per release". Useful for versioned product documentation.

What about ML model training (not just inference)?▾

In scope. Training-time AI assistance (data labelling, hyperparameter tuning via AI) generates receipts. The AIBOM covers both training and inference touchpoints.