Can you state the exact model version in production right now, for every AI system?

Not the family and not the vendor. The version, and the date it was deployed.

Do you record parent model lineage and every fine tuning run?

A fine tuned model inherits the properties and the problems of its parent. Without lineage an incident cannot be traced past the last training run.

For third party models, do you hold the provider’s own bill of materials?

Major model providers have begun publishing structured, machine readable bills of materials alongside model releases. Asking is now a reasonable request rather than an unusual one.

Could you reproduce a decision made by a superseded model version?

Six months after a complaint, the model that made the decision may no longer exist. Retention of superseded versions is the difference between explaining and apologising.

Can you name the training data sources for every model you operate?

Including for models you did not train, where the answer may be that the provider will not say. That is an answer and it should be recorded as one.

Do you hold the licensing terms for every dataset used?

Licence terms are where a bill of materials most often turns into a legal problem, because a dataset licensed for research does not become commercial by being fine tuned.

Is personal data used in training identified, and on what lawful basis?

The Omnibus expressly permits processing special category data to detect and correct bias, which makes the fairness testing position easier and the recording duty no lighter.

Do you record the preprocessing applied to training data?

Two models trained on the same data with different preprocessing are different models. Without this, reproduction is impossible even with the data in hand.

Do you have a software bill of materials for the training and serving stack?

This is the one category most organisations already partly have, because software bills of materials have been a procurement requirement for years. Extending it is cheaper than starting it.

Is the evaluation harness recorded as part of the artefact?

An accuracy claim without the harness that produced it is a marketing claim. Annex IV asks for the metrics and the metrics used.

Can you tell which dependency versions were present when a given model was trained?

The library version that produced the weights is part of the provenance, and it changes under you silently.

Do you correlate AI specific risk against your components?

The correlation surface is not the common vulnerabilities feed. It is model card disclosures of failure modes, AI vulnerability databases and the agentic risk catalogue, and it is more fragmented.

Do you record the accelerator configuration a model was trained on?

Reproduction and cost both depend on it, and it is the category most often omitted because it feels like infrastructure detail rather than provenance.

Do you record what is required to operate the model, as against to train it?

A buyer or a regulator asking about resilience is asking this question. It is also the question that decides whether you could move the workload.

For hosted models, do you know which jurisdiction the compute sits in?

This is where the bill of materials meets the placement discipline, and where an answer of we assume so is not an answer.

Are the transformations applied to training data recorded?

Distinct from preprocessing methodology: this is what actually happened to the data, not what the method says should happen.

Are anonymisation or differential privacy techniques and their parameters recorded?

A privacy technique without its parameters is a claim. The parameter is what determines whether the claim holds.

Is the output processing applied at inference recorded?

Filters, guardrails and post processing change what the system does. A bill of materials describing only the model describes something the user never met.

Does every production model have a model card?

Including the ones you did not build, where the provider’s card is the artefact and its gaps are your findings.

Do you hold bias and fairness evaluation results?

Article 10 expects examination for bias. The Omnibus now expressly permits processing the attributes you need in order to do it.

Do you hold safety testing results, including adversarial testing?

For an agentic system this includes goal hijacking and tool misuse, which are named risks in the agentic catalogue rather than general robustness.

Is there a change history that records what changed, when, and who approved it?

Annex IV asks for change documentation through the lifecycle. This is the category that makes the other five auditable rather than merely present.

Which specification do you produce, or intend to produce?

Two formats reached production maturity. The choice is not neutral and it is worth making deliberately rather than by whichever tool you found first. CycloneDX ML BOM v1.7, SPDX 3.0 AI Profile

Is the artefact cryptographically signed, and is the key verifiable?

The published baseline is a document signed by the supplier with a key verifiable through known public infrastructure. Suppliers who cannot meet it are being filtered at procurement.

How is the artefact produced?

The single strongest predictor of whether the file is current. A manual artefact cannot keep pace with retraining, and the book’s whole argument is about the difference between months and days.

What proportion of production AI systems are covered?

The three step rollout in Chapter 8 starts with one high risk system, extends to all production systems, then extends to vendor procurement. Say honestly which step you are on. Chapter 8