{"id":884,"date":"2026-09-15T22:13:08","date_gmt":"2026-09-15T22:13:08","guid":{"rendered":"https:\/\/www.opey.org\/opeyit\/?page_id=884"},"modified":"2026-09-16T18:19:03","modified_gmt":"2026-09-16T18:19:03","slug":"aibom-readiness-scorer","status":"publish","type":"page","link":"https:\/\/www.opey.org\/opeyit\/?page_id=884","title":{"rendered":"AIBOM Readiness Scorer"},"content":{"rendered":"\n<!--\n=====================================================\nAIBOM READINESS SCORER\nCompanion tool for WHEN AGENTS RULE by Steven Oppenheim\n=====================================================\n\nHOW TO INSTALL\n1. Create a WordPress page titled \"AIBOM Readiness Scorer\"\n2. Add a Custom HTML block, paste this entire file\n3. Preview, then Publish\n4. Note the page ID and give it to the main page update\n   (it replaces #REPLACE_TOOL_AIBOM on page 748)\n\nSELF CONTAINED. Scoped to #war-aibom-2026.\n\nTHE FRAMEWORK: Chapter 8, six AIBOM categories: models, datasets,\ncode, hardware, data processing, governance. Three step rollout and\nfive vendor RFP questions reproduced in the tool.\n\nINDUSTRY REVIEW (September 2026) CHANGED THE DESIGN:\n 1. AIBOM is now a procurement filter, so the tool returns a\n    procurement verdict as well as a readiness band.\n 2. Two production mature formats (CycloneDX ML BOM v1.7 and\n    SPDX 3.0 AI Profile) differ on signing and unknown handling.\n 3. Generation path decides currency, so it is weighted heavily\n    and the tool estimates time to produce a file on request.\n\nONE DESIGN DECISION: readiness is the WEAKEST category, not the\naverage. A request lands on the gap, not the coverage.\n\nWORDPRESS COMPATIBILITY (do not reintroduce):\n  NO less than sign or ampersand in the script. NO innerHTML.\n  No template literals, arrow functions or optional chaining.\n  The noscript block carries the full manual method.\n  No hyphens or dashes in visible prose.\n-->\n\n<div id=\"war-aibom-2026\">\n\n<style>\n#war-aibom-2026 {\n    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif !important;\n    color: #333 !important; line-height: 1.6 !important; max-width: 100% !important; margin: 0 !important; padding: 0 !important;\n    -webkit-text-size-adjust: 100% !important; text-size-adjust: 100% !important;\n}\n#war-aibom-2026 * { box-sizing: border-box !important; }\n#war-aibom-2026 h1, #war-aibom-2026 h2, #war-aibom-2026 h3, #war-aibom-2026 h4 { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif !important; text-transform: none !important; letter-spacing: normal; overflow-wrap: break-word !important; word-wrap: break-word !important; -webkit-hyphens: none !important; hyphens: none !important; }\n#war-aibom-2026 p, #war-aibom-2026 li, #war-aibom-2026 td, #war-aibom-2026 span, #war-aibom-2026 label { overflow-wrap: break-word !important; word-wrap: break-word !important; }\n#war-aibom-2026 a { text-decoration: none !important; }\n#war-aibom-2026 .ab-inner { max-width: 900px !important; margin: 0 auto !important; }\n#war-aibom-2026 .ab-wide { max-width: 1140px !important; margin: 0 auto !important; }\n\n#war-aibom-2026 .ab-band { background: linear-gradient(90deg, #475569 0%, #1e40af 100%) !important; padding: 12px 20px !important; text-align: center !important; }\n#war-aibom-2026 .ab-band p { margin: 0 !important; color: #fff !important; font-size: 13.5px !important; font-weight: 500 !important; }\n#war-aibom-2026 .ab-band strong { color: #FDE68A !important; }\n\n#war-aibom-2026 .ab-hero {\n    background: radial-gradient(circle at 78% 22%, rgba(71,85,105,0.30) 0%, transparent 55%),\n                linear-gradient(135deg, #0a1622 0%, #1a2a3a 55%, #2d4156 100%) !important;\n    padding: 52px 20px 46px 20px !important;\n}\n#war-aibom-2026 .ab-eyebrow { display: inline-block !important; color: #c9a227 !important; font-size: 11px !important; font-weight: 700 !important; letter-spacing: 2px !important; text-transform: uppercase !important; margin-bottom: 12px !important; }\n#war-aibom-2026 .ab-h1 { color: #fff !important; font-size: 42px !important; font-weight: 800 !important; margin: 0 0 14px 0 !important; line-height: 1.06 !important; letter-spacing: -0.5px !important; }\n#war-aibom-2026 .ab-lede { color: rgba(255,255,255,0.86) !important; font-size: 17px !important; margin: 0 0 20px 0 !important; line-height: 1.5 !important; max-width: 710px !important; }\n#war-aibom-2026 .ab-facts { display: flex !important; flex-wrap: wrap !important; margin: 0 0 14px -5px !important; }\n#war-aibom-2026 .ab-fact { background: rgba(255,255,255,0.08) !important; border: 1px solid rgba(255,255,255,0.18) !important; border-radius: 6px !important; padding: 9px 14px !important; color: rgba(255,255,255,0.9) !important; font-size: 12.5px !important; font-weight: 600 !important; margin: 0 5px 10px 5px !important; }\n#war-aibom-2026 .ab-fact b { color: #c9a227 !important; }\n#war-aibom-2026 .ab-honest { max-width: 730px !important; background: rgba(201,162,39,0.10) !important; border-left: 4px solid #c9a227 !important; border-radius: 6px !important; padding: 16px 18px !important; color: rgba(255,255,255,0.82) !important; font-size: 13.5px !important; line-height: 1.65 !important; }\n#war-aibom-2026 .ab-honest b { color: #c9a227 !important; }\n\n#war-aibom-2026 .ab-form { background: #f7f8fa !important; padding: 46px 20px !important; }\n#war-aibom-2026 .ab-sec { background: #fff !important; border: 1px solid #e2e6ea !important; border-radius: 12px !important; margin-bottom: 22px !important; overflow: hidden !important; }\n#war-aibom-2026 .ab-shead { padding: 20px 24px !important; display: flex !important; align-items: center !important; flex-wrap: wrap !important; }\n#war-aibom-2026 .ab-shead.s1 { background: linear-gradient(135deg, #7C3AED 0%, #6D28D9 100%) !important; }\n#war-aibom-2026 .ab-shead.s2 { background: linear-gradient(135deg, #B91C1C 0%, #991B1B 100%) !important; }\n#war-aibom-2026 .ab-shead.s3 { background: linear-gradient(135deg, #B45309 0%, #D97706 100%) !important; }\n#war-aibom-2026 .ab-shead.s4 { background: linear-gradient(135deg, #047857 0%, #059669 100%) !important; }\n#war-aibom-2026 .ab-shead.s5 { background: linear-gradient(135deg, #1e40af 0%, #1e3a8a 100%) !important; }\n#war-aibom-2026 .ab-shead.s6 { background: linear-gradient(135deg, #7f1d1d 0%, #B91C1C 100%) !important; }\n#war-aibom-2026 .ab-shead.s0 { background: linear-gradient(135deg, #475569 0%, #334155 100%) !important; }\n#war-aibom-2026 .ab-snum { width: 46px !important; height: 46px !important; flex-shrink: 0 !important; background: rgba(255,255,255,0.16) !important; border: 2px solid rgba(255,255,255,0.35) !important; border-radius: 10px !important; display: flex !important; align-items: center !important; justify-content: center !important; color: #fff !important; font-size: 17px !important; font-weight: 800 !important; margin-right: 15px !important; }\n#war-aibom-2026 .ab-stitle { flex: 1 !important; min-width: 200px !important; }\n#war-aibom-2026 .ab-stitle h2 { margin: 0 0 4px 0 !important; color: #fff !important; font-size: 20px !important; font-weight: 700 !important; line-height: 1.25 !important; }\n#war-aibom-2026 .ab-stitle p { margin: 0 !important; color: rgba(255,255,255,0.88) !important; font-size: 13px !important; line-height: 1.45 !important; }\n#war-aibom-2026 .ab-sbody { padding: 6px 24px 20px 24px !important; }\n#war-aibom-2026 .ab-q { padding: 18px 0 !important; border-bottom: 1px solid #eef1f4 !important; }\n#war-aibom-2026 .ab-q:last-child { border-bottom: none !important; }\n#war-aibom-2026 .ab-qlabel { font-size: 15.5px !important; font-weight: 700 !important; color: #1a2a3a !important; margin: 0 0 4px 0 !important; line-height: 1.45 !important; }\n#war-aibom-2026 .ab-help { font-size: 12.5px !important; color: #6b7785 !important; margin: 0 0 10px 0 !important; line-height: 1.55 !important; }\n#war-aibom-2026 .ab-cite { font-size: 11.5px !important; color: #1e40af !important; font-weight: 700 !important; letter-spacing: 0.4px !important; }\n#war-aibom-2026 .ab-opt { display: block !important; position: relative !important; padding: 12px 14px 12px 42px !important; border: 1px solid #dde2e7 !important; border-radius: 7px !important; margin-bottom: 8px !important; cursor: pointer !important; font-size: 14px !important; color: #444 !important; line-height: 1.5 !important; background: #fff !important; min-height: 46px !important; -webkit-tap-highlight-color: rgba(201,162,39,0.25) !important; }\n#war-aibom-2026 .ab-opt:hover { border-color: #b9c2cb !important; background: #fbfcfd !important; }\n#war-aibom-2026 .ab-opt input { position: absolute !important; left: 14px !important; top: 14px !important; width: 18px !important; height: 18px !important; margin: 0 !important; min-height: 0 !important; cursor: pointer !important; -webkit-appearance: radio !important; appearance: auto !important; }\n#war-aibom-2026 .ab-fields { display: grid !important; grid-template-columns: repeat(2, minmax(0, 1fr)) !important; grid-gap: 14px !important; gap: 14px !important; margin-top: 16px !important; }\n#war-aibom-2026 .ab-f label { display: block !important; font-size: 13px !important; font-weight: 700 !important; color: #1a2a3a !important; margin-bottom: 5px !important; line-height: 1.4 !important; min-height: 44px !important; }\n#war-aibom-2026 .ab-f .ab-hint2 { display: block !important; font-size: 11.5px !important; font-weight: 400 !important; color: #6b7785 !important; margin-top: 2px !important; line-height: 1.45 !important; }\n#war-aibom-2026 .ab-wrap { display: flex !important; align-items: stretch !important; }\n#war-aibom-2026 .ab-pre { background: #eef1f4 !important; border: 1px solid #dde2e7 !important; border-right: none !important; border-radius: 7px 0 0 7px !important; color: #6b7785 !important; font-size: 13.5px !important; font-weight: 700 !important; display: flex !important; align-items: center !important; padding: 0 11px !important; flex-shrink: 0 !important; }\n#war-aibom-2026 .ab-f input, #war-aibom-2026 .ab-f select { display: block !important; flex: 1 !important; min-width: 0 !important; width: 100% !important; max-width: 100% !important; padding: 12px 13px !important; border: 1px solid #dde2e7 !important; border-radius: 7px !important; font-size: 16px !important; font-family: inherit !important; color: #1a2a3a !important; min-height: 46px !important; background: #fff !important; -webkit-appearance: none !important; appearance: none !important; }\n#war-aibom-2026 .ab-wrap .ab-pre + input { border-radius: 0 7px 7px 0 !important; }\n#war-aibom-2026 .ab-locked { background: #eef2ff !important; border: 1px solid #c7d2fe !important; border-left: 4px solid #1e40af !important; border-radius: 7px !important; padding: 13px 15px !important; font-size: 13px !important; color: #1e3a5f !important; line-height: 1.6 !important; margin: 16px 0 !important; }\n#war-aibom-2026 .ab-locked b { color: #1e40af !important; }\n\n#war-aibom-2026 .ab-progress { position: -webkit-sticky !important; position: sticky !important; bottom: 0 !important; background: #1a2a3a !important; padding: 14px 20px !important; z-index: 20 !important; box-shadow: 0 -4px 18px rgba(0,0,0,0.22) !important; }\n#war-aibom-2026 .ab-pinner { max-width: 900px !important; margin: 0 auto !important; display: flex !important; align-items: center !important; flex-wrap: wrap !important; }\n#war-aibom-2026 .ab-pinner > * { margin: 4px 6px !important; }\n#war-aibom-2026 .ab-ptext { color: rgba(255,255,255,0.9) !important; font-size: 13px !important; font-weight: 600 !important; flex: 1 !important; min-width: 150px !important; }\n#war-aibom-2026 .ab-ptext b { color: #c9a227 !important; }\n#war-aibom-2026 .ab-bar { flex: 1 1 140px !important; height: 8px !important; background: rgba(255,255,255,0.16) !important; border-radius: 4px !important; overflow: hidden !important; display: block !important; }\n#war-aibom-2026 .ab-bar i { display: block !important; height: 100% !important; width: 0%; background: linear-gradient(90deg, #475569, #c9a227) !important; transition: width 0.25s ease !important; }\n#war-aibom-2026 .ab-go { background: #c9a227 !important; color: #1a2a3a !important; border: none !important; padding: 14px 24px !important; min-height: 48px !important; border-radius: 7px !important; font-size: 14.5px !important; font-weight: 800 !important; cursor: pointer !important; font-family: inherit !important; -webkit-appearance: none !important; appearance: none !important; }\n#war-aibom-2026 .ab-go:hover { background: #ddb832 !important; }\n#war-aibom-2026 .ab-go[disabled] { background: #6b7785 !important; color: rgba(255,255,255,0.72) !important; cursor: not-allowed !important; }\n#war-aibom-2026 .ab-clear { background: transparent !important; color: rgba(255,255,255,0.85) !important; border: 2px solid rgba(255,255,255,0.3) !important; padding: 12px 18px !important; min-height: 48px !important; border-radius: 7px !important; font-size: 13px !important; font-weight: 700 !important; cursor: pointer !important; font-family: inherit !important; -webkit-appearance: none !important; appearance: none !important; }\n\n#war-aibom-2026 .ab-result { display: none !important; background: linear-gradient(135deg, #0a1622 0%, #1a2a3a 100%) !important; padding: 52px 20px !important; }\n#war-aibom-2026 .ab-result.on { display: block !important; }\n#war-aibom-2026 .ab-panel { background: #fff !important; border-radius: 12px !important; padding: 24px 22px !important; margin-bottom: 22px !important; }\n#war-aibom-2026 .ab-grid2 { display: grid !important; grid-template-columns: repeat(2, minmax(0, 1fr)) !important; grid-gap: 18px !important; gap: 18px !important; margin-bottom: 22px !important; }\n#war-aibom-2026 .ab-grid2 .ab-panel { margin-bottom: 0 !important; }\n#war-aibom-2026 .ab-panel h3 { margin: 0 0 6px 0 !important; font-size: 19px !important; font-weight: 800 !important; color: #1a2a3a !important; line-height: 1.3 !important; }\n#war-aibom-2026 .ab-panel .ab-sub { margin: 0 0 16px 0 !important; font-size: 13px !important; color: #6b7785 !important; line-height: 1.6 !important; }\n#war-aibom-2026 .ab-ask { border-left: 6px solid #c9a227 !important; }\n#war-aibom-2026 .ab-askrow { display: flex !important; padding: 12px 0 !important; border-bottom: 1px solid #eef1f4 !important; flex-wrap: wrap !important; }\n#war-aibom-2026 .ab-askrow:last-child { border-bottom: none !important; }\n#war-aibom-2026 .ab-askrow b { flex: 0 0 180px !important; font-size: 11px !important; font-weight: 800 !important; letter-spacing: 1px !important; text-transform: uppercase !important; color: #6b7785 !important; padding: 2px 14px 4px 0 !important; }\n#war-aibom-2026 .ab-askrow span { flex: 1 1 240px !important; min-width: 0 !important; font-size: 15px !important; color: #1a2a3a !important; line-height: 1.55 !important; font-weight: 600 !important; overflow-wrap: break-word !important; word-wrap: break-word !important; }\n\n#war-aibom-2026 .ab-verdict { background: #fff !important; border-radius: 14px !important; padding: 30px 28px !important; margin-bottom: 22px !important; border-left: 8px solid #475569 !important; }\n#war-aibom-2026 .ab-verdict.vgood { border-left-color: #059669 !important; }\n#war-aibom-2026 .ab-verdict.vmid { border-left-color: #D97706 !important; }\n#war-aibom-2026 .ab-verdict.vbad { border-left-color: #B91C1C !important; }\n#war-aibom-2026 .ab-vtop { font-size: 11px !important; font-weight: 800 !important; letter-spacing: 1.6px !important; text-transform: uppercase !important; color: #6b7785 !important; margin: 0 0 12px 0 !important; }\n#war-aibom-2026 .ab-vname { font-size: 36px !important; font-weight: 800 !important; color: #1a2a3a !important; margin: 0 0 8px 0 !important; line-height: 1.1 !important; letter-spacing: -0.5px !important; overflow-wrap: break-word !important; word-wrap: break-word !important; }\n#war-aibom-2026 .ab-vscore { font-size: 15px !important; font-weight: 700 !important; color: #6b7785 !important; margin: 0 0 18px 0 !important; line-height: 1.5 !important; }\n#war-aibom-2026 .ab-vread { font-size: 14.5px !important; color: #444 !important; line-height: 1.7 !important; margin: 0 !important; max-width: 760px !important; }\n#war-aibom-2026 .ab-bars { margin: 20px 0 0 0 !important; }\n#war-aibom-2026 .ab-brow { display: flex !important; align-items: center !important; margin-bottom: 12px !important; flex-wrap: wrap !important; }\n#war-aibom-2026 .ab-blabel { flex: 0 0 168px !important; font-size: 13px !important; font-weight: 800 !important; color: #1a2a3a !important; padding-right: 12px !important; }\n#war-aibom-2026 .ab-btrack { flex: 1 1 170px !important; height: 26px !important; background: #eef1f4 !important; border-radius: 5px !important; position: relative !important; overflow: hidden !important; }\n#war-aibom-2026 .ab-bfill { height: 100% !important; border-radius: 5px !important; }\n#war-aibom-2026 .ab-bfill.f0 { background: linear-gradient(90deg, #B91C1C, #DC2626) !important; }\n#war-aibom-2026 .ab-bfill.f1 { background: linear-gradient(90deg, #D97706, #F59E0B) !important; }\n#war-aibom-2026 .ab-bfill.f2 { background: linear-gradient(90deg, #059669, #10B981) !important; }\n#war-aibom-2026 .ab-bval { flex: 0 0 84px !important; font-size: 15px !important; font-weight: 800 !important; font-family: Georgia, serif !important; color: #1a2a3a !important; text-align: right !important; }\n#war-aibom-2026 .ab-bbind { flex: 0 0 96px !important; font-size: 9.5px !important; font-weight: 800 !important; letter-spacing: 0.6px !important; text-transform: uppercase !important; color: #922b21 !important; padding-left: 12px !important; }\n\n#war-aibom-2026 .ab-big { font-size: 30px !important; font-weight: 800 !important; color: #1a2a3a !important; line-height: 1.15 !important; margin: 0 0 4px 0 !important; font-family: Georgia, serif !important; overflow-wrap: break-word !important; word-wrap: break-word !important; }\n#war-aibom-2026 .ab-big.neg { color: #B91C1C !important; }\n#war-aibom-2026 .ab-note { border-radius: 8px !important; padding: 15px 17px !important; font-size: 13.5px !important; line-height: 1.65 !important; margin-top: 14px !important; }\n#war-aibom-2026 .ab-note.warn { background: #fadbd8 !important; border-left: 4px solid #B91C1C !important; color: #6d2019 !important; }\n#war-aibom-2026 .ab-note.caution { background: #fdf2d0 !important; border-left: 4px solid #D97706 !important; color: #6d4a00 !important; }\n#war-aibom-2026 .ab-note.ok { background: #dcf0e4 !important; border-left: 4px solid #059669 !important; color: #14603c !important; }\n#war-aibom-2026 .ab-note.info { background: #eef2f7 !important; border-left: 4px solid #475569 !important; color: #2f3c4d !important; }\n#war-aibom-2026 .ab-grade { display: -webkit-inline-flex !important; display: inline-flex !important; align-items: center !important; justify-content: center !important; width: 62px !important; height: 62px !important; border-radius: 50% !important; font-size: 30px !important; font-weight: 800 !important; font-family: Georgia, serif !important; margin-bottom: 12px !important; }\n#war-aibom-2026 .ab-grade.gA { background: #dcf0e4 !important; color: #14603c !important; }\n#war-aibom-2026 .ab-grade.gB { background: #e4f0dc !important; color: #3d6014 !important; }\n#war-aibom-2026 .ab-grade.gC { background: #fdf2d0 !important; color: #8a6100 !important; }\n#war-aibom-2026 .ab-grade.gD { background: #fadbd8 !important; color: #922b21 !important; }\n\n#war-aibom-2026 table.ab-tbl { width: 100% !important; min-width: 620px !important; border-collapse: collapse !important; font-size: 13px !important; }\n#war-aibom-2026 table.ab-tbl th { background: #1a2a3a !important; color: #fff !important; text-align: left !important; padding: 10px 12px !important; font-size: 11px !important; font-weight: 800 !important; letter-spacing: 0.5px !important; text-transform: uppercase !important; }\n#war-aibom-2026 table.ab-tbl td { padding: 10px 12px !important; border-bottom: 1px solid #eef1f4 !important; vertical-align: top !important; color: #444 !important; line-height: 1.5 !important; }\n#war-aibom-2026 table.ab-tbl td.num { text-align: right !important; font-family: Georgia, serif !important; white-space: nowrap !important; }\n#war-aibom-2026 table.ab-tbl tr.bad td { background: #fdeceb !important; color: #922b21 !important; font-weight: 600 !important; }\n#war-aibom-2026 table.ab-tbl tr.mid td { background: #fffaf1 !important; color: #8a5a00 !important; }\n#war-aibom-2026 table.ab-tbl tr.good td { background: #f2faf5 !important; color: #14603c !important; }\n#war-aibom-2026 .ab-scroll { overflow-x: auto !important; -webkit-overflow-scrolling: touch !important; max-width: 100% !important; }\n#war-aibom-2026 .ab-hint { display: none !important; }\n@media (max-width: 768px) { #war-aibom-2026 .ab-hint { display: block !important; font-size: 11.5px !important; font-weight: 700 !important; color: #6b7785 !important; margin: 0 0 8px 0 !important; } }\n\n#war-aibom-2026 .ab-card { background: #f6f8fa !important; border: 1px dashed #c3ccd5 !important; border-radius: 8px !important; padding: 18px 20px !important; font-size: 13px !important; color: #333 !important; line-height: 1.7 !important; white-space: pre-wrap !important; overflow-wrap: break-word !important; word-wrap: break-word !important; font-family: Georgia, 'Times New Roman', serif !important; }\n#war-aibom-2026 .ab-btnrow { display: flex !important; flex-wrap: wrap !important; margin: 10px -5px 0 -5px !important; }\n#war-aibom-2026 .ab-btn { background: #1a2a3a !important; color: #fff !important; border: none !important; cursor: pointer !important; padding: 13px 20px !important; min-height: 46px !important; border-radius: 6px !important; font-size: 13px !important; font-weight: 700 !important; font-family: inherit !important; display: -webkit-inline-flex !important; display: inline-flex !important; align-items: center !important; margin: 6px 5px 0 5px !important; -webkit-appearance: none !important; appearance: none !important; }\n#war-aibom-2026 .ab-btn:hover { background: #2d4156 !important; }\n#war-aibom-2026 .ab-btn.gold { background: #c9a227 !important; color: #1a2a3a !important; }\n#war-aibom-2026 .ab-btn.ghost { background: transparent !important; color: #1a2a3a !important; border: 2px solid #c3ccd5 !important; }\n\n#war-aibom-2026 .ab-next { background: #fff !important; padding: 50px 20px !important; }\n#war-aibom-2026 .ab-next h3 { text-align: center !important; font-size: 28px !important; font-weight: 800 !important; color: #1a2a3a !important; margin: 0 0 10px 0 !important; }\n#war-aibom-2026 .ab-next .ab-sub { text-align: center !important; max-width: 660px !important; margin: 0 auto 32px auto !important; color: #6b7785 !important; font-size: 15px !important; line-height: 1.6 !important; }\n#war-aibom-2026 .ab-grid3 { display: grid !important; grid-template-columns: repeat(3, minmax(0, 1fr)) !important; grid-gap: 18px !important; gap: 18px !important; }\n#war-aibom-2026 .ab-tile { border: 1px solid #e2e6ea !important; border-radius: 10px !important; padding: 22px 20px !important; background: #fbfcfd !important; }\n#war-aibom-2026 .ab-tile h4 { margin: 0 0 8px 0 !important; font-size: 16px !important; font-weight: 700 !important; color: #1a2a3a !important; line-height: 1.35 !important; }\n#war-aibom-2026 .ab-tile p { margin: 0 0 14px 0 !important; font-size: 13.5px !important; color: #555 !important; line-height: 1.6 !important; }\n#war-aibom-2026 .ab-tile a { display: inline-block !important; background: #1a2a3a !important; color: #fff !important; padding: 12px 18px !important; min-height: 46px !important; border-radius: 6px !important; font-size: 12.5px !important; font-weight: 700 !important; line-height: 22px !important; }\n#war-aibom-2026 .ab-tile a:hover { background: #c9a227 !important; color: #1a2a3a !important; }\n#war-aibom-2026 .ab-cta { background: linear-gradient(135deg, #c9a227 0%, #ddb832 100%) !important; padding: 46px 20px !important; text-align: center !important; }\n#war-aibom-2026 .ab-cta h3 { font-size: 27px !important; font-weight: 800 !important; color: #1a2a3a !important; margin: 0 0 10px 0 !important; }\n#war-aibom-2026 .ab-cta p { font-size: 15.5px !important; color: #1a2a3a !important; opacity: 0.85 !important; margin: 0 0 24px 0 !important; }\n#war-aibom-2026 .ab-ctarow { display: flex !important; justify-content: center !important; flex-wrap: wrap !important; }\n#war-aibom-2026 .ab-ctarow a { background: #1a2a3a !important; color: #fff !important; padding: 13px 22px !important; min-height: 46px !important; border-radius: 6px !important; font-size: 13px !important; font-weight: 700 !important; display: -webkit-inline-flex !important; display: inline-flex !important; align-items: center !important; margin: 5px !important; }\n#war-aibom-2026 .ab-fine { background: #1a2a3a !important; padding: 26px 20px !important; }\n#war-aibom-2026 .ab-fine p { max-width: 900px !important; margin: 0 auto !important; color: rgba(255,255,255,0.62) !important; font-size: 11.5px !important; line-height: 1.75 !important; }\n#war-aibom-2026 .ab-fine b { color: rgba(255,255,255,0.85) !important; }\n#war-aibom-2026 .ab-manual { background: #fff9f0 !important; border-top: 4px solid #D97706 !important; padding: 40px 20px !important; }\n#war-aibom-2026 .ab-manual h3 { font-size: 23px !important; font-weight: 800 !important; color: #1a2a3a !important; margin: 0 0 10px 0 !important; }\n\n@media print {\n    #war-aibom-2026 .ab-band, #war-aibom-2026 .ab-hero, #war-aibom-2026 .ab-form,\n    #war-aibom-2026 .ab-progress, #war-aibom-2026 .ab-next, #war-aibom-2026 .ab-cta,\n    #war-aibom-2026 .ab-btnrow { display: none !important; }\n    #war-aibom-2026 .ab-result { background: #fff !important; padding: 0 !important; }\n    #war-aibom-2026 .ab-panel, #war-aibom-2026 .ab-verdict { border: 1px solid #ccc !important; page-break-inside: avoid !important; }\n    #war-aibom-2026 .ab-fine { background: #fff !important; }\n    #war-aibom-2026 .ab-fine p, #war-aibom-2026 .ab-fine b { color: #444 !important; }\n    #war-aibom-2026 table.ab-tbl { min-width: 0 !important; }\n}\n@media (max-width: 900px) {\n    #war-aibom-2026 .ab-grid2 { grid-template-columns: minmax(0, 1fr) !important; }\n    #war-aibom-2026 .ab-grid3 { grid-template-columns: minmax(0, 1fr) !important; max-width: 480px !important; margin: 0 auto !important; }\n}\n@media (max-width: 768px) {\n    #war-aibom-2026 .ab-h1 { font-size: 31px !important; }\n    #war-aibom-2026 .ab-hero { padding: 38px 18px 34px 18px !important; }\n    #war-aibom-2026 .ab-form, #war-aibom-2026 .ab-result, #war-aibom-2026 .ab-next { padding: 34px 16px !important; }\n    #war-aibom-2026 .ab-shead, #war-aibom-2026 .ab-sbody { padding-left: 16px !important; padding-right: 16px !important; }\n    #war-aibom-2026 .ab-fields { grid-template-columns: minmax(0, 1fr) !important; }\n    #war-aibom-2026 .ab-panel { padding: 20px 17px !important; }\n    #war-aibom-2026 .ab-verdict { padding: 22px 18px !important; }\n    #war-aibom-2026 .ab-vname { font-size: 26px !important; }\n    #war-aibom-2026 .ab-blabel { flex: 0 0 100% !important; margin-bottom: 4px !important; }\n    #war-aibom-2026 .ab-bbind { flex: 0 0 auto !important; }\n    #war-aibom-2026 .ab-askrow b { flex: 0 0 100% !important; }\n}\n@media (max-width: 420px) {\n    #war-aibom-2026 .ab-h1 { font-size: 26px !important; }\n    #war-aibom-2026 .ab-vname { font-size: 22px !important; }\n    #war-aibom-2026 .ab-big { font-size: 24px !important; }\n    #war-aibom-2026 .ab-opt { font-size: 13.5px !important; padding-left: 40px !important; }\n    #war-aibom-2026 .ab-shead, #war-aibom-2026 .ab-sbody, #war-aibom-2026 .ab-panel { padding-left: 12px !important; padding-right: 12px !important; }\n    #war-aibom-2026 .ab-stitle { min-width: 0 !important; }\n    #war-aibom-2026 .ab-snum { width: 38px !important; height: 38px !important; margin-right: 10px !important; }\n    #war-aibom-2026 .ab-bval { flex: 0 0 64px !important; font-size: 13px !important; }\n    #war-aibom-2026 .ab-btrack { flex: 1 1 100px !important; }\n}\n<\/style>\n\n<div class=\"ab-band\">\n    <p>READINESS IS THE WEAKEST CATEGORY, NOT THE AVERAGE: <strong>a buyer asks for the file, not for a category.<\/strong><\/p>\n<\/div>\n\n<div class=\"ab-hero\">\n    <div class=\"ab-inner\">\n        <span class=\"ab-eyebrow\">Quadrant One \/\/ When Agents Rule<\/span>\n        <h1 class=\"ab-h1\">AIBOM Readiness Scorer<\/h1>\n        <p class=\"ab-lede\">Score your AI bill of materials across the six categories from Chapter 8. Get the category to fix first, the estimated time to produce an Annex IV file on request, and whether you would pass a 2026 vendor qualification.<\/p>\n        <div class=\"ab-facts\">\n            <span class=\"ab-fact\"><b>22<\/b> checks, six categories<\/span>\n            <span class=\"ab-fact\"><b>4<\/b> context questions<\/span>\n            <span class=\"ab-fact\"><b>8<\/b> minutes<\/span>\n            <span class=\"ab-fact\"><b>0<\/b> fields sent anywhere<\/span>\n        <\/div>\n        <div class=\"ab-honest\">\n            <b>Why this is now a commercial question and not a security one.<\/b> Through 2026 enterprise procurement began treating an AI bill of materials as a vendor qualification condition, the AI equivalent of a security audit report, with suppliers who cannot meet the baseline filtered before the technical evaluation. So this tool returns a procurement verdict as well as a readiness band: the band is an internal number, the verdict is the consequence.<br><br>\n            <b>And why the weakest category is the answer.<\/b> An auditor asks for the file. A file with five strong categories and one absent is a file with a hole in it, and the request will land on the hole. The average of six categories is a comfortable number that predicts nothing, so it is disclosed here and then set aside.<br><br>\n            This is the fast diagnostic. The companion AIBOM Readiness Checklist carries the full forty six check assessment and the procurement clause language. Nothing you enter is transmitted or stored.\n        <\/div>\n    <\/div>\n<\/div>\n\n<div class=\"ab-form\">\n<div class=\"ab-inner\">\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s1\">\n            <div class=\"ab-snum\">M<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Models<\/h2>\n                <p>Weights, architecture, version, parent model lineage and fine tuning history.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Can you state the exact model version in production right now, for every AI system?<\/p>\n                <p class=\"ab-help\">Not the family and not the vendor. The version, and the date it was deployed.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m1\" value=\"0\"><span>No. We could establish it for some systems by asking the team that built them.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m1\" value=\"1\"><span>For our main systems, from documentation that is updated by hand.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m1\" value=\"2\"><span>For every production system, from a register we maintain.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m1\" value=\"3\"><span>For every production system, automatically, from the deployment pipeline itself.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you record parent model lineage and every fine tuning run?<\/p>\n                <p class=\"ab-help\">A fine tuned model inherits the properties and the problems of its parent. Without lineage an incident cannot be traced past the last training run.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m2\" value=\"0\"><span>No lineage recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m2\" value=\"1\"><span>Parent model noted, fine tuning runs not systematically recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m2\" value=\"2\"><span>Parent and fine tuning history recorded for production models.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m2\" value=\"3\"><span>Full lineage including datasets used at each stage, queryable.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">For third party models, do you hold the provider&#8217;s own bill of materials?<\/p>\n                <p class=\"ab-help\">Major model providers have begun publishing structured, machine readable bills of materials alongside model releases. Asking is now a reasonable request rather than an unusual one.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m3\" value=\"0\"><span>We have not asked.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m3\" value=\"1\"><span>We have asked and not received one.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m3\" value=\"2\"><span>We hold one for some providers, in whatever form they supplied.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m3\" value=\"3\"><span>We hold one in a machine readable standard format for every third party model in production.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Could you reproduce a decision made by a superseded model version?<\/p>\n                <p class=\"ab-help\">Six months after a complaint, the model that made the decision may no longer exist. Retention of superseded versions is the difference between explaining and apologising.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m4\" value=\"0\"><span>No. Superseded versions are not retained.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m4\" value=\"1\"><span>Sometimes, depending on the team.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m4\" value=\"2\"><span>Yes for systems we classified as high risk.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"m4\" value=\"3\"><span>Yes for all production systems, with a stated retention period tied to our limitation periods.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s2\">\n            <div class=\"ab-snum\">D<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Datasets<\/h2>\n                <p>Training data sources, licensing terms, preprocessing methodology and any personal data used.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Can you name the training data sources for every model you operate?<\/p>\n                <p class=\"ab-help\">Including for models you did not train, where the answer may be that the provider will not say. That is an answer and it should be recorded as one.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d1\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d1\" value=\"1\"><span>For models we trained ourselves only.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d1\" value=\"2\"><span>For models we trained, and the provider position is recorded for the rest.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d1\" value=\"3\"><span>For all models, with provenance recorded and the gaps named explicitly.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you hold the licensing terms for every dataset used?<\/p>\n                <p class=\"ab-help\">Licence terms are where a bill of materials most often turns into a legal problem, because a dataset licensed for research does not become commercial by being fine tuned.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d2\" value=\"0\"><span>No licence records.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d2\" value=\"1\"><span>Held informally, not centrally.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d2\" value=\"2\"><span>Held centrally for datasets we selected.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d2\" value=\"3\"><span>Held centrally for all datasets, with commercial use confirmed in writing.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Is personal data used in training identified, and on what lawful basis?<\/p>\n                <p class=\"ab-help\">The Omnibus expressly permits processing special category data to detect and correct bias, which makes the fairness testing position easier and the recording duty no lighter.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d3\" value=\"0\"><span>Not identified.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d3\" value=\"1\"><span>Identified for some datasets.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d3\" value=\"2\"><span>Identified, with a lawful basis recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d3\" value=\"3\"><span>Identified, lawful basis recorded, and the record is reviewed when the model is retrained.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you record the preprocessing applied to training data?<\/p>\n                <p class=\"ab-help\">Two models trained on the same data with different preprocessing are different models. Without this, reproduction is impossible even with the data in hand.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d4\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d4\" value=\"1\"><span>Informally, in notebooks or commit messages.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d4\" value=\"2\"><span>Documented for production models.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"d4\" value=\"3\"><span>Documented and version controlled alongside the model.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s3\">\n            <div class=\"ab-snum\">C<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Code<\/h2>\n                <p>Training pipeline, evaluation harnesses and dependency tree.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you have a software bill of materials for the training and serving stack?<\/p>\n                <p class=\"ab-help\">This is the one category most organisations already partly have, because software bills of materials have been a procurement requirement for years. Extending it is cheaper than starting it.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c1\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c1\" value=\"1\"><span>For some services.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c1\" value=\"2\"><span>For production services, generated in the build.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c1\" value=\"3\"><span>For production services, generated in the build, signed, and ingested by our own tooling.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Is the evaluation harness recorded as part of the artefact?<\/p>\n                <p class=\"ab-help\">An accuracy claim without the harness that produced it is a marketing claim. Annex IV asks for the metrics and the metrics used.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c2\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c2\" value=\"1\"><span>Results retained, harness not.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c2\" value=\"2\"><span>Harness retained for production models.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c2\" value=\"3\"><span>Harness version controlled and re runnable against the deployed model.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Can you tell which dependency versions were present when a given model was trained?<\/p>\n                <p class=\"ab-help\">The library version that produced the weights is part of the provenance, and it changes under you silently.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c3\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c3\" value=\"1\"><span>Approximately, from build logs.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c3\" value=\"2\"><span>Yes, pinned and recorded at training time.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c3\" value=\"3\"><span>Yes, pinned, recorded, and the training environment is reproducible from the record.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you correlate AI specific risk against your components?<\/p>\n                <p class=\"ab-help\">The correlation surface is not the common vulnerabilities feed. It is model card disclosures of failure modes, AI vulnerability databases and the agentic risk catalogue, and it is more fragmented.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c4\" value=\"0\"><span>No correlation of any kind.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c4\" value=\"1\"><span>Software vulnerabilities only.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c4\" value=\"2\"><span>Software vulnerabilities plus model card failure modes reviewed at selection.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"c4\" value=\"3\"><span>Both, reviewed on a cadence rather than once, against a named catalogue.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s4\">\n            <div class=\"ab-snum\">H<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Hardware<\/h2>\n                <p>Accelerator configuration and the infrastructure needed to reproduce or operate the model.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you record the accelerator configuration a model was trained on?<\/p>\n                <p class=\"ab-help\">Reproduction and cost both depend on it, and it is the category most often omitted because it feels like infrastructure detail rather than provenance.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h1\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h1\" value=\"1\"><span>Broadly, by environment.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h1\" value=\"2\"><span>Recorded for production models.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h1\" value=\"3\"><span>Recorded, with the configuration needed to reproduce stated explicitly.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you record what is required to operate the model, as against to train it?<\/p>\n                <p class=\"ab-help\">A buyer or a regulator asking about resilience is asking this question. It is also the question that decides whether you could move the workload.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h2\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h2\" value=\"1\"><span>Known informally by the platform team.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h2\" value=\"2\"><span>Documented for production systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h2\" value=\"3\"><span>Documented, and tested by running the model somewhere else at least once.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">For hosted models, do you know which jurisdiction the compute sits in?<\/p>\n                <p class=\"ab-help\">This is where the bill of materials meets the placement discipline, and where an answer of we assume so is not an answer.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h3\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h3\" value=\"1\"><span>We assume, based on the region we selected.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h3\" value=\"2\"><span>Confirmed contractually for our main providers.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"h3\" value=\"3\"><span>Confirmed contractually for all providers, including where support access originates.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s5\">\n            <div class=\"ab-snum\">P<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Data Processing<\/h2>\n                <p>Transformations, anonymisation techniques, and output preprocessing at inference.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Are the transformations applied to training data recorded?<\/p>\n                <p class=\"ab-help\">Distinct from preprocessing methodology: this is what actually happened to the data, not what the method says should happen.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p1\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p1\" value=\"1\"><span>Partially.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p1\" value=\"2\"><span>Recorded for production models.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p1\" value=\"3\"><span>Recorded and reproducible from the record.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Are anonymisation or differential privacy techniques and their parameters recorded?<\/p>\n                <p class=\"ab-help\">A privacy technique without its parameters is a claim. The parameter is what determines whether the claim holds.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p2\" value=\"0\"><span>Not recorded, or not used.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p2\" value=\"1\"><span>Technique named, parameters not recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p2\" value=\"2\"><span>Technique and parameters recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p2\" value=\"3\"><span>Recorded, with the privacy position reviewed by someone qualified to review it.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Is the output processing applied at inference recorded?<\/p>\n                <p class=\"ab-help\">Filters, guardrails and post processing change what the system does. A bill of materials describing only the model describes something the user never met.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p3\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p3\" value=\"1\"><span>Known to the team, not recorded.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p3\" value=\"2\"><span>Recorded for production systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"p3\" value=\"3\"><span>Recorded, version controlled, and changes are logged with the reason.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s6\">\n            <div class=\"ab-snum\">G<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Governance<\/h2>\n                <p>Model card, bias and fairness evaluation, safety testing results and change history.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Does every production model have a model card?<\/p>\n                <p class=\"ab-help\">Including the ones you did not build, where the provider&#8217;s card is the artefact and its gaps are your findings.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g1\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g1\" value=\"1\"><span>For some systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g1\" value=\"2\"><span>For all production systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g1\" value=\"3\"><span>For all production systems, kept current when the model changes.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you hold bias and fairness evaluation results?<\/p>\n                <p class=\"ab-help\">Article 10 expects examination for bias. The Omnibus now expressly permits processing the attributes you need in order to do it.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g2\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g2\" value=\"1\"><span>Conducted once, at selection.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g2\" value=\"2\"><span>Conducted and retained for high risk systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g2\" value=\"3\"><span>Conducted, retained, and repeated when the model or the population changes.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Do you hold safety testing results, including adversarial testing?<\/p>\n                <p class=\"ab-help\">For an agentic system this includes goal hijacking and tool misuse, which are named risks in the agentic catalogue rather than general robustness.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g3\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g3\" value=\"1\"><span>Functional testing only.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g3\" value=\"2\"><span>Adversarial testing for the highest autonomy systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g3\" value=\"3\"><span>Adversarial testing on a cadence, with findings tracked to closure.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Is there a change history that records what changed, when, and who approved it?<\/p>\n                <p class=\"ab-help\">Annex IV asks for change documentation through the lifecycle. This is the category that makes the other five auditable rather than merely present.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g4\" value=\"0\"><span>No.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g4\" value=\"1\"><span>Partial, in tickets.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g4\" value=\"2\"><span>Maintained for production systems.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"g4\" value=\"3\"><span>Maintained, with approver identity recorded and linked to the governance council decision.<\/span><\/label>\n            <\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-sec\">\n        <div class=\"ab-shead s0\">\n            <div class=\"ab-snum\">i<\/div>\n            <div class=\"ab-stitle\">\n                <h2>Format, signing, generation and scope<\/h2>\n                <p>Context rather than category score. These four decide whether the file works at all.<\/p>\n            <\/div>\n        <\/div>\n        <div class=\"ab-sbody\">\n            <div class=\"ab-locked\">\n                <b>These four answers change the result more than any single category score.<\/b> Format decides whether a buyer can ingest your file at all. Signing decides whether they can trust it. Generation path decides whether it is still true next month. Scope decides whether the score means anything.\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Which specification do you produce, or intend to produce?<\/p>\n                <p class=\"ab-help\">Two formats reached production maturity. The choice is not neutral and it is worth making deliberately rather than by whichever tool you found first. <span class=\"ab-cite\">CycloneDX ML BOM v1.7, SPDX 3.0 AI Profile<\/span><\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-fmt\" value=\"cdx\"><span>CycloneDX ML BOM v1.7. Signature carried in the document, version and serial number first class, strongest tooling for continuous generation.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-fmt\" value=\"spdx\"><span>SPDX 3.0 AI Profile. Usually needs an external signing envelope, but has an explicit convention for unknown as against omitted.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-fmt\" value=\"both\"><span>Both, or we normalise between them on ingestion.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-fmt\" value=\"own\"><span>Our own internal format or a spreadsheet.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-fmt\" value=\"none\"><span>None. We do not produce a structured bill of materials.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">Is the artefact cryptographically signed, and is the key verifiable?<\/p>\n                <p class=\"ab-help\">The published baseline is a document signed by the supplier with a key verifiable through known public infrastructure. Suppliers who cannot meet it are being filtered at procurement.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-sign\" value=\"0\"><span>Not signed.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-sign\" value=\"1\"><span>Signed with an internal key that an external party could not verify.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-sign\" value=\"2\"><span>Signed, with the key verifiable through public infrastructure.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-sign\" value=\"3\"><span>Signed and verifiable, with risk findings attached either in the document or as a parallel exploitability statement.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">How is the artefact produced?<\/p>\n                <p class=\"ab-help\">The single strongest predictor of whether the file is current. A manual artefact cannot keep pace with retraining, and the book&#8217;s whole argument is about the difference between months and days.<\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-gen\" value=\"0\"><span>It does not exist yet.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-gen\" value=\"1\"><span>By hand, per deployment, when somebody asks.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-gen\" value=\"2\"><span>By hand, on a schedule, whether or not anybody asks.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-gen\" value=\"3\"><span>Generated automatically in the build or deployment pipeline, so it cannot drift from what is running.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-q\">\n                <p class=\"ab-qlabel\">What proportion of production AI systems are covered?<\/p>\n                <p class=\"ab-help\">The three step rollout in Chapter 8 starts with one high risk system, extends to all production systems, then extends to vendor procurement. Say honestly which step you are on. <span class=\"ab-cite\">Chapter 8<\/span><\/p>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-scope\" value=\"0\"><span>None yet.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-scope\" value=\"1\"><span>One system, typically our highest risk one. Step one of three.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-scope\" value=\"2\"><span>All production systems. Step two of three.<\/span><\/label>\n                <label class=\"ab-opt\"><input type=\"radio\" name=\"q-scope\" value=\"3\"><span>All production systems and it is a standard term in vendor requests for proposal. Step three of three.<\/span><\/label>\n            <\/div>\n            <div class=\"ab-fields\">\n                <div class=\"ab-f\">\n                    <label for=\"ab-org\">Organisation or portfolio assessed\n                        <span class=\"ab-hint2\">Labels the output only.<\/span>\n                    <\/label>\n                    <input type=\"text\" id=\"ab-org\" value=\"Group Technology\">\n                <\/div>\n                <div class=\"ab-f\">\n                    <label for=\"ab-owner\">Named owner accountable for the bill of materials\n                        <span class=\"ab-hint2\">A person and a role. An unowned artefact goes stale silently.<\/span>\n                    <\/label>\n                    <input type=\"text\" id=\"ab-owner\" value=\"\" placeholder=\"For example, D. Park, Head of Platform Security\">\n                <\/div>\n                <div class=\"ab-f\">\n                    <label for=\"ab-count\">Production AI systems in scope\n                        <span class=\"ab-hint2\">From the Agent Inventory. Drives the effort estimate.<\/span>\n                    <\/label>\n                    <input type=\"number\" id=\"ab-count\" value=\"12\" min=\"0\" step=\"1\" inputmode=\"numeric\">\n                <\/div>\n                <div class=\"ab-f\">\n                    <label for=\"ab-hr\">Of those, how many are high risk or Annex III\n                        <span class=\"ab-hint2\">These are the ones where Article 11 and Annex IV documentation is enforceable.<\/span>\n                    <\/label>\n                    <input type=\"number\" id=\"ab-hr\" value=\"3\" min=\"0\" step=\"1\" inputmode=\"numeric\">\n                <\/div>\n            <\/div>\n        <\/div>\n    <\/div>\n\n<\/div>\n<\/div>\n\n<div class=\"ab-progress\">\n    <div class=\"ab-pinner\">\n        <p class=\"ab-ptext\" id=\"ab-prog\"><b>0<\/b><span id=\"ab-progl\"> of 26 answered<\/span><\/p>\n        <span class=\"ab-bar\"><i id=\"ab-fill\"><\/i><\/span>\n        <button type=\"button\" class=\"ab-clear\" id=\"ab-clearbtn\">Clear<\/button>\n        <button type=\"button\" class=\"ab-go\" id=\"ab-go\" disabled>Score Readiness<\/button>\n    <\/div>\n<\/div>\n\n<div class=\"ab-result\" id=\"ab-result\">\n<div class=\"ab-wide\">\n\n    <div class=\"ab-panel ab-ask\">\n        <h3 id=\"ab-askh\">The ask<\/h3>\n        <p class=\"ab-sub\">The decision, the category to fix, the time to produce a file and the owner, in the order a board wants them. Everything below is the evidence.<\/p>\n        <div id=\"ab-asklist\"><\/div>\n    <\/div>\n\n    <div class=\"ab-verdict\" id=\"ab-verdict\">\n        <p class=\"ab-vtop\" id=\"ab-vtop\">Readiness position<\/p>\n        <h2 class=\"ab-vname\" id=\"ab-vname\">Not started<\/h2>\n        <p class=\"ab-vscore\" id=\"ab-vscore\"><\/p>\n        <p class=\"ab-vread\" id=\"ab-vread\"><\/p>\n        <div class=\"ab-bars\" id=\"ab-bars\"><\/div>\n    <\/div>\n\n    <div class=\"ab-grid2\">\n        <div class=\"ab-panel\">\n            <h3>Time to produce the file on request<\/h3>\n            <p class=\"ab-sub\">The figure Chapter 8 frames as the whole point: organisations without coverage face documentation cycles measured in months, those with it complete the same cycle in days. Derived from coverage, generation path and the number of systems in scope.<\/p>\n            <p class=\"ab-big\" id=\"ab-time\">Unknown<\/p>\n            <p class=\"ab-sub\" style=\"margin-bottom:14px !important;\">estimated elapsed time for one high risk system<\/p>\n            <p class=\"ab-big\" id=\"ab-timeall\">Unknown<\/p>\n            <p class=\"ab-sub\" style=\"margin-bottom:0 !important;\">estimated elapsed time if a regulator asks for the whole portfolio<\/p>\n            <div class=\"ab-note info\" id=\"ab-timenote\"><\/div>\n        <\/div>\n        <div class=\"ab-panel\">\n            <h3>Would you pass a vendor qualification<\/h3>\n            <p class=\"ab-sub\">Scored against the published 2026 baseline: a machine readable document in a recognised specification, cryptographically signed with a verifiable key, ingestible without manual transformation, and current.<\/p>\n            <p class=\"ab-big\" id=\"ab-proc\">Not assessed<\/p>\n            <p class=\"ab-sub\" style=\"margin-bottom:0 !important;\">procurement verdict on the four gate tests<\/p>\n            <div id=\"ab-proclist\"><\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-panel\">\n        <h3>What to fix first, specifically<\/h3>\n        <p class=\"ab-sub\">The lowest scoring checks inside the weakest category. These are the questions where a point is available in the only category that changes your readiness position.<\/p>\n        <div id=\"ab-actions\"><\/div>\n    <\/div>\n\n    <div class=\"ab-panel\">\n        <h3>Your format choice, and what it commits you to<\/h3>\n        <p class=\"ab-sub\">Two specifications reached production maturity and they differ in ways that matter once a buyer tries to ingest your file.<\/p>\n        <div id=\"ab-format\"><\/div>\n    <\/div>\n\n    <div class=\"ab-panel\">\n        <h3>The five questions to put to your own vendors<\/h3>\n        <p class=\"ab-sub\">From Chapter 8. These are the procurement filter that separates a supplier operating at the 2026 standard from one operating at the 2024 standard. Ask them in this order.<\/p>\n        <div class=\"ab-hint\">Swipe the table sideways to see every column.<\/div>\n        <div class=\"ab-scroll\">\n        <table class=\"ab-tbl\">\n            <thead><tr><th>Question<\/th><th>What a good answer looks like<\/th><th>What the answer tells you<\/th><\/tr><\/thead>\n            <tbody id=\"ab-vendor\"><\/tbody>\n        <\/table>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-panel\">\n        <h3>Do your own answers agree with each other?<\/h3>\n        <p class=\"ab-sub\">Individually plausible answers can still contradict one another, and in this area the contradiction usually shows up in front of a buyer.<\/p>\n        <div id=\"ab-coherence\"><\/div>\n    <\/div>\n\n    <div class=\"ab-grid2\">\n        <div class=\"ab-panel\">\n            <h3>Confidence in this reading<\/h3>\n            <p class=\"ab-sub\">Graded on whether the score would survive somebody asking to see the artefact, rather than on how good the score looks.<\/p>\n            <div class=\"ab-grade gA\" id=\"ab-grade\">A<\/div>\n            <p class=\"ab-big\" style=\"font-size:20px !important;\" id=\"ab-gradelabel\">Evidenced<\/p>\n            <ul id=\"ab-conflist\" style=\"margin:12px 0 0 0 !important;padding-left:20px !important;\"><\/ul>\n            <div class=\"ab-note info\" id=\"ab-confnote\"><\/div>\n        <\/div>\n        <div class=\"ab-panel\">\n            <h3>The reading a buyer would take<\/h3>\n            <p class=\"ab-sub\">Self reported coverage discounted, because coverage claimed from memory is the most inflated figure in this category of assessment.<\/p>\n            <p class=\"ab-big\" id=\"ab-chal\">0<\/p>\n            <p class=\"ab-sub\" style=\"margin-bottom:14px !important;\">challenged readiness, out of 3<\/p>\n            <p class=\"ab-big\" id=\"ab-chalcat\">None<\/p>\n            <p class=\"ab-sub\" style=\"margin-bottom:0 !important;\">weakest category on the challenged reading<\/p>\n            <div class=\"ab-note ok\" id=\"ab-chalnote\"><\/div>\n        <\/div>\n    <\/div>\n\n    <div class=\"ab-panel\">\n        <h3>Board paper<\/h3>\n        <p class=\"ab-sub\">Written to be pasted into a board, risk or audit committee paper without editing. Replace the bracketed fields before circulating.<\/p>\n        <div class=\"ab-card\" id=\"ab-cardtext\"><\/div>\n        <div class=\"ab-btnrow\">\n            <button type=\"button\" class=\"ab-btn gold\" id=\"ab-copy\">Copy the paper<\/button>\n            <button type=\"button\" class=\"ab-btn\" id=\"ab-print\">Print or save as PDF<\/button>\n            <button type=\"button\" class=\"ab-btn ghost\" id=\"ab-again\">Back to the inputs<\/button>\n        <\/div>\n    <\/div>\n\n<\/div>\n<\/div>\n\n<div class=\"ab-next\">\n<div class=\"ab-wide\">\n    <h3>Turn the score into the artefact<\/h3>\n    <p class=\"ab-sub\">A readiness band is a diagnosis. These are the instruments that close it.<\/p>\n    <div class=\"ab-grid3\">\n        <div class=\"ab-tile\">\n            <h4>The full forty six check assessment<\/h4>\n            <p>This page is the fast diagnostic. The AIBOM Readiness Checklist carries forty six scored checks across the same six domains, format selection guidance, readiness bands, and the procurement clause language to require a bill of materials from your own suppliers.<\/p>\n            <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=748#war-downloads-section\">Get the checklist<\/a>\n        <\/div>\n        <div class=\"ab-tile\">\n            <h4>The cryptographic equivalent<\/h4>\n            <p>Executive Order 14412 directs guidance on a Cryptographic Bill of Materials, a machine readable inventory of cryptographic assets. The companion workbook scores your readiness against it now, while it is cheap, and answers the FIPS 140-3 procurement question that is already live.<\/p>\n            <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=748#war-downloads-section\">Get the workbook<\/a>\n        <\/div>\n        <div class=\"ab-tile\">\n            <h4>Where the file gets used<\/h4>\n            <p>A bill of materials is an input to the Annex IV technical documentation, not a substitute for it. The Regulatory Evidence Pack Template sets out the full structure and the one day test, and the Framework Crosswalk maps each control area to the article, function and clause a buyer questionnaire will cite.<\/p>\n            <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=748#war-downloads-section\">Get the instruments<\/a>\n        <\/div>\n    <\/div>\n<\/div>\n<\/div>\n\n<noscript>\n<div class=\"ab-manual\">\n<div class=\"ab-inner\">\n    <h3>Scoring this by hand<\/h3>\n    <p style=\"font-size:14.5px !important;color:#444 !important;line-height:1.7 !important;\">Interactive scoring is unavailable in your browser. The method is unchanged.<\/p>\n    <ol style=\"font-size:14.5px !important;color:#444 !important;line-height:1.85 !important;\">\n        <li>Each answer above scores in the order shown: the first option scores 0, then 1, 2, and the last 3.<\/li>\n        <li>Average the answers within each of the six categories. Each category scores from 0 to 3.<\/li>\n        <li><b>Your readiness position is the lowest category, not the average of the six.<\/b> An auditor asks for the file, and a file with five strong categories and one absent is a file with a hole in it. The request will land on the hole.<\/li>\n        <li>That lowest category is the one to fix first. Inside it, the lowest scoring individual checks are the specific work.<\/li>\n        <li>Then apply the four context answers, which decide whether the file works at all. Format decides whether a buyer can ingest it. Signing decides whether they can trust it. Generation path decides whether it is still true next month. Scope decides whether the score means anything.<\/li>\n        <li>For the procurement verdict, all four of these must hold: a recognised specification rather than your own format, a signature verifiable outside your organisation, generation that does not depend on somebody remembering, and coverage of more than one system.<\/li>\n    <\/ol>\n    <div class=\"ab-scroll\">\n    <table class=\"ab-tbl\" style=\"margin-top:14px !important;\">\n        <thead><tr><th>Weakest category<\/th><th>Band<\/th><th>What it means for a request<\/th><\/tr><\/thead>\n        <tbody>\n            <tr><td>2.5 to 3.0<\/td><td>Export ready<\/td><td>You would be assembling an existing structure. Documentation cycles in days.<\/td><\/tr>\n            <tr><td>1.8 to 2.4<\/td><td>Assemblable<\/td><td>The file can be produced but it takes people and time. Cycles in weeks.<\/td><\/tr>\n            <tr><td>1.0 to 1.7<\/td><td>Partial<\/td><td>Real gaps a buyer will find. Cycles in months, and the gaps become findings.<\/td><\/tr>\n            <tr><td>0 to 0.9<\/td><td>Absent<\/td><td>There is no file. A request would start a project, not a retrieval.<\/td><\/tr>\n        <\/tbody>\n    <\/table>\n    <\/div>\n    <p style=\"font-size:14.5px !important;color:#444 !important;line-height:1.7 !important;margin-top:14px !important;\"><b>The one thing to carry away.<\/b> The generation path matters more than the score. A bill of materials produced by hand cannot keep pace with retraining, so a high score produced manually describes a file that was true when it was written and is not true now. Automation in the build pipeline is the only version that stays correct.<\/p>\n<\/div>\n<\/div>\n<\/noscript>\n\n<div class=\"ab-cta\">\n    <h3>A bill of materials is how an audit becomes ordinary operations<\/h3>\n    <p>Without it, logging captures what happened but not what was running when it happened.<\/p>\n    <div class=\"ab-ctarow\">\n        <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=748\">The book page<\/a>\n        <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=748#war-downloads-section\">Free toolkit<\/a>\n        <a href=\"https:\/\/www.amazon.com\/dp\/B0H85XZT25\">Get the book<\/a>\n        <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=14\">Advisory services<\/a>\n        <a href=\"https:\/\/www.opey.org\/opeyit\/?page_id=327\">When Clouds Fail<\/a>\n    <\/div>\n<\/div>\n\n<div class=\"ab-fine\">\n    <p><b>About this assessment.<\/b> The AI Bill of Materials and its six categories are set out in Chapter 8 of When Agents Rule by Steven Oppenheim. This tool is a self assessment instrument, not an audit, a certification or a benchmark, and it reflects what you tell it: a generous reading produces a flattering result and no useful information. Readiness is deliberately reported as the weakest of the six categories rather than their average, for the reason given on this page. No peer comparison is offered because no dataset underlies this instrument.<br><br>\n    <b>On the standards referenced.<\/b> CycloneDX ML BOM is maintained under the OWASP project and the SPDX AI Profile under the Linux Foundation; both continue to change, so verify the current specification before committing to a schema. The time to produce estimates are derived from your own answers and are planning figures, not commitments. Whether Article 11 and Annex IV documentation obligations apply to a given system is a legal determination for qualified counsel, and Regulation (EU) 2026\/1744 moved the high risk application dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I. Not legal, technical or financial advice. Nothing you enter leaves your browser: there is no account, no transmission and no storage.<\/p>\n<\/div>\n\n<\/div>\n<!-- End of #war-aibom-2026 -->\n\n<script>\n\/* AIBOM READINESS SCORER. No less than sign, no ampersand, no innerHTML,\n   no template literals, no arrow functions. *\/\n(function () {\n    var root = document.getElementById('war-aibom-2026');\n    if (!root) { return; }\n\n    var CATS = [\n      { key: 'models', name: 'Models', q: ['m1','m2','m3','m4'],\n        labels: ['Exact model version in production','Parent lineage and fine tuning history',\n                 'Provider bill of materials for third party models','Superseded versions retained'],\n        moves: ['Take the version from the deployment pipeline rather than from documentation, because documentation is a claim about the past and the pipeline is the present.',\n                'Record parent model and every fine tuning run with the dataset used at each stage. Without it an incident cannot be traced past the last training run.',\n                'Ask each provider for a machine readable bill of materials. Major providers have begun publishing them with model releases, so the request is now ordinary rather than unusual.',\n                'Set a retention period for superseded model versions tied to your own limitation periods, then keep to it. A decision you cannot reproduce is a decision you can only apologise for.'] },\n      { key: 'datasets', name: 'Datasets', q: ['d1','d2','d3','d4'],\n        labels: ['Training data sources named','Licensing terms held','Personal data identified with a lawful basis','Preprocessing recorded'],\n        moves: ['Name the sources for models you trained, and record the provider position for the rest. A refusal to disclose is an answer and belongs in the file.',\n                'Centralise licence records and confirm commercial use in writing. A dataset licensed for research does not become commercial by being fine tuned.',\n                'Identify personal data in training and record the lawful basis. The Omnibus now expressly permits processing special category data to detect and correct bias, which makes this easier rather than optional.',\n                'Version control preprocessing alongside the model. Two models trained on the same data with different preprocessing are different models.'] },\n      { key: 'code', name: 'Code', q: ['c1','c2','c3','c4'],\n        labels: ['Software bill of materials for the stack','Evaluation harness retained',\n                 'Dependency versions at training time','AI specific risk correlation'],\n        moves: ['Extend the software bill of materials you already generate rather than building a parallel process. The machine learning profiles are explicitly designed to integrate with existing tooling.',\n                'Retain the evaluation harness and make it re runnable. An accuracy claim without the harness that produced it is a marketing claim.',\n                'Pin and record dependency versions at training time. The library version that produced the weights is part of the provenance and it changes under you silently.',\n                'Correlate against model card failure modes and the agentic risk catalogue, not only the vulnerability feed. The correlation surface here is more fragmented and it will not find itself.'] },\n      { key: 'hardware', name: 'Hardware', q: ['h1','h2','h3'],\n        labels: ['Training accelerator configuration','What is needed to operate it','Jurisdiction of the compute'],\n        moves: ['Record the accelerator configuration a model was trained on. It is the category most often omitted because it feels like infrastructure rather than provenance, and it is both.',\n                'Document what it takes to operate the model, then prove it by running the model somewhere else once. Until you have, portability is a hypothesis.',\n                'Confirm the compute jurisdiction contractually, including where support access originates. We assume so is not an answer to this question.'] },\n      { key: 'processing', name: 'Data Processing', q: ['p1','p2','p3'],\n        labels: ['Transformations recorded','Anonymisation technique and parameters','Output processing at inference'],\n        moves: ['Record what actually happened to the data, not what the method says should happen, and make it reproducible from the record.',\n                'Record the privacy technique and its parameters. A technique without its parameter is a claim, and the parameter is what decides whether the claim holds.',\n                'Record and version the filters and guardrails applied at inference. A file describing only the model describes something your user never met.'] },\n      { key: 'governance', name: 'Governance', q: ['g1','g2','g3','g4'],\n        labels: ['Model card per production system','Bias and fairness results','Safety and adversarial testing','Change history with approver'],\n        moves: ['Produce a model card for every production system, including the ones you did not build, where the provider card is the artefact and its gaps are your findings.',\n                'Conduct and retain bias evaluation, and repeat it when the model or the population changes. Once at selection is a snapshot, not a control.',\n                'Add adversarial testing for the highest autonomy systems, covering goal hijacking and tool misuse rather than general robustness, and track findings to closure.',\n                'Maintain a change history with the approver recorded and linked to the governance decision. This is the category that makes the other five auditable rather than merely present.'] }\n    ];\n    var CTX = ['q-fmt','q-sign','q-gen','q-scope'];\n    var ALLQ = [];\n    var ci = 0;\n    for (ci = 0; ci !== CATS.length; ci++) { ALLQ = ALLQ.concat(CATS[ci].q); }\n\n    var BANDS = [\n      { min: 2.5, label: 'Export ready', read: 'You would be assembling an existing structure rather than building one. Documentation cycles in days, which is the position Chapter 8 describes as the payoff.' },\n      { min: 1.8, label: 'Assemblable', read: 'The file can be produced but it costs people and elapsed time. Cycles in weeks. Survivable for one request and not for a portfolio review.' },\n      { min: 1.0, label: 'Partial', read: 'Real gaps that a buyer or an auditor will find, because the request lands on the gap rather than on the coverage. Cycles in months, and the gaps become findings.' },\n      { min: 0, label: 'Absent', read: 'There is no file. A request would start a project rather than a retrieval, and the project would run while the clock did.' }\n    ];\n\n    function goTo(n) {\n        if (!n.scrollIntoView) { return; }\n        try { n.scrollIntoView({ behavior: 'smooth', block: 'start' }); } catch (ex) { try { n.scrollIntoView(true); } catch (ex2) { } }\n    }\n    function el(id) { return document.getElementById(id); }\n    function mk(tag, cls, txt) {\n        var n = document.createElement(tag);\n        if (cls) { n.className = cls; }\n        if (txt !== undefined) { if (txt !== null) { n.textContent = txt; } }\n        return n;\n    }\n    function clear(n) { while (n.firstChild) { n.removeChild(n.firstChild); } }\n    function pick(name) {\n        var h = root.querySelector('input[name=\"' + name + '\"]:checked');\n        if (!h) { return null; }\n        return h.value;\n    }\n    function num(id) { var v = parseFloat(el(id).value); if (isNaN(v)) { return 0; } if (0 > v) { return 0; } return Math.round(v); }\n    function answered() {\n        var n = 0; var i = 0;\n        for (i = 0; i !== ALLQ.length; i++) { if (pick(ALLQ[i]) !== null) { n = n + 1; } }\n        for (i = 0; i !== CTX.length; i++) { if (pick(CTX[i]) !== null) { n = n + 1; } }\n        return n;\n    }\n    function refresh() {\n        var n = answered();\n        var total = ALLQ.length + CTX.length;\n        el('ab-prog').firstChild.textContent = '' + n;\n        el('ab-progl').textContent = ' of ' + total + ' answered';\n        el('ab-fill').style.width = Math.round(n \/ total * 100) + '%';\n        if (n === total) { el('ab-go').removeAttribute('disabled'); }\n        else { el('ab-go').setAttribute('disabled', 'disabled'); }\n    }\n    function bandOf(s) {\n        var i = 0;\n        for (i = 0; i !== BANDS.length; i++) { if (s + 0.0001 >= BANDS[i].min) { return BANDS[i]; } }\n        return BANDS[BANDS.length - 1];\n    }\n    function fmt1(x) { return (Math.round(x * 10) \/ 10).toFixed(1); }\n    \/* Singular and plural handled. Days stay days up to two working weeks. *\/\n    function phrase(dys) {\n        var w = 0; var m = 0;\n        if (11 > dys) { return dys + ((dys === 1) ? ' working day' : ' working days'); }\n        if (43 > dys) { w = Math.round(dys \/ 5); return w + ((w === 1) ? ' week' : ' weeks'); }\n        m = Math.round(dys \/ 21);\n        if (m > 24) { return 'more than 2 years'; }\n        return m + ((m === 1) ? ' month' : ' months');\n    }\n\n    function compute() {\n        var i = 0; var j = 0;\n        var scores = []; var detail = [];\n        for (i = 0; i !== CATS.length; i++) {\n            var tot = 0; var d = [];\n            for (j = 0; j !== CATS[i].q.length; j++) {\n                var v = parseInt(pick(CATS[i].q[j]), 10);\n                if (isNaN(v)) { v = 0; }\n                tot = tot + v;\n                d.push({ idx: j, val: v, label: CATS[i].labels[j], move: CATS[i].moves[j] });\n            }\n            scores.push(tot \/ CATS[i].q.length);\n            detail.push(d);\n        }\n        var weak = 0;\n        for (i = 1; i !== scores.length; i++) { if (scores[weak] > scores[i]) { weak = i; } }\n        var readiness = scores[weak];\n        var band = bandOf(readiness);\n        var avg = 0;\n        for (i = 0; i !== scores.length; i++) { avg = avg + scores[i]; }\n        avg = avg \/ scores.length;\n\n        var fmt = pick('q-fmt');\n        var sign = parseInt(pick('q-sign'), 10);\n        var gen = parseInt(pick('q-gen'), 10);\n        var scope = parseInt(pick('q-scope'), 10);\n        var org = el('ab-org').value;\n        if (org) { org = org.replace(\/\\s+\/g, ' ').replace(\/^ | $\/g, ''); }\n        if (!org) { org = 'This portfolio'; }\n        var owner = el('ab-owner').value;\n        if (owner) { owner = owner.replace(\/\\s+\/g, ' ').replace(\/^ | $\/g, ''); }\n        var ownerOK = false;\n        if (owner) { if (owner.length > 7) { if (owner.indexOf(' ') !== -1) { ownerOK = true; } } }\n        var count = num('ab-count');\n        var hr = num('ab-hr');\n\n        var vcls = 'vbad';\n        if (readiness >= 2.5) { vcls = 'vgood'; }\n        else { if (readiness >= 1.8) { vcls = 'vmid'; } }\n        el('ab-verdict').className = 'ab-verdict ' + vcls;\n        el('ab-vtop').textContent = 'Readiness position for ' + org;\n        el('ab-vname').textContent = band.label + ', held back by ' + CATS[weak].name;\n        el('ab-vscore').textContent = 'Weakest category ' + fmt1(readiness) + ' of 3, which is ' +\n            CATS[weak].name + '. The average of the six is ' + fmt1(avg) +\n            ', and it is not the number a request will land on.';\n        el('ab-vread').textContent = band.read + ' ' + CATS[weak].name + ' is the category to fix first, and the specific checks are named below.';\n\n        var bars = el('ab-bars'); clear(bars);\n        for (i = 0; i !== CATS.length; i++) {\n            var row = mk('div', 'ab-brow');\n            row.appendChild(mk('div', 'ab-blabel', CATS[i].name));\n            var track = mk('div', 'ab-btrack');\n            var f = 'f1';\n            if (scores[i] >= 2.5) { f = 'f2'; }\n            if (1.0 > scores[i]) { f = 'f0'; }\n            var fill = mk('div', 'ab-bfill ' + f);\n            fill.style.width = Math.round(scores[i] \/ 3 * 100) + '%';\n            track.appendChild(fill);\n            row.appendChild(track);\n            row.appendChild(mk('div', 'ab-bval', fmt1(scores[i]) + ' \/ 3'));\n            row.appendChild(mk('div', 'ab-bbind', (i === weak) ? 'fix first' : ''));\n            bars.appendChild(row);\n        }\n\n        var baseDays = 40;\n        if (readiness >= 2.5) { baseDays = 2; }\n        else {\n            if (readiness >= 1.8) { baseDays = 8; }\n            else { if (readiness >= 1.0) { baseDays = 20; } }\n        }\n        var genMult = 1;\n        if (gen === 0) { genMult = 3; }\n        if (gen === 1) { genMult = 2; }\n        if (gen === 2) { genMult = 1.4; }\n        if (gen === 3) { genMult = 0.6; }\n        var scopeMult = 1;\n        if (scope === 0) { scopeMult = 1.6; }\n        if (scope === 1) { scopeMult = 1.2; }\n        var oneDays = Math.ceil(baseDays * genMult * scopeMult);\n        var n = count;\n        if (1 > n) { n = 1; }\n        \/* Diminishing marginal effort: the first file is the expensive one and later\n           files reuse its structure, so effort grows with the log of system count. *\/\n        var allDays = Math.ceil(oneDays * (1 + 0.8 * Math.log(n)));\n        el('ab-time').textContent = phrase(oneDays);\n        el('ab-timeall').textContent = phrase(allDays);\n        el('ab-time').className = (oneDays > 10) ? 'ab-big neg' : 'ab-big';\n        el('ab-timeall').className = (allDays > 60) ? 'ab-big neg' : 'ab-big';\n        var tn = el('ab-timenote');\n        if (4 > oneDays) {\n            tn.className = 'ab-note ok';\n            tn.textContent = 'This is the position the chapter argues for: an audit cycle that is ordinary operations rather than a scramble. Protect it by keeping generation in the pipeline, because the moment it becomes a manual step this figure reverts.';\n        } else {\n            if (allDays > 60) {\n                tn.className = 'ab-note warn';\n                tn.textContent = 'A portfolio response measured in ' + phrase(allDays) +\n                    ' is longer than most regulatory and customer response windows. Article 73 allows fifteen days from awareness for a serious incident report, and an evidence path this slow consumes the whole window before the investigation starts. The single highest leverage change is the generation path, not the category scores.';\n            } else {\n                tn.className = 'ab-note caution';\n                tn.textContent = 'Survivable for one request and not for a portfolio review. These are planning figures derived from your own answers, so treat them as an order of magnitude rather than a commitment, and test one by actually asking for a file and timing it.';\n            }\n        }\n\n        var gates = [\n          { pass: (fmt === 'cdx' || fmt === 'spdx' || fmt === 'both'),\n            name: 'A recognised specification',\n            fail: 'Your own format or a spreadsheet cannot be ingested by a buyer without manual transformation, which is the thing the baseline exists to avoid. Adopt CycloneDX ML BOM or the SPDX AI Profile.',\n            ok: 'You produce a recognised specification, so a buyer can ingest it into existing tooling.' },\n          { pass: (sign >= 2),\n            name: 'A signature verifiable outside your organisation',\n            fail: 'An unsigned document, or one signed with a key nobody outside can verify, does not establish provenance. The published baseline expects a supplier signature with the key verifiable through known public infrastructure.',\n            ok: 'The artefact is signed with a key that can be verified externally, which is what establishes provenance.' },\n          { pass: (gen >= 2),\n            name: 'Generation that does not depend on somebody remembering',\n            fail: 'An artefact produced by hand when somebody asks is out of date by definition, because the model retrains and the file does not. This is the gate most organisations fail.',\n            ok: 'Generation is scheduled or automated, so the file does not depend on a person remembering.' },\n          { pass: (scope >= 2),\n            name: 'Coverage beyond a single system',\n            fail: 'One system is step one of the three step rollout and a good place to be, but a buyer asking about the product you are selling them will not accept coverage of a different system.',\n            ok: 'Coverage extends across production systems rather than one pilot.' }\n        ];\n        var passed = 0;\n        for (i = 0; i !== gates.length; i++) { if (gates[i].pass) { passed = passed + 1; } }\n        el('ab-proc').textContent = passed + ' of 4';\n        el('ab-proc').className = (passed === 4) ? 'ab-big' : 'ab-big neg';\n        var pl = el('ab-proclist'); clear(pl);\n        for (i = 0; i !== gates.length; i++) {\n            var box = mk('div', 'ab-note ' + (gates[i].pass ? 'ok' : 'warn'));\n            box.appendChild(mk('b', null, gates[i].name + '. '));\n            box.appendChild(document.createTextNode(gates[i].pass ? gates[i].ok : gates[i].fail));\n            pl.appendChild(box);\n        }\n\n        var d2 = detail[weak].slice(0);\n        d2.sort(function (a, b) { if (a.val === b.val) { return a.idx - b.idx; } return a.val - b.val; });\n        var act = el('ab-actions'); clear(act);\n        var shown = 0;\n        for (i = 0; i !== d2.length; i++) {\n            if (shown === 3) { break; }\n            if (d2[i].val > 1) { continue; }\n            var b2 = mk('div', 'ab-note info');\n            b2.appendChild(mk('b', null, d2[i].label + ': ' + d2[i].val + ' of 3. '));\n            b2.appendChild(document.createTextNode(d2[i].move));\n            act.appendChild(b2);\n            shown = shown + 1;\n        }\n        if (shown === 0) {\n            act.appendChild(mk('div', 'ab-note ok', 'Every check inside ' + CATS[weak].name +\n              ' scores 2 or 3, so there is no single weak check to name. The category is your lowest only because the others are higher, which means the next move is the generation path rather than any category, and the estimate above will tell you whether that is worth doing.'));\n        }\n\n        var fm = el('ab-format'); clear(fm);\n        if (fmt === 'cdx') {\n            fm.appendChild(mk('div', 'ab-note ok',\n              'CycloneDX ML BOM v1.7. This is the practical choice for continuous generation, and it is the one the OWASP project maintains. It carries the author signature inside the document and treats document version and serial number as first class fields, so a buyer can tell two revisions apart without an external register. The one thing to settle explicitly with consumers is the convention for a field that is unknown as against one that does not apply, because an omission read as not applicable is a finding waiting to happen.'));\n        }\n        if (fmt === 'spdx') {\n            fm.appendChild(mk('div', 'ab-note ok',\n              'SPDX 3.0 AI Profile. The advantage is an explicit convention for unknown as against omitted, which removes the ambiguity that causes disputes on ingestion. The cost is that a signature normally needs an external envelope rather than travelling in the document, so decide now whether a detached signature or a public transparency log attestation is what you will offer, and say so in your procurement responses rather than leaving a buyer to ask.'));\n        }\n        if (fmt === 'both') {\n            fm.appendChild(mk('div', 'ab-note ok',\n              'Producing or normalising both is the strongest position and the most expensive one. It is worth it if you sell into buyers with different tooling. If you do not, pick one: maintaining two schemas for one portfolio means two chances for the file to drift from what is running.'));\n        }\n        if (fmt === 'own') {\n            fm.appendChild(mk('div', 'ab-note warn',\n              'An internal format or a spreadsheet fails the first procurement gate, because the baseline a buyer applies is a document ingestible into their existing supply chain tooling without manual transformation. The content you already hold is not wasted: map it to CycloneDX ML BOM v1.7 if you want continuous generation, or to the SPDX AI Profile if the unknown against omitted distinction matters more to your buyers. Mapping an existing structure is a short exercise. Building the content is the long one, and you have done that part.'));\n        }\n        if (fmt === 'none') {\n            fm.appendChild(mk('div', 'ab-note warn',\n              'No structured artefact yet. Start where Chapter 8 says to start: one system, the highest risk one, in CycloneDX ML BOM v1.7. Not the portfolio. The three step rollout exists because attempting full coverage on day one is the pattern that fails, and a single complete file teaches you what the other systems will cost.'));\n        }\n        fm.appendChild(mk('div', 'ab-note info',\n          'Whichever you choose, the baseline a buyer applies has four parts beyond the schema: the document is signed by the supplier with a key verifiable through known public infrastructure, it carries risk findings either embedded or as a parallel exploitability statement, it is machine ingestible without manual transformation, and it is current. Generation tooling is still less mature than for software bills of materials, so a manual artefact per deployment is common today. That is a reason to design for automation now rather than to wait for it.'));\n\n        var VQ = [\n          ['Does the vendor provide a bill of materials compliant with a recognised specification for the offered system?',\n           'A file, named specification and version, supplied before contract rather than promised after it.',\n           'Whether they have one at all. A promise to produce one on request usually means it does not exist.'],\n          ['What is the update cadence when the model is retrained or fine tuned?',\n           'Regenerated in their pipeline on every release, not quarterly and not on request.',\n           'Whether their file is generated or written. Only a generated file can answer this with a mechanism rather than an intention.'],\n          ['Which of the six categories are fully covered, partially covered, or omitted?',\n           'A per category answer with the omissions named. Omissions are acceptable; unnamed omissions are not.',\n           'Whether they have read their own artefact. A vendor who cannot answer per category has not.'],\n          ['What cryptographic provenance attestation is provided, and which signing authority backs it?',\n           'A signature verifiable through public infrastructure, with the authority named.',\n           'Whether provenance is verifiable or asserted. This is the question that separates the 2026 standard from the 2024 one.'],\n          ['How does the vendor handle updates when subcomponents in their own supply chain change?',\n           'A described mechanism for propagating an upstream change into their own file and notifying you.',\n           'Whether they treat their supply chain as their problem or yours. The answer predicts what happens when an upstream model is deprecated.']\n        ];\n        var vt = el('ab-vendor'); clear(vt);\n        for (i = 0; i !== VQ.length; i++) {\n            var tr = document.createElement('tr');\n            tr.appendChild(mk('td', null, (i + 1) + '. ' + VQ[i][0]));\n            tr.appendChild(mk('td', null, VQ[i][1]));\n            tr.appendChild(mk('td', null, VQ[i][2]));\n            vt.appendChild(tr);\n        }\n\n        var coh = [];\n        if (2 > gen) {\n            if (readiness >= 2.0) {\n                coh.push(['warn', 'Two of your answers pull against each other. You report category coverage at ' + fmt1(readiness) +\n                  ' of 3 while the artefact is produced by hand or not at all. A manually produced file was true when it was written and is not true now, because the model retrains and the document does not. Either the coverage figure describes a document rather than the systems, or it will be wrong by the next release. Treat the generation path as the finding rather than the score.']);\n            } else {\n                coh.push(['caution', 'The artefact is produced by hand or not yet at all. That is common and the tooling is genuinely immature, so it is not a criticism. It does mean the score above has a shelf life measured in weeks.']);\n            }\n        } else { coh.push(['ok', 'Generation is scheduled or automated, so the file does not depend on a person remembering, which is the single strongest predictor that it is still true.']); }\n        if (scope === 3) {\n            if (1.8 > readiness) {\n                coh.push(['warn', 'You report the artefact as a standard term in vendor requests for proposal while your own weakest category sits at ' + fmt1(readiness) +\n                  ' of 3. Requiring of suppliers what you could not produce yourself is a position that survives until the first supplier asks to see yours, and it is a poor place to be in a negotiation.']);\n            } else { coh.push(['ok', 'You require the artefact of suppliers and could produce your own to a comparable standard, which is step three of the rollout and an uncommon position.']); }\n        }\n        if (hr > count) {\n            coh.push(['warn', 'More high risk systems were entered than production systems in total, which cannot be right. Correct the counts, because the portfolio estimate is derived from them.']);\n        } else {\n            if (hr > 0) {\n                if (2 > scope) {\n                    coh.push(['caution', 'You have ' + hr + ' high risk ' + ((hr === 1) ? 'system' : 'systems') + ' and coverage of at most one. Article 11 and Annex IV documentation is enforceable for high risk systems, so the gap between ' + hr +\n                      ' and your coverage is the exposure, and the deferral to 2 December 2027 for Annex III systems is the window in which to close it rather than a reason not to.']);\n                } else { coh.push(['ok', 'Coverage extends across production systems, which includes your ' + hr + ' high risk ' + ((hr === 1) ? 'system' : 'systems') + ' where the documentation duty is enforceable.']); }\n            }\n        }\n        if (sign === 0) {\n            if (fmt !== 'none') { coh.push(['caution', 'You produce a structured artefact and do not sign it. Signing is the cheapest remaining improvement available here: the content is the hard part and you have done it, and an unsigned file establishes contents without establishing provenance.']); }\n        }\n        if (fmt === 'none') {\n            if (readiness >= 2.0) {\n                coh.push(['warn', 'You report strong category coverage and no structured bill of materials at all. The information may exist across several systems, but a buyer asks for one file. Until it is assembled into a recognised specification, the coverage is real and the artefact is not.']);\n            }\n        }\n        if (!ownerOK) {\n            if (!owner) { coh.push(['warn', 'No owner is named, so the artefact commits nobody and will go stale without anybody noticing.']); }\n            else { coh.push(['warn', 'The owner is recorded as \"' + owner + '\", which will not do for an artefact a buyer or a regulator may rely on. A full name and a role is the minimum.']); }\n        } else { coh.push(['ok', 'A named owner with a role is recorded, which is what keeps an artefact current between requests.']); }\n        var ch = el('ab-coherence'); clear(ch);\n        for (i = 0; i !== coh.length; i++) { ch.appendChild(mk('div', 'ab-note ' + coh[i][0], coh[i][1])); }\n\n        var pass = []; var fail = [];\n        if (gen >= 2) { pass.push('Generation is scheduled or automated, so the coverage claim describes what is running rather than what was written.'); }\n        else { fail.push('The artefact is produced by hand or not at all, so the coverage claim ages from the moment it is made.'); }\n        if (sign >= 2) { pass.push('The artefact is signed with an externally verifiable key, so provenance can be established rather than asserted.'); }\n        else { fail.push('Provenance is asserted rather than verifiable, so a buyer must take the contents on trust.'); }\n        if (fmt === 'cdx' || fmt === 'spdx' || fmt === 'both') { pass.push('A recognised specification is used, so a third party can ingest and check the file.'); }\n        else { fail.push('No recognised specification, so nobody outside can check the file without manual work.'); }\n        if (ownerOK) { pass.push('A named owner with a role is accountable for keeping it current.'); }\n        else { fail.push('No owner is recorded to a standard an external party would accept.'); }\n        var score4 = pass.length;\n        var grade = 'D'; var glabel = 'Not yet presentable';\n        if (score4 === 4) { grade = 'A'; glabel = 'Evidenced'; }\n        if (score4 === 3) { grade = 'B'; glabel = 'Defensible'; }\n        if (score4 === 2) { grade = 'C'; glabel = 'Challengeable'; }\n        el('ab-grade').className = 'ab-grade g' + grade;\n        el('ab-grade').textContent = grade;\n        el('ab-gradelabel').textContent = glabel;\n        var cl = el('ab-conflist'); clear(cl);\n        for (i = 0; i !== pass.length; i++) {\n            var lp = mk('li', null, pass[i]);\n            lp.style.color = '#14603c'; lp.style.fontSize = '13px'; lp.style.lineHeight = '1.55'; lp.style.marginBottom = '6px';\n            cl.appendChild(lp);\n        }\n        for (i = 0; i !== fail.length; i++) {\n            var lf = mk('li', null, fail[i]);\n            lf.style.color = '#922b21'; lf.style.fontSize = '13px'; lf.style.lineHeight = '1.55'; lf.style.marginBottom = '6px';\n            cl.appendChild(lf);\n        }\n        var cfn = el('ab-confnote');\n        if (grade === 'A') { cfn.className = 'ab-note ok'; cfn.textContent = 'All four tests pass. This reading can go to a board or into a procurement response as it stands.'; }\n        else {\n            if (grade === 'B') { cfn.className = 'ab-note caution'; cfn.textContent = 'Three of four tests pass. Close the remaining one before circulating; it is the line a buyer will probe.'; }\n            else {\n                if (grade === 'C') { cfn.className = 'ab-note caution'; cfn.textContent = 'Two of four tests pass. Present the challenged reading rather than the headline, and name what is still being built.'; }\n                else { cfn.className = 'ab-note warn'; cfn.textContent = 'Fewer than two tests pass. This is a working figure and not a board paper. Adopting a recognised specification and signing the file would move it two grades and neither is expensive.'; }\n            }\n        }\n\n        var hair = 0;\n        if (2 > gen) { hair = 0.7; }\n        if (sign === 0) { hair = hair + 0.3; }\n        var chScores = [];\n        for (i = 0; i !== scores.length; i++) {\n            var cs = scores[i] - hair;\n            if (0 > cs) { cs = 0; }\n            chScores.push(cs);\n        }\n        var chWeak = 0;\n        for (i = 1; i !== chScores.length; i++) { if (chScores[chWeak] > chScores[i]) { chWeak = i; } }\n        el('ab-chal').textContent = fmt1(chScores[chWeak]) + ' \/ 3';\n        el('ab-chalcat').textContent = CATS[chWeak].name;\n        el('ab-chal').className = (chScores[chWeak] >= 1.8) ? 'ab-big' : 'ab-big neg';\n        var chn = el('ab-chalnote');\n        if (hair === 0) {\n            chn.className = 'ab-note ok';\n            chn.textContent = 'No discount applied. Generation is at least scheduled and the artefact is signed, so the headline and the challenged reading are the same. That is the strongest position this tool can report.';\n        } else {\n            var adj = [];\n            if (2 > gen) { adj.push('every category reduced because a manually produced artefact cannot be assumed current'); }\n            if (sign === 0) { adj.push('a further reduction because an unsigned file establishes contents without establishing provenance'); }\n            chn.className = (chScores[chWeak] >= 1.8) ? 'ab-note caution' : 'ab-note warn';\n            chn.textContent = 'Under a buyer reading, readiness falls from ' + fmt1(readiness) + ' to ' + fmt1(chScores[chWeak]) +\n                ' and the weakest category ' + ((chWeak === weak) ? 'stays ' : 'moves to ') + CATS[chWeak].name +\n                '. Present the challenged figure. Adjustments: ' + adj.join('; ') + '.';\n        }\n\n        var askList = el('ab-asklist'); clear(askList);\n        var decision = 'Fund the ' + CATS[weak].name.toLowerCase() +\n            ' category to close the bill of materials gap, and move generation into the build pipeline.';\n        if (gen >= 3) { decision = 'Fund the ' + CATS[weak].name.toLowerCase() + ' category to close the bill of materials gap. Generation is already in the pipeline, so the category work is the whole ask.'; }\n        if (readiness >= 2.5) {\n            if (gen >= 3) { decision = 'Note the position as export ready and protect it. The decision required is to keep generation in the pipeline when the next delivery pressure arrives.'; }\n        }\n        if (fmt === 'none') { decision = 'Authorise a single complete bill of materials for the highest risk system in a recognised specification. One system, not the portfolio, which is step one of the three step rollout.'; }\n        var askRows = [\n            ['Decision requested', decision],\n            ['Readiness position', band.label + ', held back by ' + CATS[weak].name + ' at ' + fmt1(readiness) +\n              ' of 3. Average across the six ' + fmt1(avg) + ', which is not what a request lands on.'],\n            ['Time to produce', phrase(oneDays) + ' for one high risk system, ' + phrase(allDays) + ' for the portfolio of ' + count + ((count === 1) ? ' system.' : ' systems.')],\n            ['Procurement position', passed + ' of 4 gate tests passed' + ((passed === 4) ? '. You would clear a 2026 vendor qualification on these answers.' : '. A buyer applying the 2026 baseline would filter on the failing tests.')],\n            ['Regulatory exposure', (hr > 0) ? (hr + ' of ' + count + ' systems are high risk, where Article 11 and Annex IV documentation applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I, under Regulation (EU) 2026\/1744.') : 'No high risk systems recorded, so the documentation duty is commercial rather than regulatory for now.'],\n            ['Confidence', grade + ', ' + glabel.toLowerCase() + '. ' + score4 + ' of 4 evidence tests pass. Buyer reading ' + fmt1(chScores[chWeak]) + ' of 3.'],\n            ['Accountable owner', ownerOK ? (owner + ', accountable for the artefact and for keeping it current between requests.')\n                                          : 'NOT NAMED to a standard an external party would accept. An unowned artefact goes stale silently.']\n        ];\n        for (i = 0; i !== askRows.length; i++) {\n            var arow = mk('div', 'ab-askrow');\n            arow.appendChild(mk('b', null, askRows[i][0]));\n            arow.appendChild(mk('span', null, askRows[i][1]));\n            askList.appendChild(arow);\n        }\n        el('ab-askh').textContent = 'The ask, for ' + org;\n\n        var lines = [];\n        lines.push('AI BILL OF MATERIALS READINESS ASSESSMENT');\n        lines.push('Portfolio: ' + org);\n        lines.push('Prepared [DATE] by [NAME, ROLE]. Method: the six AIBOM categories from When Agents Rule, Chapter 8.');\n        lines.push('Scope: ' + count + ' production AI systems, of which ' + hr + ' high risk. Categories scored 0 to 3.');\n        lines.push('');\n        lines.push('THE ASK.');\n        for (i = 0; i !== askRows.length; i++) { lines.push('  ' + askRows[i][0] + ': ' + askRows[i][1]); }\n        lines.push('');\n        lines.push('CATEGORY SCORES.');\n        for (i = 0; i !== CATS.length; i++) {\n            lines.push('  ' + CATS[i].name + ': ' + fmt1(scores[i]) + ' of 3' + ((i === weak) ? '  WEAKEST, FIX FIRST' : ''));\n        }\n        lines.push('  Readiness is the weakest category, not the average: ' + fmt1(readiness) + ' of 3, ' + band.label + '.');\n        lines.push('');\n        lines.push('TIME TO PRODUCE THE FILE ON REQUEST.');\n        lines.push('  One high risk system: ' + phrase(oneDays) + '. Whole portfolio: ' + phrase(allDays) + '.');\n        lines.push('  Derived from category coverage, the generation path and the number of systems in scope. A planning figure, not a commitment. Test it by asking for one file and timing it.');\n        lines.push('');\n        lines.push('PROCUREMENT GATE TESTS. ' + passed + ' of 4 passed.');\n        for (i = 0; i !== gates.length; i++) {\n            lines.push('  ' + (gates[i].pass ? 'PASS' : 'FAIL') + ': ' + gates[i].name + '. ' + (gates[i].pass ? gates[i].ok : gates[i].fail));\n        }\n        lines.push('');\n        lines.push('WHAT TO FIX FIRST, INSIDE ' + CATS[weak].name.toUpperCase() + '.');\n        var listed = 0;\n        for (i = 0; i !== d2.length; i++) {\n            if (listed === 3) { break; }\n            if (d2[i].val > 1) { continue; }\n            lines.push('  ' + d2[i].label + ' scores ' + d2[i].val + ' of 3. ' + d2[i].move);\n            listed = listed + 1;\n        }\n        if (listed === 0) { lines.push('  No single weak check in this category. The next move is the generation path rather than any category.'); }\n        lines.push('');\n        lines.push('COHERENCE CHECKS. Whether the answers agree with one another.');\n        for (i = 0; i !== coh.length; i++) {\n            var tag = 'NOTE';\n            if (coh[i][0] === 'warn') { tag = 'CONTRADICTION'; }\n            if (coh[i][0] === 'caution') { tag = 'WATCH'; }\n            if (coh[i][0] === 'ok') { tag = 'SOUND'; }\n            lines.push('  ' + tag + ': ' + coh[i][1]);\n        }\n        lines.push('');\n        lines.push('CONFIDENCE. Grade ' + grade + ', ' + glabel + '. ' + score4 + ' of 4 evidence tests pass.');\n        for (i = 0; i !== fail.length; i++) { lines.push('  Outstanding: ' + fail[i]); }\n        lines.push('');\n        lines.push('THE READING A BUYER WOULD TAKE. ' + fmt1(chScores[chWeak]) + ' of 3, weakest category ' + CATS[chWeak].name + '.');\n        lines.push('');\n        lines.push('BASIS AND LIMITS. A self assessment applying the Chapter 8 categories to answers supplied by the preparer. Not an audit, a certification or a benchmark, and no peer comparison is claimed because no dataset underlies this instrument. Readiness is reported as the weakest of the six categories rather than their average, because a request lands on the gap rather than on the coverage. Time to produce figures are planning estimates derived from the answers given. Whether Article 11 and Annex IV documentation obligations apply to a given system is a legal determination for qualified counsel, and the high risk application dates were amended by Regulation (EU) 2026\/1744 to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Specification references were current in 2026 and both specifications continue to change. Not legal, technical or financial advice.');\n        el('ab-cardtext').textContent = lines.join('\\n');\n\n        var res = el('ab-result');\n        res.className = 'ab-result on';\n        goTo(res);\n    }\n\n    var inputs = root.querySelectorAll('input, select');\n    var k = 0;\n    for (k = 0; k !== inputs.length; k++) {\n        inputs[k].addEventListener('change', refresh);\n        inputs[k].addEventListener('input', refresh);\n        inputs[k].addEventListener('click', refresh);\n    }\n    el('ab-go').addEventListener('click', compute);\n    el('ab-print').addEventListener('click', function () { window.print(); });\n    el('ab-again').addEventListener('click', function () {\n        el('ab-result').className = 'ab-result';\n        goTo(root);\n    });\n    el('ab-clearbtn').addEventListener('click', function () {\n        var j = 0;\n        var rs = root.querySelectorAll('input[type=\"radio\"]');\n        for (j = 0; j !== rs.length; j++) { rs[j].checked = false; }\n        el('ab-org').value = ''; el('ab-owner').value = '';\n        el('ab-count').value = '0'; el('ab-hr').value = '0';\n        el('ab-result').className = 'ab-result';\n        refresh();\n        goTo(root);\n    });\n    el('ab-copy').addEventListener('click', function () {\n        var txt = el('ab-cardtext').textContent;\n        var btn = el('ab-copy');\n        function done(ok) {\n            btn.textContent = ok ? 'Copied' : 'Select the text above to copy';\n            window.setTimeout(function () { btn.textContent = 'Copy the paper'; }, 2600);\n        }\n        function fallback() {\n            var ta = document.createElement('textarea');\n            ta.value = txt;\n            ta.setAttribute('readonly', 'readonly');\n            ta.style.position = 'fixed'; ta.style.top = '0'; ta.style.left = '0'; ta.style.opacity = '0';\n            document.body.appendChild(ta);\n            ta.focus(); ta.select();\n            try { ta.setSelectionRange(0, txt.length); } catch (e4) { }\n            var ok = false;\n            try { ok = document.execCommand('copy'); } catch (e5) { ok = false; }\n            document.body.removeChild(ta);\n            done(ok);\n        }\n        if (navigator.clipboard) {\n            if (window.isSecureContext !== false) {\n                navigator.clipboard.writeText(txt).then(function () { done(true); }, function () { fallback(); });\n                return;\n            }\n        }\n        fallback();\n    });\n\n    refresh();\n}());\n<\/script>\n\n\n\n<div id=\"elemID031021\" style=\"line-height:16px;text-align:center;z-index:100000;\"><a title=\"wix guests ip\" href=\"https:\/\/www.tracemyip.org\/pv1-3-36447-2\"><img decoding=\"async\" src=\"\/\/s3.tracemyip.org\/vLg\/1217\/4684NR-IPIB\/57003\/9\/njsUrl\/\" alt=\"Wix guests ip\" referrerpolicy=\"no-referrer-when-downgrade\" style=\"border:0px;\"><\/a><div><a href=\"https:\/\/www.tracemyip.org\/pv1-3-36447-2\">ip traffic<\/a><\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READINESS IS THE WEAKEST CATEGORY, NOT THE AVERAGE: a buyer asks for the file, not for a category. Quadrant One \/\/ When Agents Rule AIBOM Readiness Scorer Score your AI bill of materials across the six categories from Chapter 8. Get the category to fix first, the estimated time to produce an Annex IV file [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-884","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/pages\/884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=884"}],"version-history":[{"count":2,"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/pages\/884\/revisions"}],"predecessor-version":[{"id":896,"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=\/wp\/v2\/pages\/884\/revisions\/896"}],"wp:attachment":[{"href":"https:\/\/www.opey.org\/opeyit\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}