AI System Compliance and Open Source Management
While the other pages in this section deal with code produced by AI coding tools, this page covers open source management for AI systems themselves (when you develop or operate models). Copyright and regulation for AI-generated code are covered in Legal Considerations for AI-Generated Code.
Three areas where open source is used in AI systems
If you already operate ISO/IEC 5230 and 18974, apply the same principles to AI systems — but each area differs from your existing process in specific ways.
- AI frameworks and libraries (PyTorch, TensorFlow, Transformers, etc.) — treat them like any dependency: your existing 5230 process and SBOM tools (syft, cdxgen) apply as-is.
- Pre-trained models (Llama, Mistral, etc.) — many use non-standardized custom licenses, so check the model card individually for commercial-use conditions, MAU thresholds, and derivative-model obligations. Also distinguish "open weight" models from open source AI models under the OSAID definition.
- Training datasets — fulfill attribution and share-alike obligations of CC-family open data licenses, and if CC-BY-SA data was used for training, consult legal on the licensing of derivative models.
For per-area detail (framework, model, and data license tables plus checkpoints), see the KWG AI Compliance Guide.
AI SBOM
The AI SBOM extends the SBOM to record pre-trained models and datasets. SPDX 3.0 AI Profile and CycloneDX 1.7 ML-BOM are the de facto standard formats; conventional SBOM tools do not detect model files automatically, so record model and dataset entries separately. For a clause checklist, a phased roadmap, and tool walkthroughs, see the KWG AI SBOM Compliance Guide, and you can practice generating one in 5.4 AI SBOM.
ISO/IEC 42001 and the open source manager's role
If your company is preparing for ISO/IEC 42001 (AI management systems), the open source management system you already built can be reused at these intersecting clauses.
| ISO 42001 clause | Open source manager's role | Existing asset to reuse |
|---|---|---|
| §5.2 AI policy | Include open source principles in AI policy | Open source policy §5 (AI-generated code) |
| §6.1.2 AI risk assessment | Assess OSS license and vulnerability risk | Vulnerability response procedure, SLA |
| §7.5 Documentation | Establish and maintain the AI SBOM | SBOM generation and management process |
| A.6 AI system life cycle (Annex A) | Review OSS compliance per development stage | Usage approval, pre-distribution checklist |
| A.7 Data for AI systems (Annex A) | Manage dataset licenses | License review procedure |
| A.10 Third parties and customers (Annex A) | Verify external open source model supply chains | Supply chain SBOM request and verification |
Companion standards in the same family
ISO/IEC 42001 alone tells you what you must have in place. How to actually assess risk and impact, and what basis certification audits use, is covered by other standards in the same family.
| Standard | Title | Published | What it is for |
|---|---|---|---|
| ISO/IEC 23894:2023 | Guidance on risk management | 2023-02-06 | Procedures and perspectives to draw on when performing the §6.1.2 risk assessment above |
| ISO/IEC 42005:2025 | AI system impact assessment | 2025-05-28 | Assessing the impact of an AI system on individuals and societies, and feeding it back in |
| ISO/IEC 42006:2025 | Requirements for bodies auditing and certifying AI management systems | 2025-07-07 | Seeing what requirements a certification body works under; a basis for choosing one |
ISO/IEC 42005 covers assessment timing, life cycle stages, and documentation items, and states that the impact assessment process can be integrated into an organization's AI risk management and AI management system. From an open source management perspective, usage restrictions in pre-trained model licenses and the license conditions of training datasets become inputs to that assessment.
ISO/IEC 42006 is not a standard an organization applies directly; it sets requirements for certification bodies. If you are considering ISO/IEC 42001 certification, use it to see in advance what basis you will be audited against.
ISO/IEC 42001 covers AI governance as a whole and is certified separately from ISO 5230/18974 self-certification. Companies that built the 5230/18974 system first can reuse the intersecting items above to prepare more efficiently.
Sources and further reading
This page is a summary reworked from the OpenChain KWG AI Compliance Guide (CC BY 4.0).
- KWG — ISO 42001 working guide for open source managers
- SPDX 3.0 specification (AI Profile)
- ISO/IEC 23894:2023, ISO/IEC 42005:2025, ISO/IEC 42006:2025 (full texts are sold through the ISO catalogue)
- Legal Considerations for AI-Generated Code — copyright, indemnity, and disclosure when using AI coding tools