Skip to main content

AI System Compliance and Open Source Management

While the other pages in this section deal with code produced by AI coding tools, this page covers open source management for AI systems themselves (when you develop or operate models). Copyright and regulation for AI-generated code are covered in Legal Considerations for AI-Generated Code.

Three areas where open source is used in AI systems

If you already operate ISO/IEC 5230 and 18974, apply the same principles to AI systems — but each area differs from your existing process in specific ways.

  1. AI frameworks and libraries (PyTorch, TensorFlow, Transformers, etc.) — treat them like any dependency: your existing 5230 process and SBOM tools (syft, cdxgen) apply as-is.
  2. Pre-trained models (Llama, Mistral, etc.) — many use non-standardized custom licenses, so check the model card individually for commercial-use conditions, MAU thresholds, and derivative-model obligations. Also distinguish "open weight" models from open source AI models under the OSAID definition.
  3. Training datasets — fulfill attribution and share-alike obligations of CC-family open data licenses, and if CC-BY-SA data was used for training, consult legal on the licensing of derivative models.

For per-area detail (framework, model, and data license tables plus checkpoints), see the KWG AI Compliance Guide.

AI SBOM

The AI SBOM extends the SBOM to record pre-trained models and datasets. SPDX 3.0 AI Profile and CycloneDX 1.6 ML-BOM are the de facto standard formats; conventional SBOM tools do not detect model files automatically, so record model and dataset entries separately. For a clause checklist, a phased roadmap, and tool walkthroughs, see the KWG AI SBOM Compliance Guide, and you can practice generating one in 5.4 AI SBOM.

ISO/IEC 42001 and the open source manager's role

If your company is preparing for ISO/IEC 42001 (AI management systems), the open source management system you already built can be reused at these intersecting clauses.

ISO 42001 clauseOpen source manager's roleExisting asset to reuse
§5.2 AI policyInclude open source principles in AI policyOpen source policy §5 (AI-generated code)
§6.1.2 AI risk assessmentAssess OSS license and vulnerability riskVulnerability response procedure, SLA
§7.5 DocumentationEstablish and maintain the AI SBOMSBOM generation and management process
A.6 AI system life cycle (Annex A)Review OSS compliance per development stageUsage approval, pre-distribution checklist
A.7 Data for AI systems (Annex A)Manage dataset licensesLicense review procedure
A.10 Third parties and customers (Annex A)Verify external open source model supply chainsSupply chain SBOM request and verification
ISO 42001 certification is a separate process

ISO/IEC 42001 covers AI governance as a whole and is certified separately from ISO 5230/18974 self-certification. Companies that built the 5230/18974 system first can reuse the intersecting items above to prepare more efficiently.

Sources and further reading

This page is a summary reworked from the OpenChain KWG AI Compliance Guide (CC BY 4.0).