{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d11cadcb-487c-4dc9-90d1-6ddea1b541ff",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-14T19:44:16.563709+00:00",
    "tools": [
      {
        "vendor": "Kyoto AI Compliance Engine",
        "name": "ai-rmf-tools",
        "version": "0.2.0"
      }
    ],
    "component": {
      "type": "application",
      "bom-ref": "pkg:ai/demo-rag-app@1.0.0",
      "name": "demo-rag-app",
      "version": "1.0.0",
      "description": "AI Application complying with NIST AI RMF 1.0"
    }
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "pkg:ml/Google/gemini-1.5-flash@1.0",
      "name": "gemini-1.5-flash",
      "version": "1.0",
      "supplier": {
        "name": "Google"
      },
      "modelCard": {
        "modelParameters": {
          "approach": {
            "type": "supervised"
          },
          "architecture": "rag_assistant"
        },
        "inputs": [
          {
            "format": "string",
            "description": "User queries, prompt context, and retrieved chunks"
          }
        ],
        "outputs": [
          {
            "format": "string",
            "description": "Synthesized text response and assistant completions"
          }
        ],
        "quantitativeAnalysis": {
          "performanceMetrics": [
            {
              "type": "target_accuracy",
              "value": "0.95"
            },
            {
              "type": "bias_parity_threshold",
              "value": "0.03"
            }
          ]
        },
        "considerations": {
          "users": [
            "enterprise_users"
          ],
          "useCases": [
            "General generative assistant"
          ],
          "technicalLimitations": [
            "Hallucinated Citations",
            "Confidential Document Exfiltration",
            "Prompt Injection Bypass"
          ]
        }
      }
    },
    {
      "type": "data",
      "bom-ref": "data:customer_knowledge_base_v2@1.0",
      "name": "Customer Knowledge Base v2",
      "description": "Application operational repositories & vector embeddings",
      "data": {
        "type": "configuration",
        "governance": {
          "owners": [
            {
              "name": "Compliance Lead"
            }
          ]
        }
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:pypi/ai-rmf-tools@0.2.0",
      "name": "ai-rmf-tools",
      "version": "0.2.0",
      "description": "NIST AI RMF 1.0 Runtime Compliance and Guardrail Engine",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ]
    }
  ]
}