Assessment of no-code platforms for security automation reveals that while they simplify the creation of ML-driven workflows, they do not exempt the…

The statement is correct. An AI Bill of Materials (AI BOM) is a formal record of the components, data, and dependencies used in developing, training, and deploying an AI model. The use of a no-code platform, which abstracts the underlying components into visual blocks, does not eliminate the need for this transparency. In fact, it can make an AI BOM even more critical. The organization deploying the solution is ultimately responsible for its security and behavior. Without an AI BOM, the organization would have no visibility into the third-party models, libraries, or datasets embedded within the no-code tool, making it impossible to track vulnerabilities, manage licenses, or understand potential data provenance issues in their AI supply chain.

The alternative, "False," is incorrect because it implies that using a simplified development tool absolves an organization of its due diligence and security responsibilities. Regulatory and security frameworks increasingly emphasize supply chain transparency (akin to SBOM for traditional software), and this principle extends directly to AI systems, regardless of the abstraction level of the development platform. Ignoring the need for an AI BOM creates a significant blind spot in the organization's security posture.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). (The framework's "Govern" function emphasizes understanding and documenting the entire AI lifecycle, including components and data provenance. Section 4.3, "AI system documentation and transparency," highlights the need for information about components, which is the core purpose of an AI BOM). Document: https://doi.org/10.6028/NIST.AI.100-1

2. U.S. Department of Commerce, NTIA. (2021). The Minimum Elements For a Software Bill of Materials (SBOM). (While focused on software, the principles of supply chain transparency are the direct foundation for the AI BOM concept. The document establishes the need for component inventory for risk management, a need that is not negated by the type of development tool used).

3. Stanford University, Center for Research on Foundation Models (CRFM). (2023). On the Opportunities and Risks of Foundation Models. (This report discusses the importance of model transparency and documentation, such as through "Model Cards" and datasheets, which are components of a comprehensive AI BOM. This need for transparency applies to all models, including those integrated into third-party platforms). Available via arXiv: https://arxiv.org/abs/2108.07258