AI compliance profile
Project: Aether-7B-5Attn · Generated: 2026-07-21T02:59:57Z
This profile re-aggregates the conformance and SBOM artifacts already produced.
G7 present 25 / 38
G7 gap 13
Needs review 13
License flags 0
Base result: PASS
Licenses flagged for review
No components carry an AI behavioral-use or non-commercial license flag.
G7 minimum elements by cluster
| Cluster | Present | Gap | Review | Total |
|---|
| dp | 1 | 4 | 5 | 10 |
| infrastructure | 0 | 2 | 0 | 2 |
| kpi | 0 | 1 | 1 | 2 |
| metadata | 7 | 3 | 0 | 10 |
| models | 14 | 0 | 0 | 14 |
| slp | 3 | 2 | 4 | 9 |
| sp | 0 | 1 | 3 | 4 |
Regulatory crosswalk
BomLens does not certify or determine compliance with the EU AI Act, the Korean AI Framework Act, or any other regulation. This crosswalk makes documentation gaps visible so a person can prepare; interpreting it against a specific system's legal obligations is a person's job.
| Framework | Present | Gap | Review | Mapped |
|---|
| EU AI Act — Annex IV technical documentation | 6 | 7 | 10 | 23 |
| AI Framework Act (Korea) | 2 | 1 | 7 | 10 |
The full element-by-element mapping is in the conformance report.
How to close the gaps
These G7 elements have an automated source but are absent from the SBOM. The conformance report carries the CycloneDX fragment that would satisfy each one.
- SBOM author (metadata)
- SBOM author signature (metadata) — https://cyclonedx.org/docs/1.7/json/#signature
- SBOM generation context (metadata)
- System components (slp)
- System producer (slp)
- Dataset description (dp) — https://huggingface.co/docs/hub/datasets-cards
- Dataset identifier (dp) — https://github.com/package-url/purl-spec
- Dataset provenance (dp) — https://cyclonedx.org/capabilities/mlbom/
- Dataset license (dp) — https://huggingface.co/docs/hub/datasets-cards
- Infrastructure software (dependencies) (infrastructure)
- Infrastructure hardware (HBOM link) (infrastructure) — https://cyclonedx.org/capabilities/hbom/
- Vulnerability referencing (sp)
- Operational performance KPIs (kpi)
Elements a person still has to fill in
These G7 elements have no automated source; they are surfaced for human review, not guessed.
- System data flow (slp)
- System data usage (slp)
- System input/output properties (slp)
- Intended application area (slp)
- Dataset content (dp)
- Dataset hash (dp)
- Dataset statistical properties (dp)
- Dataset sensitivity (PII/copyright) (dp)
- Dataset dependency relationship (dp)
- Security controls (sp)
- Security compliance (sp)
- Cybersecurity policy information (sp)
- Security metrics (kpi)