Your AI Training Data
Now Needs an SBOM
Europe's regulators just made dataset provenance a compliance requirement.
SBOMator already speaks that language — 100% local, air-gap ready, zero data leaves your PC.
ESL · SBOMatorThe EDPB Adopted Guidelines 03/2026 on
Web Scraping for Generative AI
required per source
across the full lifecycle
with collection dates
ESL · SBOMatorWhat You Must Now Evidence — For Every Dataset
DEMAND Source inventory
A searchable list of scraped domains and URLs, with collection dates and periods — published, not just filed away.
DEMAND PII minimization
Syntax-based filters for identifiers — emails, ID numbers, financial data — applied and documented before training.
DEMAND Special-category control
Health, political, ethnic, religious content: incidental collection tolerated only with demonstrable lifecycle safeguards.
DEMAND Opt-out respect
robots.txt, ai.txt, CAPTCHAs and login walls now carry weight in the GDPR balancing test. Ignoring them has legal consequences.
DEMAND Supply-chain evidence
Bought a scraped dataset? You must document its sources, exclusion criteria, warranties and the originating controller.
DEMAND Accountability on paper
Legitimate-interest assessments and DPIAs, case by case. The first thing an authority will ask for is your documentation.
ESL · SBOMatorA Trained Model Cannot Be Patched
Software provenance failures can be fixed after the fact — re-scan, patch, redeploy.
Data provenance failures are permanent: the EDPB itself notes that removing personal data from a trained model is close to impossible.
maximum GDPR fine exposure
out of a shipped model
before training starts
You must know its provenance.
ESL · SBOMatorThis Is Exactly What SBOMs Did to Software
| Software supply chain (SBOM) | AI training data (EDPB 03/2026) |
|---|---|
| Component inventory — what's in the build | Source list — domains, URLs, searchable |
| Version & timestamp per component | Collection date per source |
| Supplier identity | Originating controller & contact point |
| License compliance per component | Legal basis per source |
| Vulnerability scan against inventory | PII & special-category screening |
| Attestations when buying binaries | Warranties when buying datasets |
EO 14028, FDA and the EU CRA made SBOMs mandatory after software learned this lesson the hard way.
The EDPB is applying the same principle to data — before the incident that forces it.
ESL · SBOMatorSBOMator DataBOM — Dataset Provenance,
Scanned Like Firmware
The same scanner your security team already trusts for firmware SBOMs
now generates the provenance evidence regulators expect for AI training data.
directory · archive · JSONL / CSV / Parquet · crawl logs
DataBOM scan
+ CycloneDX ML-BOM
Runs entirely on your machine. Your dataset never leaves your PC.
ESL · SBOMatorEverything Happens Inside Your Perimeter
ESL · SBOMatorEach Report Section Maps to an EDPB Demand
| DataBOM report section | EDPB requirement it evidences |
|---|---|
| Source inventory — domains, counts, dates | Art. 14(5)(b) transparency source list |
| PII scan — emails, IDs, IPs, GPS | Data-minimization filters |
| Special-category flags — with review samples | Art. 9 lifecycle safeguards |
| Secrets scan | Security & minimization |
| Opt-out signal status — robots.txt / ai.txt | Reasonable-expectations balancing |
| Risky-source flags — minor-directed, sensitive sites | Source-exclusion expectation |
| Provenance completeness score | Accountability · DPIA input |
An evidence generator for your DPO and legal team — the documented inputs a
legitimate-interest assessment and DPIA are built on.
ESL · SBOMatorThe DataBOM Tab — Right Next to Your Firmware Scans
Product mockup — DataBOM tab in the ESL-SBOMator desktop application (v1.3.x UI)
ESL · SBOMatorAir-Gapped by Design = GDPR by Design
Cloud scanning tools create the very GDPR problems they claim to solve.
SBOMator's architecture removes them before they exist.
Art. 28 No processor, no DPA
ESL never touches your data — so there is no data-processing agreement to negotiate, no sub-processor list to audit, no vendor risk assessment for your dataset.
Ch. V No international transfer
Nothing crosses a border because nothing crosses your firewall. No SCCs, no adequacy analysis, no transfer impact assessment.
Art. 5 Minimization by architecture
The scanner reads your dataset in place and stores nothing but the report you asked for. Storage limitation is enforced by design, not by policy.
Art. 32 Your perimeter, your controls
Security of processing inherits the controls you already certified — disk encryption, access control, physical security. No new attack surface.
OFFLINE True air-gap operation
Vulnerability and metadata databases install from an offline bundle. Fully disconnected networks are a supported configuration, not an afterthought.
LICENSE Site license + support
One site license, real engineering support, no per-scan metering — and no usage telemetry phoning home, because there is no home to phone.
Know Your Data Like You Know Your Code
The consultation window closes 30 October 2026. The final guidelines land by year end.
Teams that can already produce provenance evidence won't be the ones scrambling.