AI Bill of Materials: Documenting Models and Providers

The full executive answer

It exists as code, which is the answer a CAIO should want: we maintain a model registry — a governed inventory file in the platform — declaring every model we can call, its provider, its role, its data-handling posture, and an explicit approval flag. A coverage test in our build pipeline asserts that every model the engine can resolve is declared there, so an engineer literally cannot swap a model without creating a governance entry. That is the EU AI Act and NIST expectation of a maintained model inventory, enforced by the build.

The inventory today: Anthropic’s Claude Sonnet 4.6 is the primary reasoning model for complex and standard analysis; Claude Haiku 4.5 — a date-pinned version — handles fast phrasing and classification tasks; Claude Opus 4.8 is registered as the deepest tier, only active on extended compute budgets. OpenAI’s GPT-4o is the cross-provider fallback and the second opinion in our consensus checks. OpenAI’s text-embedding-3-small produces the document embeddings for retrieval, and Cohere’s Rerank 3.5 is an optional retrieval reranker that only activates when a key is configured. Every entry carries the same data posture: personal data is redacted before anything leaves our infrastructure.

Model choice per task is routed by a complexity tier — complex, standard, fast — set per module in code, and all of it is environment-configurable, so a model upgrade is a config change plus a forced registry entry, not a rewrite. Honest caveat: the approval flag today is our internal engineering sign-off; a formal AI governance committee with external membership is roadmap, and I will not dress the current state up as more than it is.