The release finds AI SDKs, model files and AI service API keys that go undeclared, and documents them in an AIBOM as evidence towards EU AI Act obligations.
SCANOSS detailed the AI governance capabilities of Earnie, its code governance solution, which launched publicly on October 6, 2026 at a live online event.
As buyers, regulators and boards increasingly ask a specific question, what AI is actually inside this software, many organisations can only answer with a self-reported list. Earnie is built to answer with detection instead of declaration, finding what is actually present in a codebase, including what nobody wrote down.
Most AI governance programmes are built on a form someone filled out. Earnie gives customers a record that holds up when a regulator, an insurer or the board asks more than the form can answer.”
— Paula Calvo, Chief Experience Officer, SCANOSS
Earnie looks for AI in three places it commonly hides: AI SDKs and embedded AI code, such as LLM clients, agent frameworks and machine learning frameworks, recognised in dependencies and source; AI model files, identified by fingerprinting the weights so a renamed file is still recognised, and matched against the AI Model Dataset, a proprietary dataset of known models with licence and provenance information; and code that calls AI services, surfacing AI usage that was never formally declared.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
Findings are compiled into an AI Bill of Materials (AIBOM), exported in CycloneDX 1.7 as evidence towards EU AI Act documentation obligations. The intent is to answer two compliance questions directly: is a given model allowed under policy, and can its source be trusted.
As with every domain Earnie governs, a finding leads to a decision. Every AI model file requires one, and Earnie records each decision, so an organisation can show what AI it found, who decided it was acceptable, and when.
Earnie’s AI governance extends to how code is written as well as what a codebase already contains. Through the Model Context Protocol (MCP), coding agents can check their own output against policy before handing code back to a developer, surfacing undeclared models, licence obligations and other AI-introduced issues at the same speed the agent writes. The same policy applies again once a change reaches a pull request, where Earnie posts a summary comment and a pass, warn or block verdict for the reviewer.
– AIBOM generation in CycloneDX 1.7, as evidence towards EU AI Act obligations
– Model file fingerprinting matched against the AI Model Dataset
– Detection of embedded AI SDKs, frameworks and code that calls AI services
– In-context policy checks for coding agents via MCP, plus pre-commit and pull request checks
The SCANOSS knowledge base recognises more than 2,500 MCPs and SDKs and nearly 27,000 AI model fingerprints across 12 model formats, including Safetensors, GGUF, ONNX and PyTorch, and both figures grow every week. Detection is deterministic: the same input produces the same result every time. Every customer gets its own isolated Earnie environment, where its source code stays; only fingerprints and package identifiers are sent to SCANOSS for matching, never source code.
The AI governance capabilities are available now as part of Earnie. Full details, including open source licence compliance and cryptographic and post-quantum readiness, are at earnie.dev.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
