Robot Deployment Provenance vs. Bill of Materials: Understanding the Difference

A bill of materials is an engineering and manufacturing document that lists the components, subassemblies, and raw materials required to build a product, together with the quantities and part numbers needed for procurement and production planning. In the context of a robot system, the BOM identifies the hardware components at the level of detail needed to order replacements, plan maintenance, and manage spare parts inventory.

A BOM is organized for production and logistics efficiency: it groups components by assembly, lists part numbers and manufacturer references, and provides the purchasing information needed to procure each item. What a BOM does not typically cover: the country of origin for each component, the specific version of firmware installed on each component in the shipped product, the network endpoints each component communicates with, the organizational entities with remote access to the component, or the compliance status of the component against current procurement restrictions.

These are provenance record fields, not BOM fields.

Deployment provenance covers several dimensions of information that a BOM does not include. Origin documentation covers the country of manufacture for each major component, the manufacturer's legal entity identity, and any relevant corporate affiliations that are not visible from the commercial part number. Version state documentation covers the specific firmware version installed on each hardware component in the deployed unit at a specific point in time, not the current production version or the version at design time.

Network and access documentation covers every external endpoint the deployed unit communicates with and every party with remote access, which has no counterpart in a BOM. Compliance status covers the assessment of each component against current procurement restrictions and the documented outcome of that assessment, which is a deployment-time and post-deployment activity that does not appear in the design-time BOM. The provenance record is also specific to an individual unit at a specific point in time, not a design-level document that applies to all units of a model.

Despite their differences, a BOM can contribute useful information to the deployment provenance record. The BOM provides the starting point for component identification: the component manufacturers and part numbers listed in the BOM guide the provenance investigation toward the right suppliers and datasheets. For deployments where the manufacturer provides a detailed BOM as part of the product documentation, the BOM gives the deployment team the component list they need to determine the scope of the provenance documentation effort.

Component manufacturers identified in the BOM can be researched for their country of registration and corporate affiliations. Where a BOM is not available, the provenance investigation must derive the component list from other sources: physical inspection, technical certifications, and manufacturer inquiry. In this sense, a BOM is a useful input to the provenance record but does not substitute for the provenance record; it provides the component identification layer but not the origin, version, network, or compliance layers that the provenance record requires.

A BOM alone is sufficient for the purposes it was designed to serve: manufacturing, spare parts management, and maintenance planning. It is not sufficient for deployment evidence purposes that require origin verification, version state documentation, or compliance demonstration. A procurement review that asks whether the robot's components include any from a restricted manufacturer cannot be answered from a BOM alone: the BOM identifies the component manufacturers, but the compliance determination requires comparing those manufacturers against the current restriction list, which changes over time and requires the provenance investigation to assess the manufacturer's corporate relationships, not only their commercial name.

A security review that asks what data the robot transmits externally cannot be answered from a BOM, because the BOM does not cover the robot's communication behavior. Deployment teams that try to answer provenance questions from BOM information alone consistently find that the BOM provides only the first layer of the required information and that the remaining layers require the kind of provenance investigation described in this library.

The most efficient approach to building a deployment provenance record for a new deployment is to start with any BOM information available from the manufacturer and extend it with the additional provenance layers. The BOM provides the component identification starting point; the provenance investigation adds origin, firmware version state, network and access relationships, and compliance assessment. For components in the BOM whose manufacturers can be identified from the part number or commercial name, the origin research can begin directly from the BOM information.

For components whose manufacturers are not identifiable from the BOM information alone, the provenance investigation must supplement with technical certifications, physical inspection, or manufacturer inquiry. The resulting record is a provenance record that incorporates BOM-derived information where available and supplements it with additional evidence where needed, organized by the provenance record's question-oriented structure rather than the BOM's assembly-oriented structure.

• Use available BOM information as a starting point for component identification, not as a complete provenance record
• Extend BOM component identification with origin documentation for each major subsystem
• Add version state fields that capture the specific firmware version installed in the deployed unit at commissioning
• Add network and access documentation fields that have no counterpart in the BOM
• Conduct compliance assessment against current procurement restrictions using the provenance record, not the BOM
• Note in the provenance record which fields were derived from BOM information and which required additional investigation
• Update the provenance record when components change, even when the BOM for the model is unchanged