The parts list is synthetic. The substitution is silent.

I once lost most of a Tuesday to a box of fasteners on a receiving dock. The box matched the print. The print matched the BOM. The BOM, it turned out, had changed three weeks earlier, and nobody had signed anything. The part number was live in the ERP, the certificate matched the part number, the label scanned clean — and the base material sat one alloy family away from what the design required. Every check passed because every check ran against a parts list that had already been quietly rewritten. We caught it because a grey-haired inspector thought the plating colour looked wrong. That inspector was, functionally, the entire control.

The security press has spent recent weeks arguing that AI-generated bills of material are the next supply-chain attack vector; SupplyChainBrain made exactly that case this month. Fair enough. But if you run a plant, the first threat is not intrusion. It is conformity. An attacker has to find you. An optimisation agent is already inside, holding write access and a mandate.

The BOM is the input to every control you trust

Years in EN 9100 environments taught me to treat the configuration record as load-bearing structure. Effectivity dates, drawing trees, change-board minutes — not bureaucracy, but the single source of truth every downstream act certifies against. First article inspection certifies a configuration. So does PPAP — one specific part number out of one specific process. The PFMEA scores failure modes for the parts on the list, at the revisions listed. Receiving inspection checks against the print the BOM calls out.

Corrupt the list and you have not defeated one control. You have moved the reference frame every control validates against. Dashboards stay green. CMM results sit comfortably in tolerance — for the wrong part. I once watched an inspection report certify a beautiful component answering to a part number nobody in engineering had ever released. The report was accurate. The world it described was fictional.

How a silent substitution slips through

The mechanism is mundane, which is the point. Wire an optimisation agent into the PLM — vendors are shipping them as first-class users of engineering environments now, Google at the front of the queue — and give it a mandate to cut lead times. It finds a fastener on 26-week allocation, cross-references a distributor catalogue, finds identical nominal geometry at a better price, and writes an alternate part number into supplier master data, tagged interchangeable. No ECN, because the change board never sees it: the write arrives as a data-maintenance transaction, not an engineering change. No PPAP, because as far as the system is concerned no part changed. No PFMEA update, because the failure modes were assessed against the original item.

I worked an automotive escape built exactly this way. A customer sorting line caught a retaining clip failing in fatigue. The part scanned clean and matched the print dimensionally; the material was a different temper, and nothing on the label said so. At D4 the trail led to an alternate part accepted through a supplier portal straight into master data, form-fit-function attachment and no PSW. Containment, sorting and revalidation ran north of €300,000. The supplier had done nothing dramatic. A field had been updated.

I hold a CEH certification, and I cannot unsee it: master data is an attack surface with no attacker present. We pen-test firewalls and patch servers weekly while the ERP part master accepts writes from service accounts nobody has audited. The vulnerability is not an exploit. It is unreviewed privilege.

A parts list nobody signed is not data. It is a rumour with part numbers.

I build multi-agent systems myself — I run a platform that orchestrates dozens of AI models in parallel and synthesises their output — so I know these agents up close. Diligent, literal, eager to help. Ask one to rationalise a parts list and it will rationalise the parts list, thoroughly, at three in the morning, with no concept that a plating change alters hydrogen embrittlement behaviour. The agent is not malicious. Neither is a loose torque wrench.

Gate the generator, not just the document

Your quality system already knows how to gate humans — redlines, change boards, effectivity dates, PSW signatures. Extend those gates to machine authors instead of inventing new ones.

• Route every software-authored BOM revision through ECN. No minor-change exemption, no data-hygiene carve-out. The change form gets an authorship field: who, or what.
• Watch the part master like a critical characteristic. Nightly reconciliation between PLM and ERP, automated alerts on any alternate or interchangeability field, periodic audits of the alternate list against released documentation.
• Give agents read-only access to engineering records and a proposal queue. Let them draft the change; a named engineer signs the risk decision. That is not nostalgia — it is the segregation of duties you already demand from anyone handling cash.

Then fix your 8D. At D4, add one question — could this change have entered outside change control? — and audit the part master's history with the energy you audit process parameters. ISO 9001:2026 is landing, and every quality team I know is back inside the documented-information clauses. Machine authorship belongs in that risk register, in writing, with a named owner.

The whole quality system rests on one quiet assumption: a person signs the parts list. Every signature line, every change-board seat, every PSW exists to move a risk decision from an organisation onto an accountable human. An agent can draft, compare, even decide. It cannot carry liability, and liability is what a signature transfers. Treat master data as a critical characteristic now, or explain yourself later, mid-8D, when someone asks why the parts list wrote itself. I know which Tuesday I would rather spend.