Shadow AI poses a challenge as unmanaged workloads bypass traditional security. Organizations often avoid strict developer controls to maintain development speed. To address this, k8s-aibom is being open-sourced as a lightweight, unprivileged Kubernetes controller. It continuously monitors clusters to automatically detect AI runtimes and generate ML-BOMs. This provides automated, runtime-based visibility without developer friction or cluster instability. k8s-aibom discovers AI workloads through stages: scraping, identifying AI stacks, generating BOMs, and exporting them. It doesn't require developer modifications to existing configurations or CI/CD pipelines. The tool differentiates between declared, inferred, and unresolved AI assets, enhancing audit confidence. It ensures data immutability and employs least privilege for an audit-grade security model. k8s-aibom helps map runtime data to global regulatory frameworks like the EU AI Act and NIST AI RMF.