SPDX 3.0 AI profile vs CycloneDX ML-BOM

Both major BOM standards can describe AI models and datasets, but they model them differently. CycloneDX puts a model card on a component; SPDX 3.0 adds AI and Dataset profiles with their own classes.

Background

CycloneDX is an OWASP standard, also published by Ecma as ECMA-424. Version 1.5, released on 26 June 2023, introduced machine-learning BOM support ^[1]. Version 1.7 was released on 21 October 2025 and was expected to be ratified as ECMA-424 2nd edition ^[2].

SPDX is a Linux Foundation standard. SPDX 3.0, released on 16 April 2024, restructured the specification into profiles, including profiles for AI model training and characterisation and for dataset provenance ^[3]. For the general format comparison, see CycloneDX vs SPDX.

How each models a machine-learning model

CycloneDX represents a model as a component of type machine-learning-model with a modelCard. The card has three parts ^[4]:

• modelParameters: approach, task, architecture family and name, datasets, inputs and outputs;
• quantitativeAnalysis: performance metrics and graphics;
• considerations: users, use cases, technical limitations, performance trade-offs, ethical and environmental considerations, fairness assessments.

SPDX 3.0 uses an AIPackage class, which inherits package properties such as name, version, supplier and download location, and adds AI properties including typeOfModel, domain, hyperparameter, informationAboutTraining, informationAboutApplication, metric, metricDecisionThreshold, limitation, modelExplainability, safetyRiskAssessment, standardCompliance, energyConsumption, autonomyType and useSensitivePersonalInformation ^[5].

How each models a dataset

CycloneDX uses a component of type data, referenced from a model card's datasets ^[4]. SPDX 3.0 has a DatasetPackage class with properties such as datasetType, dataCollectionProcess, dataPreprocessing, datasetSize, knownBias, hasSensitivePersonalInformation, anonymizationMethodUsed, confidentialityLevel, intendedUse and datasetUpdateMechanism ^[6].

Comparison

Validation sources: CycloneDX CLI ^[7] and SPDX's JSON-LD validation guidance ^[8].

Tooling maturity

Open-source generators currently lean towards CycloneDX: the OWASP AIBOM Generator emits CycloneDX 1.6 ^[9]. On the SPDX side, spdx3-validate checks SPDX 3 documents, while the SPDX tools-python library describes its 3.0 support as experimental ^[10]. A Linux Foundation Research report on implementing AI BOMs with SPDX 3.0 notes that adoption is still at an early stage ^[11].

Which to choose

• Choose CycloneDX if your software SBOMs are already CycloneDX, if you want model-card content in a nested object, or if you need broad open-source generator support today.
• Choose SPDX 3.0 if your organisation standardises on SPDX, if you want explicit safety, autonomy and personal-data properties, or if you work in linked-data tooling.
• Either satisfies CERT-In, which names both formats (CERT-In AIBOM requirements).

Interoperability tips

• Agree a field mapping with suppliers before exchanging AIBOMs, especially for metrics, limitations and dataset provenance.
• Keep the original supplier file alongside any converted copy, so nothing is lost if a conversion drops AI-specific fields.
• Use stable identifiers for models and datasets, such as a registry URL plus revision, so the same component can be matched across formats.
• Validate after conversion, not only before it.

How IntelliXBOM helps

IntelliXBOM generates and ingests AIBOMs in both CycloneDX and SPDX, so suppliers can deliver in either. It validates each against the same required-field policy and keeps version history and diffs across formats.