The AIBOM Data Section: Datasets and Licensing

The data section of an AIBOM records which datasets trained, tested and feed the model, under what licence, how they were collected and cleaned, and what sensitive information they hold. In CycloneDX that is a data component; in SPDX 3.0 it is a DatasetPackage linked by trainedOn or testedOn; Croissant RAI holds the richest description. Below, each fact is mapped to its field, to Article 10 of the EU AI Act, and to Northwind’s two fictional datasets.

Who this is for: GRC and compliance leads who must show a regulator or customer where the data came from, and the AppSec and data engineers who fill the fields in.

What the data section must answer

• Which datasets trained the model, which only tested it, and which does it read at run time?
• May we use them this way? That is the licence, and for personal data, the purpose.
• Where and when were they collected?
• What was done to them: cleaning, labelling, de-identification?
• What personal or sensitive information is in them?
• What do they leave out, and who is under-represented?

One fact, four places

Field names are from the CycloneDX 1.7 schema, SPDX 3.0.1, Croissant 1.1 with RAI 1.0, and the Hugging Face dataset card spec and template.

The pattern is plain. CycloneDX tells you a dataset exists, who owns it and how sensitive it is, but has no fields for how it was collected, cleaned or biased. SPDX 3.0 adds those. Croissant RAI describes the data itself in the most detail. Most teams keep the dataset in the BOM, with the full description in a Croissant file or a datasheet linked from it. Our Croissant RAI walkthrough and SPDX Dataset profile walkthrough cover each format end to end; Dataset card templates compared covers the documents for people.

Northwind’s training data, field by field

Northwind Health (fictional) fine-tuned its Triage Assistant on northwind/support-tickets-2025: 48,210 de-identified support tickets closed between January and December 2025, under a proprietary licence. Here is that dataset in the SPDX file:

{
  "type": "dataset_DatasetPackage",
  "name": "northwind/support-tickets-2025",
  "description": "48,210 de-identified support tickets, 2025-01-01 to 2025-12-31. FICTIONAL EXAMPLE.",
  "software_packageVersion": "1.0.0",
  "builtTime": "2025-12-31T23:59:59Z",
  "originatedBy": [
    "https://northwind-health.example/spdx/triage-assistant-2.3.0#org-northwind-health"
  ],
  "dataset_datasetType": ["text"],
  "dataset_intendedUse": "Fine-tuning northwind/triage-assistant to draft support replies.",
  "dataset_dataCollectionProcess": "Exported from the Northwind Health ticketing system for tickets closed between 2025-01-01 and 2025-12-31.",
  "dataset_dataPreprocessing": [
    "Removed tickets without an agent reply.",
    "De-identified free text before release."
  ],
  "dataset_anonymizationMethodUsed": [
    "Named-entity detection plus pattern rules to remove names, email addresses, phone numbers, postal addresses and account or member numbers; manual review of a sample."
  ],
  "dataset_confidentialityLevel": "amber",
  "dataset_hasSensitivePersonalInformation": "no",
  "dataset_knownBias": [
    "Covers written tickets only; phone-channel issues are under-represented."
  ],
  "dataset_datasetUpdateMechanism": "None. Static snapshot of 2025 tickets."
}

Excerpt, 26 lines: the training DatasetPackage from Northwind’s SPDX 3.0.1 file. Keys not shown are left out; every value shown is exactly as in the full file (608 lines pretty-printed), which is in the Pro AIBOM Template Library.

And in the CycloneDX file, where the same dataset is a component:

{
  "type": "data",
  "bom-ref": "data:northwind/support-tickets-2025",
  "name": "support-tickets-2025",
  "version": "1.0.0",
  "description": "48,210 de-identified support tickets, 2025-01-01 to 2025-12-31. FICTIONAL EXAMPLE.",
  "licenses": [{ "license": { "name": "Northwind Health Proprietary Licence" } }],
  "data": [
    {
      "type": "dataset",
      "name": "northwind/support-tickets-2025",
      "description": "Customer messages and the agent replies that resolved them, with the ticket category.",
      "contents": {
        "url": "https://data.northwind-health.example/datasets/support-tickets-2025"
      },
      "classification": "confidential",
      "sensitiveData": [
        "Direct identifiers removed by de-identification before release; free text may still mention health context."
      ],
      "governance": { "owners": [{ "organization": { "name": "Northwind Health" } }] }
    }
  ]
}

Excerpt, 23 lines: the training data component from Northwind’s CycloneDX 1.7 file. Keys not shown are left out; every value shown is exactly as in the full file (519 lines pretty-printed), which is in the Pro AIBOM Template Library.

Two details worth copying. dataset_datasetType is the only Dataset-profile property SPDX 3.0.1 requires. And the record count sits in the description, because SPDX dataset_datasetSize is “measured in bytes”.

A licence is not permission to train

The licence field answers “who may copy and share this?”. For data you hold about people, the harder question is purpose. Article 10(2)(b) of the AI Act asks high-risk providers to document “data collection processes and the origin of data, and in the case of personal data, the original purpose of the data collection”. Northwind collected tickets to resolve customer requests. Training a reply drafter on them is a new use. Whether that use is allowed is a question for its privacy team; the AIBOM records the answer and points to where the decision is written down. Northwind’s files describe the export but not the original purpose, which is a gap.

For third-party data, record two licences. SPDX 3.0 has hasDeclaredLicense and hasConcludedLicense, so a file can hold what the supplier declared and what your own review concluded. When they differ, the difference is the finding.

For a base model’s training data, record what the supplier states and mark it as the supplier’s claim. The public model card for Mistral-7B-Instruct-v0.3 does not describe its training data, so Northwind’s AIBOM cannot either. Write that down as a known unknown, not a blank.

Sensitive data: de-identified is not anonymous

Northwind’s three files describe the same dataset in three ways:

• CycloneDX sensitiveData: “Direct identifiers removed by de-identification before release; free text may still mention health context.”
• SPDX dataset_hasSensitivePersonalInformation: no, and on the model, ai_useSensitivePersonalInformation: no
• Croissant rai:personalSensitiveInformation: “Direct identifiers removed by de-identification. Free text can still mention health conditions, which is why the dataset is confidential.”

None of them is wrong, but a reviewer should ask whether “no” is defensible. SPDX defines the property as the presence of sensitive personal data “or information that allows drawing conclusions about a person’s identity”, and it only offers yes, no or noAssertion. Under GDPR Recital 26, pseudonymised data that can be attributed to a person with additional information is still personal data. Data concerning health is a special category under GDPR Article 9. Free-text tickets from a health company that may still mention conditions are exactly where de-identification leaks. Northwind has two honest options: keep “no” and attach the evidence, such as a re-identification test on a sample, or use noAssertion until it has that evidence.

The confidentiality level helps here. SPDX’s amber means data “can be shared only with specific organizations and their clients on a need to know basis”, which matches how Northwind treats the dataset.

What the EU AI Act asks of training data

Article 10 applies to high-risk AI systems that are trained on data. Its paragraph 2 lists the data governance practices that training, validation and testing data must be subject to. Northwind’s assistant is not high-risk (our Annex IV walkthrough explains why), but the list is the best checklist we know for a data section. The second column paraphrases the official text.

Fictional example. Northwind Health, Triage Assistant and its datasets, services, scores and URLs are invented for illustration; the base model and open-source libraries are real.

Three more points from the current text on the AI Act Service Desk:

• Article 10(3) and (4) ask for data that are relevant, sufficiently representative and, as far as possible, free of errors and complete, with the right statistical properties for the people the system is used on and the setting it is used in. That evidence is per-group statistics, which no BOM format holds; link to it.
• Article 10(5) is marked deleted. Processing special categories of personal data for bias detection and correction now sits in a new Article 4a, with conditions such as pseudonymisation, no transfer to other parties and deletion once the bias is corrected.
• Annex IV point 2(d) asks for “datasheets describing the training methodologies and techniques and the training data sets used”, including provenance, scope, how the data was obtained and selected, labelling and cleaning. A datasheet per dataset answers it directly.

If your data documentation comes from a GPAI provider

Providers of general-purpose AI models document their data in the Model Documentation Form. A downstream provider receives only part of it: the data type and modality, the provenance categories (web crawling, third-party private datasets, user data, publicly available datasets, data collected by other means, non-public synthetic data) and the curation methods. How the data was obtained, its scope, the number of data points and the measures against unsuitable data and bias go to the AI Office and national authorities only. Copy what you receive into your AIBOM as the supplier’s statement. Our form explainer lists who gets each item.

The evaluation set and the RAG index are data too

• northwind/triage-eval-v4: 1,200 labelled tickets, linked with testedOn, version 4.0.0, with dataset_intendedUse “Evaluation only. Never used for training.” Record the version, because a metric is meaningless without the exact test set. Northwind does not record a check that no evaluation ticket also appears in the training set; add one.
• northwind-helpcentre-index: retrieved at run time from the public help centre and rebuilt weekly. SPDX models it as a DatasetPackage with dataset_datasetUpdateMechanism and confidentiality clear; CycloneDX models it as a service. It changes what the model says without changing the weights, which is why the security and runtime section treats it as an input to secure.

Data section checklist

• Every training, evaluation and retrieval dataset is listed, with version and hash.
• Each is marked as training or testing data (SPDX trainedOn / testedOn, or the description in CycloneDX).
• A licence is recorded, and for personal data, the original collection purpose and the approval for the new one.
• Collection, cleaning, labelling and de-identification are described.
• Sensitive-data claims come with evidence, or say noAssertion.
• Known biases and gaps are written down, including what is missing.
• Record counts sit in the description; dataset_datasetSize holds bytes.
• Each dataset links to a datasheet or Croissant file with the full story.

The rest of the AIBOM

Data is one section of four. Identity and lineage pins the model and its base models. Security and runtime covers what runs and what the model can reach. Evaluation and intended use covers the metrics measured on the evaluation set. To see each dataset field next to its equivalent in every other format, use the AIBOM Format Field Map (Pro); the complete Northwind files are in the AIBOM Template Library (Pro). All guides by role are on the AIBOM Library hub.

Frequently asked questions

What should the data section of an AIBOM include?

For every training, evaluation and retrieval dataset: its name, version and hash; its licence; where and when it was collected and for what original purpose; what was done to it (cleaning, labelling, de-identification); what personal or sensitive information it holds; its known biases and gaps; its intended use; and whether it trained or only tested the model.

How do I record a dataset licence in an AIBOM?

In CycloneDX, use licenses on the data component, with an SPDX licence ID or a named licence. In SPDX 3.0, link the DatasetPackage to a licence expression with hasDeclaredLicense, and use hasConcludedLicense for the licence you concluded after review; custom licences use a LicenseRef- identifier. Croissant uses the schema.org license property, ideally a URL.

Does the EU AI Act require documenting training data?

For high-risk AI systems, yes: Article 10 sets data governance practices for training, validation and testing data, and Annex IV point 2(d) asks for datasheets describing the data, its provenance and how it was obtained, labelled and cleaned. Providers of general-purpose AI models document their data under Annexes XI and XII and publish a summary of training content.

Is de-identified data still personal data?

It can be. Under GDPR Recital 26, pseudonymised data that could be attributed to a person with additional information is still personal data; only data rendered anonymous, so that people are no longer identifiable, falls outside the GDPR. Free text is hard to anonymise fully, so record the method used and the evidence, not just a yes or no.

Where do I record that a dataset was only used for evaluation?

SPDX 3.0 has separate relationships: trainedOn for training data and testedOn for evaluation data, plus dataset_intendedUse for a sentence such as “evaluation only”. CycloneDX lists both in modelCard.modelParameters.datasets without a split, so say which is which in each data component’s description.

Should I use CycloneDX, SPDX or Croissant for datasets?

CycloneDX is thin on dataset detail but sits in the same file as the model and the software. SPDX 3.0’s Dataset profile has fields for collection, preprocessing, anonymisation, bias and confidentiality. Croissant with its RAI vocabulary is the richest description of the data itself. A common pattern is the BOM for the inventory, with a Croissant file or datasheet per dataset linked from it.

Sources

• CycloneDX 1.7 JSON schema (bom-1.7.schema.json): component, pedigree, modelCard, componentData, service, vulnerability
• SPDX 3.0.1: DatasetPackage
• SPDX 3.0.1: datasetSize (“measured in bytes”)
• SPDX 3.0.1: hasSensitivePersonalInformation
• SPDX 3.0.1: ConfidentialityLevelType
• SPDX 3.0.1: RelationshipType (descendantOf, hasVariant, trainedOn, testedOn, dependsOn)
• MLCommons Croissant 1.1 specification
• MLCommons Croissant RAI 1.0 specification
• Hugging Face dataset card metadata spec
• Hugging Face dataset card template
• AI Act Article 10 (AI Act Service Desk)
• AI Act Article 4a (AI Act Service Desk)
• AI Act Annex IV (AI Act Service Desk)
• GPAI Code of Practice: Model Documentation Form (DOCX)
• Regulation (EU) 2016/679 (GDPR), Article 9 and Recital 26
• mistralai/Mistral-7B-Instruct-v0.3 on Hugging Face (model card, Apache-2.0, base_model)

Checked on 29 October 2026. PlayCISO is not affiliated with any standards body, vendor or project named here. This is general information, not legal advice.