SPDX 3.0 AI and Dataset Profiles, With Example

SPDX 3.0 describes an AI model as an AIPackage from the AI profile and each dataset as a DatasetPackage from the Dataset profile. Both are software packages, so they carry the usual name, version, supplier and download location. They are joined by separate Relationship elements: trainedOn and testedOn from the model to its data, descendantOf to the base model. The current version is 3.0.1.

Who this is for: AppSec engineers whose SBOM pipeline already speaks SPDX and now has to cover models, and GRC teams who receive SPDX files as evidence and need to know what each AI field claims. For the general idea, start with what an AIBOM is; for a format-neutral field list, see the AIBOM parameters checklist.

Fictional example. Northwind Health, Triage Assistant and its datasets, services, scores and URLs are invented for illustration; the base model and open-source libraries are real.

How an SPDX 3.0 AIBOM is laid out

An SPDX 3.0 file in JSON-LD is one @context and one flat @graph of elements. Five things to know before reading one:

• Everything is an element with an spdxId, a URI. Northwind uses https://northwind-health.example/spdx/triage-assistant-2.3.0#….
• One shared CreationInfo says who produced the data and when (spec version 3.0.1). Every element points at it.
• Profiles are declared. The SpdxDocument lists profileConformance: core, software, ai, dataset and simpleLicensing for Northwind.
• Property names carry the profile as a prefix in JSON-LD: ai_limitation, dataset_datasetType, software_packageVersion. Core properties such as name have none.
• Links are elements too. “The model was trained on this dataset” is a Relationship node with from, relationshipType and to, not a field inside the model. Licences work the same way, through hasDeclaredLicense.

If you know SPDX 2.x, note that 3.0 is a new model, not an extension of 2.x documents. Tools written for 2.x will not read it.

AIPackage: the AI profile

An AIPackage must have the six package properties in the first rows. Every ai_ property is optional. Cardinality is from the SPDX 3.0.1 class page.

Two of these are judgements, not facts. ai_safetyRiskAssessment is the supplier’s own rating on a four-level scale, and ai_useSensitivePersonalInformation is the supplier’s claim after its own de-identification. Read both as claims to test.

DatasetPackage: the Dataset profile

A DatasetPackage must have at least one dataset_datasetType, plus builtTime, releaseTime, originatedBy, a download location and a primary purpose (data).

Relationships that make it an AIBOM

• describes: the SBOM element describes the application.
• dependsOn: the application depends on the model, vLLM 0.6.3, the RAG index and the MCP server; vLLM depends on its libraries.
• descendantOf: the fine-tune is a descendant of mistralai/Mistral-7B-Instruct-v0.3.
• trainedOn and testedOn: the model was trained on northwind/support-tickets-2025 and tested on northwind/triage-eval-v4. The direction is always from the model to the data.
• hasDeclaredLicense: each package to a simplelicensing_LicenseExpression element. The base model gets Apache-2.0; Northwind’s own model and data get a LicenseRef- identifier mapped to a licence URL.

The Northwind field table

The example file, excerpted

The model with its signature link, the training dataset, and the two relationships that say where the model came from and what it learned from.

{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "ai_AIPackage",
      "spdxId": "https://northwind-health.example/spdx/triage-assistant-2.3.0#model",
      "name": "northwind/triage-assistant",
      "software_packageVersion": "2.3.0",
      "software_primaryPurpose": "model",
      "suppliedBy": "https://northwind-health.example/spdx/triage-assistant-2.3.0#org-northwind-health",
      "releaseTime": "2026-02-16T09:00:00Z",
      "ai_typeOfModel": ["decoder-only transformer (causal language model)"],
      "ai_limitation": "Out of scope: Medical advice or clinical triage of symptoms; Sending any reply to a customer without human approval.",
      "ai_autonomyType": "no",
      "ai_safetyRiskAssessment": "medium",
      "ai_useSensitivePersonalInformation": "no",
      "externalRef": [
        {
          "type": "ExternalRef",
          "externalRefType": "other",
          "locator": [
            "https://models.northwind-health.example/northwind/triage-assistant/2.3.0/model.sig"
          ],
          "contentType": "application/vnd.dev.sigstore.bundle.v0.3+json",
          "comment": "Sigstore model signature (OpenSSF model signing), produced in CI."
        }
      ]
    },
    {
      "type": "dataset_DatasetPackage",
      "spdxId": "https://northwind-health.example/spdx/triage-assistant-2.3.0#dataset-support-tickets-2025",
      "name": "northwind/support-tickets-2025",
      "builtTime": "2025-12-31T23:59:59Z",
      "originatedBy": [
        "https://northwind-health.example/spdx/triage-assistant-2.3.0#org-northwind-health"
      ],
      "dataset_datasetType": ["text"],
      "dataset_anonymizationMethodUsed": [
        "Named-entity detection plus pattern rules to remove names, email addresses, phone numbers, postal addresses and account or member numbers; manual review of a sample."
      ],
      "dataset_confidentialityLevel": "amber",
      "dataset_hasSensitivePersonalInformation": "no"
    },
    {
      "type": "Relationship",
      "from": "https://northwind-health.example/spdx/triage-assistant-2.3.0#model",
      "relationshipType": "descendantOf",
      "to": ["https://northwind-health.example/spdx/triage-assistant-2.3.0#base-model"]
    },
    {
      "type": "Relationship",
      "from": "https://northwind-health.example/spdx/triage-assistant-2.3.0#model",
      "relationshipType": "trainedOn",
      "to": [
        "https://northwind-health.example/spdx/triage-assistant-2.3.0#dataset-support-tickets-2025"
      ]
    }
  ]
}

Excerpt, 59 lines: the AIPackage (metrics and two of its three external references left out), the training DatasetPackage, and the descendantOf and trainedOn relationships. Keys and list entries not shown are left out; every value shown is exactly as in the full file, which runs to 608 lines pretty-printed.

The complete file, with the application, the base model, the evaluation set, the RAG index, the MCP server, the libraries, the licences and every relationship, is in the AIBOM Template Library (Pro).

Gaps we hit, and what we did

Building the Northwind file in SPDX 3.0.1 ran into five places where the model has no field for something an AI system needs. None makes the file invalid. All of them push facts into free text.

SPDX or CycloneDX?

Neither is better in general. Pick by what you need to express and who reads it.

The CycloneDX ML-BOM guide uses the same Northwind system, so you can compare the two files field by field. The AIBOM Format Field Map (Pro) does that comparison for every field. For how the three bill-of-materials ideas differ, see SBOM vs AIBOM vs MLBOM.

How to validate it

1. Structure: the official SPDX 3.0.1 JSON schema checks that the JSON-LD has the right shape.
2. Meaning: the SHACL shapes in the SPDX model file (spdx-model.ttl) check required properties, cardinalities and enumerated values, for example with pySHACL. This is what catches a DatasetPackage without a datasetType.
3. Both at once: the community tool spdx3-validate runs the schema and SHACL checks together, with some extra checks for documents that reference each other.

The Northwind file passes the official SPDX 3.0.1 JSON schema and the SHACL shapes (checked with pySHACL). As with any format, valid only means well-formed. The facts inside, such as the de-identification claim, still need evidence.

Where to go next

This guide is part of the AIBOM Library. The same Northwind system in the other formats: CycloneDX ML-BOM and Croissant RAI. To choose between formats, start with AIBOM standards and templates compared; to see one field across every format, use the AIBOM Format Field Map (Pro).

Frequently asked questions

What is the SPDX AI profile?

The part of SPDX 3.0 that describes AI models. It adds the AIPackage class, a software package with properties such as typeOfModel, informationAboutTraining, informationAboutApplication, limitation, metric, hyperparameter, autonomyType, safetyRiskAssessment, useSensitivePersonalInformation and energyConsumption. The Dataset profile adds DatasetPackage for training and test data.

What fields does an SPDX AIPackage require?

In SPDX 3.0.1 every AIPackage needs a name, packageVersion, downloadLocation, primaryPurpose, suppliedBy and releaseTime, plus the spdxId and creationInfo every element has. All the ai_ properties are optional. A DatasetPackage needs datasetType, builtTime, releaseTime, originatedBy, downloadLocation and primaryPurpose.

How do you link a model to its training data in SPDX 3.0?

With Relationship elements. A relationship from the model to a dataset with relationshipType trainedOn says the model was trained on it; testedOn says it was tested on it; descendantOf from the fine-tune to the base model records lineage. Relationships are separate nodes in the @graph, not properties nested inside the model.

Can SPDX 3.0 describe a RAG pipeline or an MCP server?

Only partly. SPDX 3.0.1 has no class for a service called at run time. You can model a retrieval index as a DatasetPackage and a tool server as a software Package, linked with dependsOn, but authentication, trust boundaries and tool permissions end up in free text. CycloneDX services hold them as fields.

Is SPDX 3.0 an ISO standard?

No. ISO/IEC 5962:2021 is SPDX 2.2.1. The AI and Dataset profiles are new in SPDX 3.0, so they are not part of that ISO text. The current SPDX version is 3.0.1; SPDX 3.1 was at release-candidate stage in October 2026.

Should I use SPDX or CycloneDX for an AIBOM?

Use the format your SBOM pipeline and your customers already use. Choose CycloneDX if you need run-time services with trust boundaries or a structured model card. Choose SPDX if your focus is licence compliance or detailed dataset facts such as anonymisation method and confidentiality level. You can produce both from one source.

Sources

• SPDX 3.0.1: AIPackage
• SPDX 3.0.1: DatasetPackage
• SPDX 3.0.1: RelationshipType (trainedOn, testedOn, descendantOf)
• SPDX 3.0.1: ExternalRefType
• SPDX 3.0.1: datasetSize (“measured in bytes”)
• SPDX 3.0.1 JSON schema
• spdx3-validate (JSON schema plus SHACL checks for SPDX 3)
• SPDX 3.1 release candidate 1
• Mistral-7B-Instruct-v0.3 on Hugging Face (the real base model in the example)

Checked on 29 October 2026. PlayCISO is not affiliated with OWASP, Ecma, the Linux Foundation or MLCommons. This is general information, not legal advice.