AIBOM Template Library
An AIBOM template is easiest to fill in when you can see a finished one. This library has the same AI system written three ways: a CycloneDX 1.7 ML-BOM, an SPDX 3.0.1 document with the AI and Dataset profiles, and a Croissant RAI file for its training data. Each file passes its official validator, and every field is explained below.
Who this is for: AppSec and AI-security engineers producing their first AIBOM, and GRC teams who need to know what each field claims. Fictional example. Northwind Health, Triage Assistant and its datasets, services, scores and URLs are invented for illustration; the base model and open-source libraries are real.
Pick it when security tooling will read the file: scanners, dependency-track style inventories, the AIBOM Validator and Diff. Read the CycloneDX ML-BOM example field by field ↓
What this tool is
- Three complete AIBOM example files for one AI system: a CycloneDX 1.7 ML-BOM, an SPDX 3.0.1 document with the AI and Dataset profiles, and a Croissant 1.1 dataset file with the Croissant RAI extension.
- All three describe the same fictional system, Northwind Health’s Triage Assistant v2.3: a LoRA fine-tune of Mistral-7B-Instruct-v0.3 served with vLLM, with a RAG index and an MCP tool server.
- The unedited files pass the official CycloneDX 1.7 JSON schema, the SPDX 3.0.1 JSON schema and SHACL shapes, and the mlcroissant reference validator with no errors.
- Every field is explained in plain English below. With Pro: edit the key fields, watch the file regenerate, copy it, and download the JSON plus a PDF field guide, CSV field map and JPG summary card.
- Runs in your browser. Nothing you type is uploaded.
The Northwind example
Northwind Health (fictional) runs Triage Assistant v2.3, which drafts replies to customer support tickets for a human agent to approve. The model, northwind/triage-assistant 2.3.0, is a LoRA fine-tune of the open-weights mistralai/Mistral-7B-Instruct-v0.3 (Apache-2.0), stored as safetensors. It was trained on northwind/support-tickets-2025 (48,210 de-identified tickets from 2025, proprietary) and evaluated on northwind/triage-eval-v4 (1,200 labelled tickets). It is served with vLLM 0.6.3, reads a weekly-refreshed RAG index over the public help centre, and calls one MCP tool server that reads and writes tickets. The weights are signed with Sigstore in CI, and build provenance is an in-toto SLSA attestation.
Out of scope: medical advice, and sending any reply without human approval. Evaluation results (answer accuracy 0.87, toxicity rate 0.2%) are invented for the example.
CycloneDX ML-BOM example, field by field
The whole AI system: model with model card, base model, datasets, libraries, RAG index and MCP server as services, dependency graph, signature and provenance links.
Pick it when security tooling will read the file: scanners, dependency-track style inventories, the AIBOM Validator and Diff. It is one file per system. Detailed dataset documentation fits better in Croissant.
- Standard: CycloneDX (ECMA-424), version 1.7. Specification
- File:
northwind-triage-assistant-2.3.0.cdx.json(application/vnd.cyclonedx+json) - Validated with: Official CycloneDX bom-1.7 JSON schema (Draft-07), with spdx.schema.json and jsf-0.82.schema.json.
| Field | Northwind value | What it means |
|---|---|---|
| bomFormat, specVersion | CycloneDX, 1.7 | Which standard and version the file follows. Validators pick the schema from specVersion. |
| serialNumber, version | urn:uuid:7fffa837-67cc-40b9-963f-55c4f9bf7152, 1 | A unique ID for this BOM and its revision. Bump version when you reissue the same BOM. |
| metadata.timestamp | 2026-02-16T09:00:00Z | When the BOM was generated. |
| metadata.lifecycles[].phase | build | Generated in the build pipeline, not reconstructed later. |
| metadata.component | Triage Assistant 2.3.0 (application) | The system the BOM describes. Everything else is a part of it. |
| metadata.manufacturer / supplier | Northwind Health | Who built and who supplies the system: the accountable party. |
| components[].type | machine-learning-model | Marks the component as a model, so tools look for a model card. |
| components[].group / name / version | northwind / triage-assistant / 2.3.0 | Model identity. This is what an incident responder searches for. |
| components[].hashes | SHA-256 3bad18cc9805… (placeholder) | Digest of the weights file, so you can prove which file was deployed. |
| components[].pedigree.ancestors | mistralai/Mistral-7B-Instruct-v0.3 (pkg:huggingface/mistralai/Mistral-7B-Instruct-v0.3) | Lineage: the base model this one was fine-tuned from. |
| modelCard.modelParameters.approach.type | supervised | Training approach. LoRA fine-tuning on ticket and reply pairs is supervised. |
| modelCard.modelParameters.task | text-generation | What the model does. |
| modelCard.modelParameters.architectureFamily / modelArchitecture | mistral / MistralForCausalLM | Architecture, so you can match vulnerabilities and tooling to it. |
| modelCard.modelParameters.datasets[].ref | data:northwind/support-tickets-2025, data:northwind/triage-eval-v4 | Links to the data components the model was trained and evaluated on. |
| modelCard.quantitativeAnalysis.performanceMetrics | answer-accuracy 0.87 on northwind/triage-eval-v4; toxicity-rate 0.002 (0.2%) (fictional) | Measured results, each tied to the dataset or slice it was measured on. |
| modelCard.considerations.users / useCases | Draft replies to customer support tickets for a human support agent to review, edit and approve before sending. | Intended users and use. The baseline for "is this use allowed?". |
| modelCard.considerations.technicalLimitations | Medical advice or clinical triage of symptoms; Sending any reply to a customer without human approval | Out-of-scope uses and known limits. |
| modelCard.considerations.ethicalConsiderations | Medical advice; personal data in tickets (each with a mitigation) | Named risks, each with how it is handled. |
| components[] (base model).licenses / purl | Apache-2.0 / pkg:huggingface/mistralai/Mistral-7B-Instruct-v0.3@c170c708c41dac9275d15a8fff4eca08d52bab71 | Licence and a package URL pinned to an exact revision of the base model. |
| components[].type = data, data[].classification | northwind/support-tickets-2025: confidential; northwind/triage-eval-v4: confidential | Datasets as first-class components, with classification, sensitive-data notes and owner. |
| components[] (libraries) | vllm 0.6.3, torch 2.4.0, transformers 4.45.2, safetensors 0.4.5, peft 0.13.2 (scope excluded) | Runtime software. Scope "excluded" marks training-only tools that are not shipped. |
| services[] (RAG index) | northwind-helpcentre-index: authenticated, outbound public data, refreshed weekly | Run-time data the model reads that is not in the weights. |
| services[] (MCP server) | ticketing-mcp: x-trust-boundary true, bi-directional confidential data | Tools the model can call, and the fact that calls cross a trust boundary. |
| dependencies[] | Triage Assistant → model, vllm, RAG index, MCP server; model → base model | The graph that answers "what is affected if X is compromised?". |
| externalReferences[] (model) | model-card, digital-signature (Sigstore), attestation (SLSA in-toto), distribution | Where to find the signature and build provenance that back the claims in this file. |
The model component’s modelCard, from the full ML-BOM:
{
"type": "machine-learning-model",
"bom-ref": "model:northwind/triage-assistant@2.3.0",
"name": "triage-assistant",
"version": "2.3.0",
"modelCard": {
"modelParameters": {
"approach": {
"type": "supervised"
},
"task": "text-generation",
"architectureFamily": "mistral",
"modelArchitecture": "MistralForCausalLM",
"datasets": [
{
"ref": "data:northwind/support-tickets-2025"
},
{
"ref": "data:northwind/triage-eval-v4"
}
],
"inputs": [
{
"format": "string"
}
],
"outputs": [
{
"format": "string"
}
]
},
"quantitativeAnalysis": {
"performanceMetrics": [
{
"type": "answer-accuracy",
"value": "0.87",
"slice": "northwind/triage-eval-v4"
},
{
"type": "toxicity-rate",
"value": "0.002",
"slice": "internal red-team prompt set"
}
]
},
"considerations": {
"users": [
"Northwind Health customer support agents"
],
"useCases": [
"Draft replies to customer support tickets for a human support agent to review, edit and approve before sending."
],
"technicalLimitations": [
"Out of scope: Medical advice or clinical triage of symptoms.",
"Out of scope: Sending any reply to a customer without human approval."
],
"ethicalConsiderations": [
{
"name": "A drafted reply could contain medical advice.",
"mitigationStrategy": "System prompt refuses medical advice; a human agent approves every reply before it is sent."
},
{
"name": "Free-text tickets can contain personal data.",
"mitigationStrategy": "Training data de-identified before fine-tuning; replies are drafts that never leave without human review."
}
]
},
"properties": [
{
"name": "playciso:example:metrics",
"value": "Metric values are fictional."
}
]
}
}SPDX 3.0 AI + Dataset example, field by field
The model as an AIPackage, the training, evaluation and retrieval data as DatasetPackages, the runtime as software packages, linked by trainedOn, testedOn, descendantOf and dependsOn relationships.
Pick it when your organisation already ships SPDX SBOMs, or when you need the richer dataset fields (collection, preprocessing, anonymisation, bias). Version 3.0.1 has no service class, so RAG indexes and tool servers are modelled as datasets and packages.
- Standard: SPDX 3.0.1 (AI and Dataset profiles), version 3.0.1. Specification
- File:
northwind-triage-assistant-2.3.0.spdx3.jsonld(application/ld+json) - Validated with: Official SPDX 3.0.1 JSON schema and the SHACL shapes in spdx-model.ttl (pySHACL).
| Field | Northwind value | What it means |
|---|---|---|
| @context | https://spdx.org/rdf/3.0.1/spdx-context.jsonld | Declares SPDX 3.0.1 JSON-LD. Every node lives in one @graph. |
| CreationInfo (specVersion, created, createdBy) | 3.0.1, 2026-02-16T09:00:00Z, Northwind Health | Who produced the SPDX data and when. Shared by every element. |
| SpdxDocument.profileConformance | core, software, ai, dataset, simpleLicensing | Which SPDX profiles the document uses. "ai" and "dataset" are the AIBOM parts. |
| software_Sbom.software_sbomType | build | Generated at build time. |
| ai_AIPackage name / software_packageVersion | northwind/triage-assistant / 2.3.0 | Model identity. AIPackage requires name, version, download location, supplier, release time and primary purpose. |
| software_primaryPurpose | model | Says this package is a model (datasets use "data"). |
| suppliedBy / releaseTime | Northwind Health / 2026-02-16T09:00:00Z | Accountable supplier and release date. |
| verifiedUsing (Hash sha256) | 3bad18cc9805… (placeholder) | Integrity check of the weights file. |
| ai_typeOfModel / ai_domain | decoder-only transformer / customer support | Free-text model type and the domain it is meant for. |
| ai_informationAboutTraining | LoRA fine-tune on northwind/support-tickets-2025 | How the model was trained, in words. |
| ai_informationAboutApplication | Draft replies to customer support tickets for a human support agent to review, edit and approve before sending. | Intended application. |
| ai_limitation | Medical advice or clinical triage of symptoms; Sending any reply to a customer without human approval | Known limitations and out-of-scope uses. One string in SPDX 3.0.1. |
| ai_metric (DictionaryEntry) | answer-accuracy 0.87; toxicity-rate 0.002 (fictional) | Metric name and value as key/value pairs. |
| ai_hyperparameter | finetuning_method = LoRA; task = text-generation | Training settings worth recording. |
| ai_autonomyType | no | No: a human approves every output before it has effect. |
| ai_safetyRiskAssessment | medium | Northwind Health's own risk rating on SPDX's four-level scale (serious, high, medium, low). Fictional. |
| ai_useSensitivePersonalInformation | no | Publisher asserts no sensitive personal data was used in training, after de-identification. |
| dataset_DatasetPackage (training) | northwind/support-tickets-2025, datasetType text, confidentialityLevel amber | The training data as its own element. datasetType is the one Dataset-profile field that is required. |
| dataset_anonymizationMethodUsed / dataset_hasSensitivePersonalInformation | NER plus pattern rules, sample review / no | How identifiers were removed, and the resulting claim. De-identified is not the same as anonymous. |
| dataset_datasetSize | (omitted) | Size in bytes, not records. The record count (48,210) goes in the description. |
| Relationship descendantOf | triage-assistant → mistralai/Mistral-7B-Instruct-v0.3 | Lineage to the base model. |
| Relationship trainedOn / testedOn | northwind/support-tickets-2025 / northwind/triage-eval-v4 | Which data trained the model and which tested it. |
| Relationship dependsOn | Triage Assistant → model, vllm 0.6.3, northwind-helpcentre-index, ticketing-mcp | Run-time dependencies. SPDX 3.0.1 has no service class, so the RAG index is a dataset and the MCP server a package. |
| Relationship hasDeclaredLicense | Apache-2.0 (base model); LicenseRef proprietary (model, data) | Licences, as simplelicensing_LicenseExpression elements. |
| externalRef (model) | documentation (model card); other: Sigstore bundle; other: in-toto provenance | Links to the signature and provenance. SPDX 3.0.1 has no dedicated signature or SLSA ref type, so these use "other" with a contentType. |
The model as an ai_AIPackage, from the full @graph:
{
"type": "ai_AIPackage",
"spdxId": "https://northwind-health.example/spdx/triage-assistant-2.3.0#model",
"creationInfo": "_:creationinfo",
"name": "northwind/triage-assistant",
"summary": "LoRA fine-tune of mistralai/Mistral-7B-Instruct-v0.3 for drafting support replies.",
"software_packageVersion": "2.3.0",
"software_downloadLocation": "https://models.northwind-health.example/northwind/triage-assistant/2.3.0/model.safetensors",
"software_primaryPurpose": "model",
"releaseTime": "2026-02-16T09:00:00Z",
"suppliedBy": "https://northwind-health.example/spdx/triage-assistant-2.3.0#org-northwind-health",
"ai_typeOfModel": [
"decoder-only transformer (causal language model)"
],
"ai_domain": [
"customer support"
],
"ai_informationAboutTraining": "Supervised fine-tuning with LoRA on northwind/support-tickets-2025 (48,210 de-identified tickets). Evaluated on northwind/triage-eval-v4.",
"ai_informationAboutApplication": "Draft replies to customer support tickets for a human support agent to review, edit and approve before sending.",
"ai_limitation": "Out of scope: Medical advice or clinical triage of symptoms; Sending any reply to a customer without human approval.",
"ai_hyperparameter": [
{
"type": "DictionaryEntry",
"key": "finetuning_method",
"value": "LoRA"
},
{
"type": "DictionaryEntry",
"key": "task",
"value": "text-generation"
}
],
"ai_metric": [
{
"type": "DictionaryEntry",
"key": "answer-accuracy (northwind/triage-eval-v4)",
"value": "0.87"
},
{
"type": "DictionaryEntry",
"key": "toxicity-rate (internal red-team set)",
"value": "0.002"
}
],
"ai_autonomyType": "no",
"ai_safetyRiskAssessment": "medium",
"ai_useSensitivePersonalInformation": "no",
"ai_modelDataPreprocessing": [
"De-identification of tickets before training (see the dataset element)."
]
}Croissant RAI example, field by field
The training dataset only: what it contains, its files and record structure, and the Responsible AI fields (collection, preprocessing, sensitive data, biases, limitations, intended use).
Pick it for the training or evaluation dataset itself, especially if you publish data or need the Responsible AI fields. It describes a dataset only. Reference it from the CycloneDX or SPDX file that describes the model.
- Standard: MLCommons Croissant 1.1 + Croissant RAI 1.0, version 1.1 / RAI 1.0. Specification
- File:
northwind-support-tickets-2025.croissant.json(application/ld+json) - Validated with: mlcroissant 1.1.1 (the MLCommons reference library) with no errors.
| Field | Northwind value | What it means |
|---|---|---|
| @context | schema.org vocabulary plus cr:, rai: and dct: prefixes | Croissant is schema.org Dataset markup with ML and RAI extensions. |
| @type | sc:Dataset | A schema.org Dataset, so dataset search engines can read it. |
| conformsTo | http://mlcommons.org/croissant/1.1, http://mlcommons.org/croissant/RAI/1.0 | Required. Declares Croissant 1.1 and the Responsible AI extension. |
| name / alternateName | northwind-support-tickets-2025 / northwind/support-tickets-2025 | Dataset name, plus the repo-style ID used elsewhere in the AIBOM. |
| description | 48,210 de-identified tickets with the resolving reply | Required. What is in the dataset. |
| license | https://northwind-health.example/licences/proprietary | Required. A licence URL; use an SPDX licence URL when one applies. |
| url / creator / datePublished | https://data.northwind-health.example/datasets/support-tickets-2025 / Northwind Health / 2026-01-20 | Required. Where it lives, who made it, when it was published. |
| citeAs | BibTeX @misc entry | Recommended by the reference validator. How to cite the dataset. |
| version | 1.0.0 | Recommended. Semantic versioning: MAJOR when existing records change. |
| distribution[] (cr:FileObject) | tickets.jsonl, application/jsonlines, sha256 (placeholder) | Required. The files, with format and checksum so a download can be verified. |
| recordSet[] / field[] | tickets: ticket_id, closed_on, channel, category, customer_message, agent_reply | The structure of each record and where each field is read from (jsonPath). |
| rai:dataCollection | Exported from the ticketing system, 2025-01-01 to 2025-12-31 | How the data was collected. |
| rai:dataCollectionType | Customer feedback data | Collection type, from the RAI spec's recommended values. |
| rai:dataCollectionTimeframe | 2025-01-01/2025-12-31 | Collection period as an ISO 8601 interval (start/end), the form the RAI vocabulary describes. |
| rai:dataCollectionMissingData | No-reply tickets excluded; phone calls missing | What is not in the data and why. |
| rai:dataPreprocessingProtocol | Dedupe, de-identify, sample review | Steps between raw export and training-ready data. |
| rai:dataAnnotationProtocol / rai:annotationsPerItem | Agent-chosen category at closure / 1 | Where labels came from and how many per record. |
| rai:personalSensitiveInformation | Direct identifiers removed; health context may remain | What sensitive information is or may be present. |
| rai:dataBiases | Written channels only | Known biases. |
| rai:dataLimitations | 2025 products and policies; not for medical advice | Known limits and non-recommended uses. |
| rai:dataUseCases | Fine-tuning northwind/triage-assistant; not for medical advice or profiling | Recommended and excluded uses. |
| rai:dataSocialImpact | Faster replies; risk of repeating agent mistakes | Expected impact on people. |
| rai:dataReleaseMaintenancePlan | Static snapshot, yearly successor | How the dataset is versioned and retired. |
conformsTo and the Croissant RAI properties, from the full dataset file:
{
"conformsTo": [
"http://mlcommons.org/croissant/1.1",
"http://mlcommons.org/croissant/RAI/1.0"
],
"name": "northwind-support-tickets-2025",
"rai:dataCollection": "Tickets closed between 2025-01-01 and 2025-12-31 were exported from the Northwind Health ticketing system, paired with the final agent reply, and de-identified before release.",
"rai:dataCollectionType": [
"Customer feedback data"
],
"rai:dataCollectionRawData": "Northwind Health ticketing system export (email, web form and chat tickets).",
"rai:dataCollectionTimeframe": "2025-01-01/2025-12-31",
"rai:dataCollectionMissingData": "Tickets closed without an agent reply were excluded. Phone calls are not transcribed, so phone-only issues are missing.",
"rai:personalSensitiveInformation": [
"Direct identifiers removed by de-identification. Free text can still mention health conditions, which is why the dataset is confidential."
],
"rai:dataUseCases": [
"Fine-tuning northwind/triage-assistant to draft replies for human approval.",
"Not for: medical advice, profiling customers, or any use outside customer support."
]
}Things the examples get right that templates often miss
- Lineage is explicit. CycloneDX records the base model in
pedigree.ancestorswith a package URL pinned to an exact Hugging Face revision; SPDX uses adescendantOfrelationship. - Run-time reach is in the BOM. The RAG index and the MCP server are listed, and the MCP server is marked as crossing a trust boundary with read/write access to confidential data. That is what a responder needs when the model misbehaves.
- Every metric names its dataset. A score without the dataset it was measured on cannot be compared or reproduced.
- Training-only tools are marked. PEFT is listed with CycloneDX scope
excluded: used to train, not shipped. - Units are right. SPDX
dataset_datasetSizeis bytes, not records, so the record count goes in the description instead. - Claims link to evidence. The signature (Sigstore bundle) and build provenance (in-toto SLSA attestation) are linked from the model, so a reviewer can check the file against what was deployed.
After you download
- Replace every placeholder. The SHA-256 values are digests of placeholder strings, and the
.exampleURLs do not resolve. - Validate. Paste a CycloneDX file into the AIBOM Validator. For SPDX, use the SPDX 3.0.1 JSON schema; for Croissant, mlcroissant.
- Generate it in the build, not by hand, so it matches what shipped. The CycloneDX ML-BOM Converter turns model metadata into an ML-BOM.
- Diff every release with the AIBOM Diff / Drift Detector to catch a swapped base model, dataset or library.
New to AIBOMs? Start with what an AIBOM is, ML-BOM explained and the AIBOM parameters checklist. Everything else is on the AIBOM Library hub.
Sources
Field names and versions checked against these on 29 October 2026. CycloneDX 1.7 is the current CycloneDX release, SPDX 3.0.1 the current SPDX release (3.1 is a release candidate), Croissant 1.1 (January 2026) the current Croissant release and Croissant RAI 1.0 the current RAI vocabulary.
- CycloneDX specification overview (current version 1.7)
- CycloneDX 1.7 JSON schema
- SPDX 3.0.1 specification: AIPackage
- SPDX 3.0.1 specification: DatasetPackage
- SPDX 3.0.1 JSON schema
- MLCommons Croissant 1.1 specification
- MLCommons Croissant RAI 1.0 specification
- Mistral-7B-Instruct-v0.3 on Hugging Face (base model, Apache-2.0)
Frequently asked questions
Is there an AIBOM template I can start from?
Yes. This page has three: a CycloneDX 1.7 ML-BOM, an SPDX 3.0.1 AI and Dataset document, and a Croissant RAI dataset file. Each is a complete example of one fictional system, not a skeleton of empty fields, so you can see what a filled-in value looks like and what it means. Replace the Northwind values with yours, then validate.
What does a CycloneDX ML-BOM example look like?
A CycloneDX JSON file whose model is a component of type machine-learning-model with a modelCard (modelParameters, quantitativeAnalysis, considerations). Datasets are components of type data, runtime libraries are components of type library or framework, and things the model calls at run time, such as a RAG index or an MCP tool server, are services. A dependencies list ties them together, and externalReferences point to the model signature and build provenance.
What is in the SPDX 3.0 AI profile?
The AI profile adds the AIPackage class. In SPDX 3.0.1 JSON-LD its properties are prefixed ai_, for example ai_typeOfModel, ai_informationAboutTraining, ai_informationAboutApplication, ai_limitation, ai_metric, ai_hyperparameter, ai_autonomyType, ai_safetyRiskAssessment and ai_useSensitivePersonalInformation. The Dataset profile adds DatasetPackage (dataset_ properties). Training and test data link to the model with trainedOn and testedOn relationships.
What is Croissant RAI?
Croissant is MLCommons’ JSON-LD metadata format for machine-learning datasets, built on schema.org Dataset. Croissant RAI is its Responsible AI extension: rai: properties for how data was collected, preprocessed and annotated, what personal or sensitive information it holds, known biases and limitations, and intended uses. A file declares both in conformsTo.
Which AIBOM format should I use?
Use CycloneDX if security tools will read the file and you want runtime services (RAG, MCP) in the same document. Use SPDX 3.0 if your organisation already produces SPDX SBOMs or needs the richer dataset fields. Use Croissant for the dataset itself, and reference it from the model’s CycloneDX or SPDX file. Many teams need two of the three.
Is Northwind Health a real company?
No. Northwind Health, Triage Assistant, its datasets, services, scores and URLs are invented. The base model (mistralai/Mistral-7B-Instruct-v0.3, Apache-2.0) and the open-source libraries and their licences are real. The hashes are placeholders and the URLs use the reserved .example domain.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.