What makes an AIBOM valid?

A valid AIBOM is well-formed CycloneDX JSON that inventories every component with a license and provenance. For an AI system that means models and datasets are represented as first-class components (CycloneDX ML-BOM), not just code libraries, and each carries a license and, ideally, a model card.

What is the difference between an SBOM and an AIBOM here?

An SBOM inventories code. An AIBOM extends it with the AI-specific components an SBOM ignores — models and datasets, with their licenses and provenance. This validator flags when a document is really just an SBOM (no model or dataset components).

Does my BOM data leave my browser?

No. Parsing and validation happen entirely client-side. Nothing you paste is uploaded or stored.

Which CycloneDX version does it expect?

It reads standard CycloneDX JSON (bomFormat "CycloneDX" with a specVersion). Machine-learning support — model cards and dataset components — is part of the CycloneDX ML-BOM extension in recent spec versions.