What makes an AIBOM valid?

A valid AIBOM is well-formed CycloneDX JSON that inventories every component with a license and provenance. For an AI system that means models and datasets are represented as first-class components (CycloneDX ML-BOM), not just code libraries, and each carries a license and, ideally, a model card.

What is the difference between an SBOM and an AIBOM here?

An SBOM inventories code. An AIBOM extends it with the AI-specific components an SBOM ignores — models and datasets, with their licenses and provenance. This validator flags when a document is really just an SBOM (no model or dataset components).

Does my BOM data leave my browser?

No. Parsing and validation happen entirely client-side. Nothing you paste is uploaded or stored.

Which CycloneDX version does it expect?

It reads standard CycloneDX JSON (bomFormat "CycloneDX" with a specVersion). Machine-learning support — model cards and dataset components — is part of the CycloneDX ML-BOM extension in recent spec versions.

Free tool · no signup · runs in your browser

AIBOM Validator

Paste a CycloneDX AI Bill of Materials and get an instant readiness check — format, model & dataset coverage, license completeness, and model cards. Nothing is uploaded.

CycloneDX JSON

Need to generate one first? Use the free AI Bill of Materials generator, check a specific license with the Model License Checker, and read what an AIBOM is.

AIBOM Validator

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free