# AIBOM Validator (CycloneDX ML-BOM Linter) — Free Tool

> Paste a CycloneDX AIBOM — get an instant pass/fail readiness check.

URL: [https://playciso.com/tools/aibom-validator](https://playciso.com/tools/aibom-validator)

The AIBOM Validator is a free, no-signup linter for CycloneDX AI Bills of Materials. Paste a CycloneDX JSON document and it checks the things a good AIBOM must get right: is it valid JSON, is it actually CycloneDX, does it inventory models and datasets (not just code), does every component carry a license, and do the models have model cards.

It runs entirely in your browser — nothing is uploaded — and it names the specific components missing a license, because a missing-license component is the gap that becomes a finding in someone else’s audit.

## How to use it

- Paste a CycloneDX BOM (the JSON your SBOM/AIBOM tooling emits) into the box.
- Read the checklist: valid JSON, CycloneDX format + spec version, component count, models, datasets, license coverage, and model cards.
- Fix the flagged gaps — especially any components listed as missing a license — and re-run.

## FAQ

### What makes an AIBOM valid?

A valid AIBOM is well-formed CycloneDX JSON that inventories every component with a license and provenance. For an AI system that means models and datasets are represented as first-class components (CycloneDX ML-BOM), not just code libraries, and each carries a license and, ideally, a model card.

### What is the difference between an SBOM and an AIBOM here?

An SBOM inventories code. An AIBOM extends it with the AI-specific components an SBOM ignores — models and datasets, with their licenses and provenance. This validator flags when a document is really just an SBOM (no model or dataset components).

### Does my BOM data leave my browser?

No. Parsing and validation happen entirely client-side. Nothing you paste is uploaded or stored.

### Which CycloneDX version does it expect?

It reads standard CycloneDX JSON (bomFormat "CycloneDX" with a specVersion). Machine-learning support — model cards and dataset components — is part of the CycloneDX ML-BOM extension in recent spec versions.


---

PlayCISO is a simulation-first platform for security leaders: a War Room incident simulator, a simulated PCI DSS QSA interview, board-report coaching, free security scanners, and a curated library of free courses. https://playciso.com