What is a CycloneDX ML-BOM?

CycloneDX is the OWASP-backed SBOM standard; its machine-learning extension (ML-BOM) adds first-class component types for models and datasets, plus model cards. It lets an AIBOM live in the same format and tooling as your SBOMs.

Is the generated AIBOM valid CycloneDX?

Yes — it emits a well-formed CycloneDX JSON document (bomFormat "CycloneDX" with a specVersion) using machine-learning-model and data component types. Run it through the AIBOM Validator to confirm license coverage before you ship.

Does my data leave the browser?

No. The conversion runs entirely client-side; nothing you type is uploaded.

Free tool · no signup · runs in your browser

CycloneDX ML-BOM Converter

Type your models and datasets as a simple list — name, version, license — and get a valid CycloneDX AI Bill of Materials. Nothing is uploaded.

Models

Datasets

Next steps. Validate the output with the free AIBOM Validator, screen each license with the Model License Checker, and read what an AIBOM is and why customers ask for one.

CycloneDX ML-BOM Converter

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free