What is a CycloneDX ML-BOM?

CycloneDX is the OWASP-backed SBOM standard; its machine-learning extension (ML-BOM) adds first-class component types for models and datasets, plus model cards. It lets an AIBOM live in the same format and tooling as your SBOMs.

Is the generated AIBOM valid CycloneDX?

Yes — it emits a well-formed CycloneDX JSON document (bomFormat "CycloneDX" with a specVersion) using machine-learning-model and data component types. Run it through the AIBOM Validator to confirm license coverage before you ship.