# CycloneDX ML-BOM Converter — Free Tool

> Turn a plain list of models & datasets into a CycloneDX AIBOM in seconds.

URL: [https://playciso.com/tools/mlbom-converter](https://playciso.com/tools/mlbom-converter)

The CycloneDX ML-BOM Converter turns a plain, human-written list of the models and datasets in your product into a standards-based CycloneDX AI Bill of Materials. You should not have to learn the CycloneDX JSON schema by hand to produce your first AIBOM — type what you know, get valid JSON out.

The output is standard CycloneDX (with the machine-learning component types), so it drops straight into the same tools, registries and vulnerability workflows your SBOMs already flow through.

## How to use it

- List your models, one per line, as: name, version, license (for example: llama-3-8b, 1.0, Llama 3 Community).
- List your datasets the same way in the datasets box.
- Copy the generated CycloneDX JSON, or validate it with the AIBOM Validator before committing it to CI.

## FAQ

### What is a CycloneDX ML-BOM?

CycloneDX is the OWASP-backed SBOM standard; its machine-learning extension (ML-BOM) adds first-class component types for models and datasets, plus model cards. It lets an AIBOM live in the same format and tooling as your SBOMs.

### Is the generated AIBOM valid CycloneDX?

Yes — it emits a well-formed CycloneDX JSON document (bomFormat "CycloneDX" with a specVersion) using machine-learning-model and data component types. Run it through the AIBOM Validator to confirm license coverage before you ship.

### Does my data leave the browser?

No. The conversion runs entirely client-side; nothing you type is uploaded.


---

PlayCISO is a simulation-first platform for security leaders: a War Room incident simulator, a simulated PCI DSS QSA interview, board-report coaching, free security scanners, and a curated library of free courses. https://playciso.com