Apr 15, 2024·SPDX (Linux Foundation) · SpecificationActiveMedium impact
SPDX 3.0 final published - adds AI and dataset profiles
SPDX 3.0 introduces profiles (Software, Security, AI, Dataset) that align directly with SaMD and PCCP cybersecurity expectations.
What changed
- AI profile lets you describe model components, training data, and security properties in the SBOM.
- Profiles can be mixed-and-matched per document.
Action for manufacturers
If you ship AI/ML SaMD, evaluate SPDX 3.0 AI profile output - reviewers asking about model provenance will accept it well.