Using SDPX 3 for AI Governance
SPDX 3 offers richer information to help teams understand what a model or component is designed to do, how it was developed, and where additional review may be needed. This richer metadata also lays the foundation for AI Bills of Materials (AI-BOMs), giving organizations a more complete inventory of the models, datasets, and other AI-related components used across their applications. In this video, see how SPDX 3 can be brought into Sonatype Guide to turn that information into actionable context for understanding and evaluating your AI supply chain.
Turn Context Into Better AI Governance
Richer software inventory data gives teams a stronger basis for managing risk, meeting internal requirements, and adapting as AI becomes a larger part of the development lifecycle.
Bring SPDX 3 Data to Existing Workflows
Import SPDX 3 documents through your preferred workflow, whether that is an API, command-line scan, or the product interface.
Keep Policy Decisions Consistent
Use the same security, license, quality, and AI policy frameworks across both traditional dependencies and AI model records.
Examine the Data That Matters
Explore model-specific attributes such as intended domains, training information, hyperparameters, and standards compliance.
Related Resources
Frequently Asked Questions
What is SPDX 3?
SPDX 3 is an open standard for sharing software supply chain information. It expands on earlier versions by supporting more detailed information about AI systems, models, datasets, and other software components.
What kinds of AI information can SPDX 3 include?
SPDX 3 can capture information such as a model’s intended use, functional domain, licensing, training details, technical parameters, standards alignment, and energy-related characteristics.
Can SPDX 3 be imported into existing workflows?
Yes. Teams can bring SPDX 3 data into their existing inventory and governance workflows through Sonatype’s APIs, CLI scanners, or directly in the user interface.
Do existing security and license policies still apply?
Yes. Existing policies can continue to evaluate the components and model records included in an SPDX 3 document. This helps teams apply consistent guardrails across open source packages and AI-related assets.
How does richer model metadata help governance teams?
More context makes it easier to understand what a model is, how it’s used, and which requirements apply. Teams can use that insight to improve AI governance, strengthen review processes, improve policy decisions, and reduce surprises later in the delivery cycle.
Is SPDX 3 only relevant for large language models?
No. SPDX 3 can describe a range of AI-related assets, along with conventional software components. It is useful for organizations that want a more complete picture of the software and AI systems moving through their development environment.