AI Assurance DirectoryAI assurance & verification
CycloneDX (AI/ML-BOM)
Evidence strength: Emerging How this is scored
OWASP/Ecma TC54 BOM standard (CycloneDX 1.7, released 21 October 2025) published as ECMA-424 2nd edition (10 December 2025). Homepage names 260+ tools, the defense industrial base, satellite and space systems, and medical-device HBOM/SBOM. The ML-BOM guide names the EU AI Act and NIST AI RMF.
Certification evidence
Analyst assessment: 1 NIST SP 800-218A practice — see which with Pro
Analyst assessment: 1 NIST AI RMF function or subcategory — see which with Pro
Certification relevance. Cited pages name EU AI Act and NIST AI RMF but do not name a specific clause, function or article.
No cited mapping or literature quote yet. Analyst assessments, if any, stay on Pro.
Listing detail and source evidence (Pro)
Included on Pro, Team and Enterprise. Public summaries, tags and official links on this page stay free.
Analyst assessments (Pro)
Included on Pro, Team and Enterprise. Public summaries, tags and official links on this page stay free.
Procurement evidence pack (Pro) — print cited mappings and analyst notes. The print view is not on this page.
- Vendor / publisher
- OWASP / Ecma TC54
- Type
- Open source
- Open source
- Open source · Apache-2.0 on the official repository https://github.com/CycloneDX/cyclonedx-cli. Badge is used only when that repo shows an OSI-approved license.
- Official site
- https://cyclonedx.org/
- Industries
- Frameworks named on cited source
- Last verified
Listing is not an endorsement, certification or recommendation. Capabilities, availability and framework support can change. Confirm with the vendor and the relevant authority. See the disclaimer.