Decision support

Compare standards by the job they do

Place up to three profiles side by side. Focus on architectural role, evidence, and the first limitation to test—not on finding a single all-purpose standard.

Working set

Choose profiles

1 of 3 selected

SPDXStandard

Add a profile

Decision lens

Compare roles before you compare maturity.

The useful question is not “Which standard wins?” It is “Which job must this part of the architecture perform, and what remains uncovered?”

Start with the job
Decide whether you need guidance, a domain payload, exchange, semantics, governance, or a reusable release.
Map lifecycle reach
Use the matrix to see where each profile has a direct role. A filled cell is coverage, not a quality score.
Test the boundary
Read what each option leaves unresolved before judging maturity, confidence, or implementation fit.

Three-part assessment

See the reach, the gaps, and the evidence.

Read left to right. Lifecycle reach comes first; maturity remains an editorial roll-up, not certification.

01 · Lifecycle reach

Where each profile contributes directly

Coverage shows a recorded role at that readiness stage. It does not imply end-to-end implementation.

Readiness-stage coverage for SPDX 3.0 System Bill of Materials
Profile	Plan	Acquire	Harmonize	Exchange	Learn + reuse
SPDXStandard	SPDX 3.0 System Bill of Materials has no direct role recorded in Plan.	SPDX 3.0 System Bill of Materials has no direct role recorded in Acquire.	SPDX 3.0 System Bill of Materials has no direct role recorded in Harmonize.	SPDX 3.0 System Bill of Materials has a direct role in Exchange.	SPDX 3.0 System Bill of Materials has a direct role in Learn + reuse.

Direct role recordedNo direct role recorded

02 · Boundaries

What each option does not cover

These are design boundaries, not faults. Use them to identify the companion layers your architecture still needs.

SPDX

Stage boundary: No direct role is recorded for Plan, Acquire, Harmonize.
Known limitation: It is a broad BOM model rather than a scientific metadata profile; generated inventories require verification, and license metadata does not authorize use of sensitive human data.

03 · Detailed assessment

Check the fit and evidence behind the map

Use the source, status, and limitation together. A higher maturity label does not erase a scope mismatch.

Detailed comparison of SPDX 3.0 System Bill of Materials
Assessment	SPDXSPDX 3.0 System Bill of Materials
Purpose & coverage	A system bill of materials spanning software, builds, AI models, datasets, identities, provenance, integrity, licenses, security findings, and relationships. Best fitReproducible and reviewable supply-chain records for an AI release that combines scientific data, preprocessing code, dependencies, models, and licenses.
Readiness stages	ExchangeLearn + reuse
AI-ready contribution	Makes the data-model-software supply chain inspectable by tools and agents, while scientific validity, consent, bias, and model performance need separate evidence.
First limitation to test	It is a broad BOM model rather than a scientific metadata profile; generated inventories require verification, and license metadata does not authorize use of sensitive human data.
Evidence	E1 + E3 Medium confidence Formal statusReleased specification 3.0.1; dataset and AI scope in v3 ReviewSource-checked · watch
Maturity	Scaling Established SPDX ecosystem; the 3.0 dataset and AI scope is newer
Sources & links	SPDX Specification 3.0.1 (opens in a new tab)Read full profile