How do SPDX 3.0.1 AI/Dataset profiles and CycloneDX 1.6/1.7 ML-BOM represent separate licences for code, weights and training data, field by field?

SPDX 3.0.1 defines hasDeclaredLicense as the licence an artifact was discovered to contain (for example by automated tooling), which differs from the conventional author-declared reading, and it attaches licences through relationships rather than a package property. CycloneDX 1.6 and 1.7 (schemas at 349314a9) distinguish license.acknowledgement 'declared' (the authors' initial intentions) from 'concluded' (verified and confirmed), with observed licences recorded in evidence.licenses. In CycloneDX, the componentData (dataset) object and the modelCard object have no licence property; licences attach to the parent component. So in both formats a dataset's or model's licence is attached to the component (CycloneDX) or by relationship (SPDX), not inside the data or model-card description, and 'declared' means different things in the two specifications. Specification text only; no SBOM was generated or validated. Curator qualifications: CycloneDX 1.6/1.7 ML-BOM field claims (componentData without licence key, acknowledgement enum) not reinspected. Whether the SPDX wording is an intended distinction is unresolved (producer). Specification text only; no SBOM generated or validated. Amendments applied: CA-AM-0094. Limitations: Specification text only; no SBOM generated or validated. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://github.com/spdx/spdx-3-model/tree/a745f63e8643d5ae0f0851fcfa6836085308f80b",
      "note": "RelationshipType.md line 52"
    },
    {
      "url": "https://github.com/CycloneDX/specification/tree/349314a9d7671d7d2ca5b711a725f49a73979da6/schema",
      "note": "RelationshipType.md line 52"
    }
  ]
}