# curie_map:
#   g7ai: "https://w3id.org/sbom/req/g7ai/"
#   sbom: "https://w3id.org/sbom/"
#   spdx3-core: "https://spdx.org/rdf/3/terms/Core/"
#   spdx3-sw: "https://spdx.org/rdf/3/terms/Software/"
#   spdx3-ai: "https://spdx.org/rdf/3/terms/AI/"
#   spdx3-ds: "https://spdx.org/rdf/3/terms/Dataset/"
#   spdx3-sec: "https://spdx.org/rdf/3/terms/Security/"
#   spdx3-hw: "https://spdx.org/rdf/3/terms/Hardware/"
#   skos: "http://www.w3.org/2004/02/skos/core#"
#   semapv: "https://w3id.org/semapv/vocab/"
# mapping_set_id: "https://w3id.org/sbom/mapping/g7ai-spdx3"
# mapping_set_version: "0.1.0"
# mapping_set_title: "G7 SBOM for AI minimum elements <-> SPDX 3.1-dev"
# mapping_set_description: "Maps the 50 minimum-element concepts defined in 'SBOM for Artificial Intelligence - Minimum Elements' (G7 Cybersecurity Working Group, 2026-05-12) to classes and properties in the SPDX 3.1-dev specification. The see_also column cites the neutral bridge concept from sbom.ttl that both the G7 source concept and the SPDX target field share."
# license: "https://creativecommons.org/licenses/by/4.0/"
# creator_id:
#   - "orcid:0000-0000-0000-0000"
# mapping_date: "2026-06-15"
# subject_source: "https://w3id.org/sbom/req/g7ai/"
# object_source: "https://spdx.github.io/spdx-spec/v3.1-dev/"
# see_also:
#   - "https://spdx.github.io/spdx-spec/v3.1-dev/model/AI/AI/"
#   - "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_minimum-elements.pdf?__blob=publicationFile&v=4"
#   - "https://w3id.org/sbom/"
subject_id	subject_label	predicate_id	object_id	object_label	mapping_justification	see_also	comment
g7ai:sbom-author	SBOM author	skos:exactMatch	spdx3-core:createdBy	createdBy	semapv:ManualMappingCuration	sbom:doc-author	CreationInfo.createdBy captures the agent(s) -- Person, Organization or Tool -- that authored the SBOM. Exact semantic match.
g7ai:sbom-version	SBOM version	skos:closeMatch	spdx3-core:version	version	semapv:ManualMappingCuration	sbom:doc-version	The Element.version property on the Sbom/SpdxDocument element carries the SBOM document version. Minor difference: version is a generic property, not SBOM-specific.
g7ai:sbom-data-format-name	SBOM data format name	skos:closeMatch	spdx3-core:specVersion	specVersion	semapv:ManualMappingCuration	sbom:doc-spec-version	The format name is implicit in the choice of SPDX serialisation; specVersion identifies the format family. No dedicated format-name field exists. Partial fit.
g7ai:sbom-data-format-version	SBOM data format version	skos:exactMatch	spdx3-core:specVersion	specVersion	semapv:ManualMappingCuration	sbom:doc-spec-version	CreationInfo.specVersion carries the explicit SPDX specification version (e.g. 3.1). Exact match for data-format version.
g7ai:sbom-author-signature	SBOM author signature	skos:narrowMatch	spdx3-core:verifiedUsing	verifiedUsing	semapv:ManualMappingCuration	sbom:doc-integrity	verifiedUsing + Hash supports cryptographic hash-based integrity but not native digital signatures (JWS/PGP). Detached signatures are attached externally. Partial/narrow fit; gap noted.
g7ai:sbom-tool-name	SBOM tool name	skos:exactMatch	spdx3-core:createdUsing	createdUsing	semapv:ManualMappingCuration	sbom:doc-tool	CreationInfo.createdUsing references Tool elements; the Tool.name property carries the tool name. Together these map exactly to SBOM tool name.
g7ai:sbom-tool-version	SBOM tool version	skos:closeMatch	spdx3-core:createdUsing	createdUsing	semapv:ManualMappingCuration	sbom:doc-tool	Tool version is carried by the Tool element (via Software.packageVersion) referenced by createdUsing. closeMatch because the version is one hop away via the Tool element.
g7ai:sbom-generation-context	SBOM generation context	skos:closeMatch	spdx3-sw:sbomType	sbomType	semapv:ManualMappingCuration	sbom:doc-lifecycle-stage	Software.Sbom.sbomType (SbomType vocabulary: build, analyzed, deployed, runtime, etc.) captures the lifecycle context in which the SBOM was generated. Close match. Note: G7/CISA2025 call this 'SBOM generation context'; FSCT3/SPDX call it 'SBOM type' -- same concept, bridge: sbom:doc-lifecycle-stage.
g7ai:sbom-timestamp	SBOM timestamp	skos:exactMatch	spdx3-core:created	created	semapv:ManualMappingCuration	sbom:doc-timestamp	CreationInfo.created is a mandatory xsd:dateTime; semantically equivalent to the SBOM creation timestamp.
g7ai:sbom-dependency-relationship	SBOM dependency relationship	skos:closeMatch	spdx3-core:Relationship	Relationship	semapv:ManualMappingCuration	sbom:doc-dependency-relationship	Dependency relationships between SBOM components are expressed via Relationship elements (DEPENDS_ON, CONTAINS, DESCRIBES, etc.). Close match at class level; the specific relationship type encodes the dependency kind.
g7ai:system-name	System name	skos:exactMatch	spdx3-core:name	name	semapv:ManualMappingCuration	sbom:component-name	Element.name on the root AIPackage element carries the AI system name. Exact match.
g7ai:system-components	System components	skos:closeMatch	spdx3-core:Relationship	Relationship	semapv:ManualMappingCuration	sbom:doc-primary-component	Constituent components are linked via Relationship elements (CONTAINS, HAS_PREREQUISITE) from the root AIPackage to child AIPackage or Package elements.
g7ai:system-producer	System producer	skos:closeMatch	spdx3-core:suppliedBy	suppliedBy	semapv:ManualMappingCuration	sbom:component-supplier	Artifact.suppliedBy (distributor/supplier) and Artifact.originatedBy (original author) together cover the 'system producer' concept. suppliedBy is the primary match.
g7ai:system-version	System version	skos:exactMatch	spdx3-sw:packageVersion	packageVersion	semapv:ManualMappingCuration	sbom:component-version	Software.Package.packageVersion carries the AI system release version. Exact match.
g7ai:system-timestamp	System timestamp	skos:closeMatch	spdx3-core:releaseTime	releaseTime	semapv:ManualMappingCuration	sbom:component-timestamp	Artifact.releaseTime (formal release) and Artifact.builtTime (build time) together cover the system timestamp concept. releaseTime is the primary match.
g7ai:system-data-flow	System data flow	skos:narrowMatch	spdx3-ai:informationAboutApplication	informationAboutApplication	semapv:ManualMappingCuration	sbom:ai-data-flow	No first-class data-flow graph field exists in SPDX 3.1-dev. informationAboutApplication (free text) is the closest home for a data-flow description. Narrow match; gap noted for future AI profile extension.
g7ai:system-data-usage	System data usage	skos:closeMatch	spdx3-ai:useSensitivePersonalInformation	useSensitivePersonalInformation	semapv:ManualMappingCuration	sbom:ai-data-usage	AIPackage.useSensitivePersonalInformation covers the sensitive-data usage aspect. informationAboutApplication covers broader data-usage description. Together they are a close match.
g7ai:system-input-output-properties	System input/output properties	skos:narrowMatch	spdx3-ai:informationAboutApplication	informationAboutApplication	semapv:ManualMappingCuration	sbom:ai-io-properties	No structured I/O schema field exists. informationAboutApplication and typeOfModel (modality) partially cover this. Narrow match; gap identified.
g7ai:system-intended-application-area	Intended application area	skos:exactMatch	spdx3-ai:domain	domain	semapv:ManualMappingCuration	sbom:ai-application-domain	AIPackage.domain (list of strings) enumerates the application domains. Exact match.
g7ai:model-name	Model name	skos:exactMatch	spdx3-core:name	name	semapv:ManualMappingCuration	sbom:component-name	Element.name on an AIPackage element carries the model name. Exact match.
g7ai:model-identifier	Model identifier	skos:exactMatch	spdx3-sw:packageUrl	packageUrl	semapv:ManualMappingCuration	sbom:component-identifier	Software.Package.packageUrl carries the PURL (Package URL) -- the preferred stable external identifier for AI models (e.g. pkg:huggingface/org/model@sha256). Exact match for the external-identifier aspect of model-identifier.
g7ai:model-identifier	Model identifier	skos:closeMatch	spdx3-core:spdxId	spdxId	semapv:ManualMappingCuration	sbom:component-identifier	Element.spdxId provides a stable internal SPDX identifier within the SBOM document. closeMatch -- covers the internal-identifier aspect; external identifiers (PURL, DOI) are carried separately.
g7ai:model-version	Model version	skos:exactMatch	spdx3-sw:packageVersion	packageVersion	semapv:ManualMappingCuration	sbom:component-version	Package.packageVersion carries the model weight/release version. Exact match.
g7ai:model-timestamp	Model timestamp	skos:closeMatch	spdx3-core:builtTime	builtTime	semapv:ManualMappingCuration	sbom:component-timestamp	Artifact.builtTime (training/build time) and Artifact.releaseTime (release time) together cover the model timestamp concept. builtTime is the primary match for model training date.
g7ai:model-producer	Model producer	skos:closeMatch	spdx3-core:suppliedBy	suppliedBy	semapv:ManualMappingCuration	sbom:component-supplier	Same supplier/originator pattern as for the AI system. suppliedBy is primary; originatedBy covers the original trainer.
g7ai:model-description	Model description	skos:exactMatch	spdx3-core:description	description	semapv:ManualMappingCuration	sbom:component-description	Element.description provides a free-text model description. Exact match.
g7ai:model-hash-value	Model hash value	skos:exactMatch	spdx3-core:hashValue	hashValue	semapv:ManualMappingCuration	sbom:component-hash	Hash.hashValue (inside verifiedUsing) carries the actual digest bytes. Exact match.
g7ai:model-hash-algorithm	Model hash algorithm	skos:exactMatch	spdx3-core:algorithm	algorithm	semapv:ManualMappingCuration	sbom:component-hash	Hash.algorithm (HashAlgorithm vocabulary: sha256, sha512, blake3, etc.) identifies the digest algorithm. Exact match.
g7ai:model-properties	Model properties	skos:broadMatch	spdx3-ai:AIPackage	AIPackage	semapv:ManualMappingCuration	sbom:ai-model-properties	'Model properties' is a basket concept covered by multiple AIPackage properties: typeOfModel, modelExplainability, autonomyType, energyConsumption, safetyRiskAssessment, limitation. Broad match at class level.
g7ai:model-input-output-properties	Model input/output properties	skos:narrowMatch	spdx3-ai:informationAboutApplication	informationAboutApplication	semapv:ManualMappingCuration	sbom:ai-io-properties	No structured I/O schema field. informationAboutApplication (free text) and typeOfModel (modality) partially cover this. Narrow match; same gap as system-level I/O.
g7ai:model-training-properties	Model training properties	skos:closeMatch	spdx3-ai:informationAboutTraining	informationAboutTraining	semapv:ManualMappingCuration	sbom:ai-training-properties	informationAboutTraining, hyperparameter, modelDataPreprocessing and finetuningEnergyConsumption together cover training properties well. closeMatch because no single field encompasses all; hyperparameter is also a primary match.
g7ai:model-license	Model license	skos:closeMatch	spdx3-core:Relationship	Relationship	semapv:ManualMappingCuration	sbom:component-license	In SPDX 3.x licensing is expressed via Relationship elements with hasDeclaredLicense / hasConcludedLicense relationship types linking to AnyLicenseInfo elements. closeMatch at class level.
g7ai:model-external-references	Model external references	skos:closeMatch	spdx3-core:externalRef	externalRef	semapv:ManualMappingCuration	sbom:component-external-reference	Element.externalRef (typed locator to model cards, papers, repos) and Element.externalIdentifier (structured IDs) together cover external references. externalRef is the primary match.
g7ai:dataset-name	Dataset name	skos:exactMatch	spdx3-core:name	name	semapv:ManualMappingCuration	sbom:component-name	Element.name on DatasetPackage carries the dataset name. Exact match.
g7ai:dataset-description	Dataset description	skos:exactMatch	spdx3-core:description	description	semapv:ManualMappingCuration	sbom:component-description	Element.description provides a free-text dataset description. Exact match.
g7ai:dataset-content	Dataset content	skos:closeMatch	spdx3-ds:datasetType	datasetType	semapv:ManualMappingCuration	sbom:dataset-type	DatasetPackage.datasetType (DatasetType vocabulary: image, text, audio, structured, etc.) covers content modality. datasetSize and sensor add further content characterisation. closeMatch.
g7ai:dataset-identifier	Dataset identifier	skos:closeMatch	spdx3-sw:packageUrl	packageUrl	semapv:ManualMappingCuration	sbom:component-identifier	packageUrl (PURL) for datasets; e.g. pkg:huggingface/... or a DOI-based PURL. closeMatch because not all dataset identifiers have a standardised PURL scheme yet.
g7ai:dataset-identifier	Dataset identifier	skos:closeMatch	spdx3-core:spdxId	spdxId	semapv:ManualMappingCuration	sbom:component-identifier	Element.spdxId for internal SPDX identifier; ExternalIdentifier elements carry DOI, dataset-registry URLs and other external IDs.
g7ai:dataset-hash	Dataset hash	skos:exactMatch	spdx3-core:verifiedUsing	verifiedUsing	semapv:ManualMappingCuration	sbom:component-hash	Artifact.verifiedUsing + Hash (algorithm + hashValue) covers dataset archive integrity. Exact match.
g7ai:dataset-provenance	Dataset provenance	skos:closeMatch	spdx3-ds:dataCollectionProcess	dataCollectionProcess	semapv:ManualMappingCuration	sbom:dataset-provenance	DatasetPackage.dataCollectionProcess (how), datasetUpdateMechanism (update cadence), suppliedBy (who) and originatedBy together form a strong provenance cluster. dataCollectionProcess is the primary match.
g7ai:dataset-statistical-properties	Dataset statistical properties	skos:closeMatch	spdx3-ds:datasetSize	datasetSize	semapv:ManualMappingCuration	sbom:dataset-statistical-properties	Statistical properties map to a basket: datasetSize, datasetNoise, knownBias, dataPreprocessing. datasetSize is the most concrete; no single field covers all. closeMatch at the cluster level.
g7ai:dataset-sensitivity	Dataset sensitivity	skos:closeMatch	spdx3-ds:hasSensitivePersonalInformation	hasSensitivePersonalInformation	semapv:ManualMappingCuration	sbom:dataset-sensitivity	DatasetPackage.hasSensitivePersonalInformation (boolean), confidentialityLevel and anonymizationMethodUsed together form a strong sensitivity cluster. hasSensitivePersonalInformation is the primary match.
g7ai:dataset-dependency-relationship	Dataset dependency relationship	skos:closeMatch	spdx3-core:Relationship	Relationship	semapv:ManualMappingCuration	sbom:component-relationship	Links from a model AIPackage to its DatasetPackages are expressed via Relationship elements with TRAINED_ON / TESTED_ON / HAS_PREREQUISITE types.
g7ai:dataset-license	Dataset license	skos:closeMatch	spdx3-core:Relationship	Relationship	semapv:ManualMappingCuration	sbom:component-license	Dataset licensing uses hasDeclaredLicense / hasConcludedLicense Relationship elements, same pattern as model licensing. DatasetPackage.datasetAvailability adds access-level detail.
g7ai:infrastructure-software	Infrastructure software	skos:closeMatch	spdx3-sw:Package	Package	semapv:ManualMappingCuration	sbom:infra-software	Container images, ML frameworks (PyTorch, CUDA), OS layers and runtime libraries are modelled as Software.Package elements with RUNTIME_DEPENDENCY_OF / BUILD_DEPENDENCY_OF relationships to the AIPackage.
g7ai:infrastructure-hardware	Infrastructure hardware	skos:exactMatch	spdx3-hw:Hardware	Hardware	semapv:ManualMappingCuration	sbom:infra-hardware	SPDX 3.1-dev introduces a Hardware profile (new vs 3.0.1). The Hardware.Hardware class covers specialised AI accelerators (GPUs, TPUs, NPUs). This closes the gap that existed in SPDX 3.0.1. Exact match.
g7ai:security-controls	Security controls	skos:narrowMatch	spdx3-core:externalRef	externalRef	semapv:ManualMappingCuration	sbom:security-controls	No first-class security-controls field in SPDX 3.1-dev. ExternalRef (type securityPolicy / other) links to external control-framework documents (NIST SP 800-53, ISO 27001). Narrow match; gap noted.
g7ai:security-compliance	Security compliance	skos:exactMatch	spdx3-ai:standardCompliance	standardCompliance	semapv:ManualMappingCuration	sbom:security-compliance	AIPackage.standardCompliance (list of strings) records conformance to standards and regulations (EU AI Act, ISO/IEC 42001, NIST AI RMF, etc.). Exact semantic match.
g7ai:cybersecurity-policy	Cybersecurity policy information	skos:narrowMatch	spdx3-core:externalRef	externalRef	semapv:ManualMappingCuration	sbom:security-policy	No first-class policy-information property. ExternalRef (type securityPolicy) links to a vulnerability-disclosure policy or security.txt file. Narrow match; gap noted.
g7ai:vulnerability-referencing	Vulnerability referencing	skos:exactMatch	spdx3-sec:Vulnerability	Vulnerability	semapv:ManualMappingCuration	sbom:vulnerability-reference	SPDX 3.1-dev Security profile: Vulnerability element + VEX assessment relationships (VexAffectedVulnAssessmentRelationship, VexFixedVulnAssessmentRelationship, etc.) provide native CVE referencing and VEX status. Exact match.
g7ai:security-metrics	Security metrics	skos:closeMatch	spdx3-ai:metric	metric	semapv:ManualMappingCuration	sbom:performance-metric	AIPackage.metric (key/value dictionary) and metricDecisionThreshold carry model-evaluation security metrics. CVSS scores live in the Security profile CvssVulnAssessmentRelationship. closeMatch because the concept spans two profiles.
g7ai:operational-performance-kpis	Operational performance KPIs	skos:closeMatch	spdx3-ai:metric	metric	semapv:ManualMappingCuration	sbom:performance-metric	AIPackage.metric and metricDecisionThreshold cover accuracy, F1, latency, throughput metrics. energyConsumption covers energy KPIs. closeMatch because no single field covers all operational KPI types.