Formats

Two formats meet the Regulation’s requirement. Both are legitimate, standardised and widely tooled; they do not share the same history or the same strengths.

Comparison

	CycloneDX	SPDX
Origin	OWASP	Linux Foundation
Standardisation	ECMA-424	ISO/IEC 5962 (for SPDX 2.2.1)
Original orientation	Security	Licence compliance
Serialisations	JSON, XML, Protobuf	Tag-value, JSON, YAML, RDF/XML, spreadsheet
Vulnerabilities in the document	Native (vulnerabilities)	Via the security profile (SPDX 3.x)
VEX	Native	Through external mechanisms or a profile
Licence depth	Good	The reference of the field (SPDX list and expressions)
Extensions	SaaSBOM, HBOM, ML-BOM, CBOM, OBOM	SPDX 3 profiles: security, build, AI, dataset, licensing
Adoption	Strong in security tooling and CI/CD	Strong in legal compliance and distributions

What they share

Both formats express the same basic notions: components, versions, identifiers, hashes, licences, dependency relationships, creation metadata. Conversion tools exist both ways.

What really separates them

CycloneDX was designed by a security community, to feed automated processing chains. It natively carries vulnerabilities and exploitability assertions, which makes it the natural working format for a steering platform.

SPDX was designed by a legal compliance community, around the question “which licences are in this software, and what do they require?”. Its licence list and licence expressions are the global reference, reused by CycloneDX itself.

Conversion and its losses

Conversion is not neutral. Typical losses:

• format-specific extensions have no equivalent in the other;
• relationships are expressed differently and may flatten;
• CycloneDX VEX assertions have no natural destination in SPDX 2.x;
• build metadata may disappear.

Every conversion must therefore be documented: tool used, version, known losses.

The choice adopted

Pivot format: CycloneDX, in a recent version, produced by the build chain and consumed by the steering platform. It is the format that natively carries VEX, and therefore the one that lets you document decisions not to fix.

SPDX export on demand, for legal uses and for customers who require it contractually.

That choice must be frozen and documented, with minimum accepted versions, and applied uniformly: two teams producing two different formats make the portfolio incomparable.