What does license acknowledgement mean in a CycloneDX component?

In CycloneDX 1.6, a license object can carry an acknowledgement with one of two values: declared or concluded. Declared means the license the producer states. Concluded means the license the SBOM author determined after looking. Setting it tells readers how much weight to give each license entry.

Where the field sits

The 1.6 JSON reference describes a component's licenses as either a list of license objects or a single SPDX license expression. Each license object holds an id from the SPDX list or a free text name, plus optional fields including acknowledgement, text, url and licensing details. The acknowledgement values are declared and concluded.

"licenses": [
  { "license": { "id": "Apache-2.0", "acknowledgement": "declared" } },
  { "license": { "id": "MIT", "acknowledgement": "concluded" } }
]

The same idea in SPDX

SPDX 2.3 separates the two into different fields. The declared license field holds what the package states about itself. The concluded license field holds what the SBOM creator decided governs the package, and the spec says that if it differs from the declared license, a written explanation should be provided in the comments on license field.

For concluded, the spec allows a license expression, NONE, or NOASSERTION, and says an absent concluded license implies NOASSERTION.

Mapping

When they differ

Typical cases include a package whose metadata names one license while its files carry another, a dual licensed package where you chose one option, or a package with missing metadata where you read the license file. In each case, record both values, mark which is which, and add the reason. A reader who sees only a concluded value cannot tell whether it came from the producer or from you.

Rules of thumb

1. Prefer declared when the producer's metadata is clear and matches the files.
2. Add concluded only when you reviewed and reached a different or more specific answer.
3. Never mark something concluded because a tool guessed. Concluded implies a human or a documented process made a decision.
4. Use a license expression for dual licensing, not two separate entries pretending to be an AND.
5. Record a reason in plain words.

Note on authority

This field records information. It does not settle a legal question. If a license choice affects your product or a deal, ask counsel. The SBOM just makes the question visible.

A review step

Pick the five components with the most restrictive declared licenses in your product. Confirm each has a declared entry, and wherever a concluded entry exists, a reason you could explain to a colleague.

Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.

Quick check

Sources

• CycloneDX 1.6 JSON reference
• SPDX 2.3.1, Clause 7: Package information

Last reviewed: 19 October 2026.