The declared license is what the package's own authors say, for example in a COPYING file inside the package. The concluded license is the SBOM creator's judgment of what governs the package. They usually match, and when they do not, SPDX asks the creator to explain why.
Declared license
Per SPDX 2.3.1, the declared license is the license the authors of the package state. It should exclude license information from outside sources, such as a third party repository page. The spec describes the information as coming from the package authors, nothing else.
If the package contains no license information, the value is NONE. If the creator could not determine it, the value is NOASSERTION.
Concluded license
The concluded license is what the creator determines governs the package. The creator bases it on the package's own license information, other objective evidence, and scanning results. It is a conclusion, so it is the creator's responsibility.
Why they differ
Common reasons, in plain terms:
- The package metadata declares one license and the files contain another.
- A project offers a choice of licenses and you have chosen one.
- The package declares a license by name but the license text is missing.
- A scanner found extra license text in some files.
When the two values differ, the spec says the creator should explain why in the comments on license field. Do that. A reviewer who sees two different values and no reason will distrust both.
What the 2026 minimum elements add
The 2026 CISA minimum elements add component license as a data field. That means a license value is expected for each component, not optional decoration. A sensible approach is to record the declared license from the package, and add your concluded license only where you did real analysis.
A practical workflow
- Take the declared license from the package metadata and the license file.
- Run a license scan across the files and note any differences.
- If they agree, put the same value in both fields.
- If they disagree, decide, record the concluded value, and write a short comment.
- If you cannot decide, use NOASSERTION and flag it for legal review.
This is not legal advice. Your legal team owns what a license permits.
Quick check
Can the concluded license be blank?
The spec treats a missing concluded license as equivalent to NOASSERTION. Better to state it explicitly.
Who writes the declared license?
The package authors do. The SBOM creator only records it.
Sources
Last reviewed: 19 October 2026.
