In SPDX 2.3, the declared license is what the package authors state, the concluded license is what the SBOM creator determined governs the package, and license information from files lists what was detected in source files. They can differ, and when they do the spec asks for an explanation in a comment.
The three fields
From the SPDX 2.3.1 package information section:
- Declared License (7.15). The licenses declared by the package authors, such as in a COPYING file within the package. Third party sources like an external repository listing do not belong here.
- Concluded License (7.13). The license the SBOM creator has determined governs the package, or an alternative value if that cannot be determined.
- License Information from Files (7.14). Every license detected in the package's files. It does not say how those licenses relate, whether combined or alternative.
All three accept an SPDX license expression, NONE or NOASSERTION. If concluded is absent, it implies NOASSERTION.
Why the three can disagree
A package may declare MIT while one vendored directory carries a GPL header. Declared says MIT, files detected lists both, and the concluded license is the creator's judgement after looking. The spec says that when concluded differs from declared, the difference should be explained in Comments on License (7.16).
Reviewers should look at all three. If you read only the declared field, you will miss the vendored file. If you read only concluded, you rely on whoever made the SBOM.
Which to trust
- For a quick inventory screen, declared is a reasonable first filter.
- For a go or no-go on a copyleft finding, read files detected and the comment.
- For a document you pass to a customer, make sure the concluded field was set on purpose, with a comment where it differs.
Tools often fill the declared field automatically from package metadata and leave concluded as NOASSERTION. That is legitimate, but it means no one has made a determination. Treat it as an open question.
A review routine
- Filter for packages where declared and files detected differ.
- Read the comment field on each.
- Decide a concluded license for the ones you ship, and record who decided.
- Keep the reasoning with the SBOM version.
CycloneDX handles the same idea with an acknowledgement value on the license of declared or concluded. See the CycloneDX license forms.
Safeguard produces SBOMs and runs dependency scanning, so the list is generated for you. Try the free scan. The concluded decision stays a human one.
Quick check
What does an absent concluded license imply?
Per the SPDX 2.3.1 text, NOASSERTION.
Where does a note about a difference belong?
In Comments on License (7.16), according to the spec text for the concluded field.
Sources
Last reviewed: 19 October 2026.
