{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/mistral/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Mistral AI: Mistral Studio and Vibe",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/mistral/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Mistral AI: Mistral Studio and Vibe"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = Published online; Mistral does not sign it offline. Evidence snapshot sha256:c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default. Evidence snapshot sha256:d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/trains_on_free_use",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use = Yes by default on Vibe, with an opt-out. Evidence snapshot sha256:d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Rate limits per model, set by the plan and shown in the Admin Panel, not on the page; spending limits by organization and workspace. Evidence snapshot sha256:4f6f0eeb88959160fbfc9f5b822009fd0bb400e6d9eaa82e473a46e58a95b6f6; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero Data Retention, pay-as-you-go stateless API calls, on approved request. Evidence snapshot sha256:c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors is recorded with no value (fact mistral/ai_subprocessors@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications is recorded with no value (fact mistral/certifications@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period is recorded with no value (fact mistral/customer_data_retention_period@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency is recorded with no value (fact mistral/data_residency@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Mistral AI's own words: \"Our Data Processing Agreement (DPA) is available in our Data Processing Addendum and is regularly updated to reflect our processing, services, security measures, and applicable regulations. We cannot sign the DPA offline.\" Source: https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in Mistral AI's own words: \"Customers retain full control over this processing and have the right to opt out at any time.\" Source: https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/trains_on_free_use/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use, in Mistral AI's own words: \"Input and output data are used by default to train our artificial intelligence models, unless you opt out of training at any time.\" Source: https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in Mistral AI's own words: \"API rate limits define how much traffic your Organization can send. They are shown in Admin Panel›API›Limits ↗.\" Source: https://docs.mistral.ai/admin/billing-usage/usage-limits"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in Mistral AI's own words: \"Zero Data Retention (ZDR) is available only with pay-as-you-go and only for stateless API calls.\" Source: https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/mistral/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/mistral/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}