{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c9694f49-3fc6-59e9-a537-cecae3f7a44d",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/xiaomi/aibom/component",
      "name": "Xiaomi: Xiaomi MiMo API Open Platform, under its privacy policy for use in China",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Some services use third-party service providers that get some personal information; none named here"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "No fixed period: kept as long as its purposes need or law requires, with exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Personal information is stored in China, for use of the service within China"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "Xiaomi signs data processing agreements with its third-party providers; no customer DPA stated"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "No for the text content a user gives, unless the user gives prior consent"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Per-account RPM and TPM limits for each model, e.g. 100 RPM and 10M TPM for mimo-v2.6-pro"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:1383019f859a7f1832aea97697484983f99456e76e0f99ab3c0a3f9c185a14e1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:zero_data_retention",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Some of our services are provided by third-party service providers. To this end, we need to provide some of your personal information to these third-party service providers."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "We retain your personal information for the period necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, or as required by applicable laws and regulations."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "This agreement applies to your use of Xiaomi MiMo services within the territory of the People's Republic of China. Accordingly, your personal information will be stored within the territory of the People's Republic of China."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "We also enter into strict data processing agreements with them, requiring these third parties to adopt adequate protective measures for your information and to strictly comply with applicable laws, regulations, and regulatory requirements."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "Without your prior consent, Xiaomi will not use the text content provided by you for model training or any other purposes."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "RPM (Requests Per Minute) : The maximum number of requests initiated per minute. The calculation scope is the sum of the total number of requests from all API Keys under a single account when calling the same model."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://mimo.mi.com/docs/en-US/api/guidance/rate-limit"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "xiaomi"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/xiaomi/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}