How to meet it
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Training Data & Model Lifecycle Audit
Keep immutable records of model changes
Verify that all model changes generate immutable audit records.
OWASP AISVS v1.01, requirement 12.5.3
In plain English
Every change to a model, its configuration or prompts creates an audit record that cannot be altered.
What good looks like
- All model changes produce records.
- Records are stored in append-only or write-once storage.
- Records link to approvals.
How teams usually do it
- Deployment pipeline events written to immutable storage.
Evidence an auditor would accept
- Records for recent changes and the storage settings.
Common mistakes
- Changes made directly in a console, outside the pipeline, which leave no record.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.