How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Model Authorization & Integrity
Keep a register of deployed models
Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.
OWASP AISVS v1.01, requirement 3.1.1
In plain English
Keep one register of every model artifact running anywhere, with where it came from, so you can answer "what is deployed and where did it come from" in minutes.
What good looks like
- Every deployed model, adapter and safety model is in the register.
- Entries record origin, version, owner and where it is deployed.
- Deployments are blocked for models not in the register.
How teams usually do it
- A model registry such as MLflow or your cloud provider's equivalent.
- A deployment check that looks up the model in the registry first.
Evidence an auditor would accept
- The registry, with current deployments listed.
- Deployment pipeline configuration showing the registry check.
Common mistakes
- Forgetting adapters, embedding models and guardrail models.
- A registry that records training runs but not what is actually in production.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.