How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Model Validation & Testing
Test the model before each deployment
Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.
OWASP AISVS v1.01, requirement 3.2.1
In plain English
Before any model goes live, run automated tests for how it handles bad input, whether it stays safe and whether its output is properly cleaned.
What good looks like
- A standard test suite runs on every model before deployment.
- The suite covers malformed and malicious input, safety behaviour and output handling.
- Failing results block the deployment.
How teams usually do it
- An evaluation step in the deployment pipeline with pass thresholds.
- Shared test sets maintained by the team, extended after each incident.
Evidence an auditor would accept
- The test suite and its pass criteria.
- Results for the currently deployed model.
Common mistakes
- Testing only accuracy on the task, with no safety or abuse tests.
- Running tests by hand when someone remembers.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.