How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Model Validation & Testing
Re-check security when the provider changes the model
Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.
OWASP AISVS v1.01, requirement 3.2.3
In plain English
When your provider changes the model, its version or how requests are routed, run your security tests again before carrying on as normal.
What good looks like
- You pin model versions where the provider allows it.
- Provider change notices reach someone who acts on them.
- Security tests rerun after each change, with results reviewed.
How teams usually do it
- Pinning dated model versions in API calls and upgrading on purpose.
- Scheduled test runs that also catch silent changes.
Evidence an auditor would accept
- Configuration showing pinned versions.
- Test results linked to each model change.
Common mistakes
- Using a model alias that moves to new versions without notice.
- Rerunning task-quality tests but not the security ones.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.