How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Controlled Deployment & Rollback
Roll out with automatic rollback
Verify that production deployments implement rollout mechanisms with automated rollback triggers.
OWASP AISVS v1.01, requirement 3.3.1
In plain English
Roll out new models gradually and roll back automatically when monitoring shows something wrong.
What good looks like
- New models go to a small share of traffic first.
- Rollback triggers are defined for error rates, safety signals and the main business metrics.
- Rollback happens without waiting for a person.
How teams usually do it
- Canary or blue-green deployments in your serving platform.
- Alert rules wired to an automated rollback job.
Evidence an auditor would accept
- Rollout configuration and trigger definitions.
- Records of a past rollback or a rollback test.
Common mistakes
- Triggers based only on uptime, so a model that is up but misbehaving stays live.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.