How to meet it
OWASP AISVS v1.01
Supply Chain Security for Models · Model Artifact Integrity
Acceptance-test models before promotion
Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.
OWASP AISVS v1.01, requirement 6.1.4
In plain English
Before a model leaves development, run behaviour tests on it. A scan of the file cannot show backdoors or unwanted behaviour that only appears when the model runs.
What good looks like
- A behavioural test suite runs before promotion to any shared environment.
- Tests include known trigger phrases and safety cases.
- Failures block promotion.
How teams usually do it
- The same evaluation suite as 3.2.1, run on third-party models as part of import.
Evidence an auditor would accept
- Test results attached to the promotion record.
Common mistakes
- Promoting third-party models to staging without testing because "staging is not production".
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.