How to meet it
OWASP AISVS v1.01
Supply Chain Security for Models · AI BOM & Supply Chain Monitoring
Fail builds with incomplete AI BOMs
Verify that AI BOM completeness checks fail the build if any component metadata is missing.
OWASP AISVS v1.01, requirement 6.2.3
In plain English
Make the build fail when a bill of materials is missing information, so incomplete records never reach production.
What good looks like
- Required fields are defined.
- The build checks them and fails if any are empty.
- Exceptions need approval.
How teams usually do it
- Schema validation of the bill of materials in the build pipeline.
Evidence an auditor would accept
- The required field list and a failed build example.
Common mistakes
- Checks that warn and carry on.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.