How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI Tool Qualification & Threat Modeling
Evaluate each tool end to end
Verify that the evaluation of each tool covers the local components (static and dynamic analysis), the SaaS endpoints (TLS, AuthN/AuthZ, logging, data residency), and the vendor's model supply chain (training-data provenance, fine-tune history, RAG sources). Each of these is reviewed and the review is written down.
OWASP AISVS v1.01, requirement AC.2.2
In plain English
Evaluate each tool end to end: what runs locally, the vendor's service and the vendor's model supply chain.
What good looks like
- Local components are analysed.
- SaaS endpoints are checked for encryption, authentication, logging and data residency.
- Vendor model provenance is reviewed and written up.
How teams usually do it
- Vendor security questionnaires plus your own testing of local components.
Evidence an auditor would accept
- Evaluation records per tool.
Common mistakes
- Relying entirely on a vendor's marketing security page.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.