How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI Tool Qualification & Threat Modeling
Use a recognised evaluation framework
Verify that evaluations follow a recognized framework such as NIST AI RMF, NIST AI 600-1 Generative AI Profile, or ISO/IEC 42001. Evaluations are repeated after a major version change, a vendor incident, or new threat intelligence relevant to the tool class.
OWASP AISVS v1.01, requirement AC.2.4
In plain English
Base tool evaluations on a recognised framework, such as the NIST AI RMF or ISO/IEC 42001, and repeat them after major versions, vendor incidents or new threat information.
What good looks like
- Evaluations follow a named framework.
- Re-evaluation triggers are defined.
- Records show when evaluations were repeated.
How teams usually do it
- Mapping your evaluation template to the chosen framework's sections.
Evidence an auditor would accept
- Evaluation records with dates and triggers.
Common mistakes
- Citing a framework without following its steps.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.