Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · AI BOM & Supply Chain Monitoring
Sign the AI bill of materials
Verify that AI BOMs are cryptographically signed before deployment.
OWASP AISVS v1.01, requirement 6.2.2
In plain English
Sign each AI bill of materials before deployment, so nobody can alter it afterwards without the change showing. An unsigned BOM can be edited to hide a component, which defeats its purpose.
What good looks like
- The build pipeline signs every BOM.
- The signature is verified before deployment, and a failure blocks the release.
- The signature ties the BOM to the specific model artifact it describes.
- Signing keys are held by the pipeline, under the same controls as model signing keys.
How teams usually do it
- Sign the BOM with the same tooling used for model artifacts, for example Sigstore cosign.
- Attach the BOM to the model as a signed attestation (in-toto format), so the two travel together in the registry.
- Verify both signatures in the same admission step.
Suggested evidence
- Signed BOMs for deployed models.
- Verification logs from deployment.
- Key access policy.
Common mistakes
- Signing the model and leaving the BOM unsigned beside it.
- Signing a BOM that does not reference the model's hash, so it could describe anything.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.