The Model Has a Supply Chain Too: Securing AI Models Before They Reach Production

The article argues that AI models, like software, have a complex supply chain that includes weights, configs, tokenizers, custom code, and dependencies. Downloading models directly into production bypasses security, legal, and quality checks. It advocates for a governed release process involving source verification, license compliance, hash recording, vulnerability scanning, runtime compatibility, and audit trails. The minimum release identity combines container digest, model artifact digest, and runtime config. It references NIST frameworks and suggests using registries like NGC or Harbor, but stresses enterprise approval is essential.