Defining assessment criteria for foundational or upstream AI models. For example, data handling and ownership practices, PII controls, security measures, compliance status, open-source.
Conducting documented assessments. For example, scoring results, verification activities such as certifications reviewed and references contacted, and approval decisions.
Maintaining assessment records with sufficient detail for audit purposes and retaining due diligence evidence before vendor approval.
Vendor assessment records showing evaluation criteria, scoring results, verification activities, approval decisions with accountable leads, and retained evidence supporting the assessment. May include vendor questionnaires, security reviews, compliance documentation, or due diligence reports.
Verifying the source, integrity and licence of the open-weight model before use. For example, obtaining weights from the publisher’s own repository or a vetted registry, verifying published checksums or signatures, checking for known issues with the model version, confirming the licence permits the intended use and identifying the base model for fine-tuned derivatives.
Assessment records showing the source, integrity and license checks performed on the open-weight model - may include a model intake checklist identifying publisher, repository or registry, model version and base model for fine-tuned derivatives, checksum or signature verification output, and licence and known-issue review notes.
Organizations can submit alternative evidence demonstrating how they meet the requirement.