Should we document AI models with model cards or SBOMs?
Answered
Yes. Document creation, operation and life-cycle management of models, datasets and system prompts, including training-data sources, scope, limitations, guardrails, hashes/signatures, retention, review frequency and failure modes. Model cards, data cards and SBOMs are useful structures.
From the guidance
Primary (how) NCSC: Secure development (AI systems)
Useful structures to help do this include model cards, data cards and software bills of materials (SBOMs). The production of comprehensive documentation supports transparency and accountability.
Section: Document your data, models and prompts
Read this in NCSC: Secure development (AI systems) (opens in new tab)
Related questions
- What AI assets should I document and inventory?
- How should I decommission AI models and training data?
- How should I threat-model an AI system? Security and safe use of tools
- How should I secure the AI supply chain (models and components)?
- What happens if the model drifts or starts performing worse over time?