Skip to main content
Flags models that are deprecated, nearing deprecation, or outdated by a newer version.

​
How to resolve

Deprecated or outdated models represent an ongoing risk that grows as vendor support diminishes. The following steps can help ensure your deployed models remain current and supported.
  • Track model lifecycle: Monitor vendor deprecation announcements and end-of-support dates for every model in use.
  • Upgrade to supported versions: Migrate to the vendor’s recommended replacement model, validating performance and safety before promoting to production.
  • Maintain an inventory: Keep a centralized registry of all deployed models with their version, vendor, and current support status.
  • Automate alerts: Set up notifications for upcoming deprecation milestones so teams have time to plan and execute migrations.

​
Risk

Governance/Compliance Using deprecated or outdated models undermines lifecycle management requirements across multiple frameworks:
  • NIST AI RMF (GOV-1, MAP-2): Requires organizations to maintain accountability over AI assets and map dependencies, including tracking model versions and their support status.
  • ISO/IEC 42001: Mandates lifecycle management processes that ensure AI systems remain current, documented, and auditable throughout their operational life.
  • EU AI Act (Art. 9, 15): Requires ongoing risk management and maintenance of high-risk AI systems, including keeping components up to date with vendor-supported versions.
  • OWASP Top 10 for LLM Applications (LLM3:2025): Requires vetting data sources and suppliers, perform vulnerability management and patching, maintain an up-to-date inventory of components, and have a policy to detect and update outdated components.
Security Deprecated models no longer receive security patches or vendor incident response, leaving known vulnerabilities unaddressed. Attackers can target publicly disclosed weaknesses in older model versions, exploiting unpatched flaws for data extraction, prompt injection, or model manipulation. Without vendor support, organizations bear the full burden of identifying and mitigating threats—often without access to the fixes or tooling that newer versions provide.

​
Explanation

AI models follow a lifecycle managed by their vendors. When a model is deprecated or reaches end-of-life, it no longer receives security patches, bug fixes, or alignment updates. Newer versions often address known vulnerabilities, biases, or safety issues discovered after the original release. Continuing to run deprecated or outdated models creates blind spots in governance and compliance, as organizations lose visibility into unpatched risks and can no longer rely on vendor support for incident response.

​
Specifications

Trigger: model version is deprecated, nearing deprecation, or superseded by a newer version Severity: MEDIUM (outdated), CRITICAL (going to be deprecated in the next 30 days or already deprecated), HIGH (going to be deprecated in more than 30 days or date unknown) Applies to: Models