Skip to main content
Models are missing metadata fields such as name, library, supplier, or manufacturer.

​
How to resolve

AI-SPM discovers AI assets via automated static code analysis and generates a comprehensive Software Bill of Materials (AI-SBOM). This issue occurs when required metadata, such as name, library, supplier, or manufacturer cannot be extracted or validated.
  • Manage access permissions: Verify the scanner has read access to all relevant repositories, submodules, dependency files, and private registries. Confirm IAM roles, tokens, and storage permissions grant the required access.
  • Verify required metadata: Ensure models are explicitly declared with a clear name, library, supplier, and a pinned, immutable version where possible (avoid floating tags such as latest or unversioned references). Also, review the repository for unsupported file formats or corrupted artifacts that may block metadata extraction.

​
Risk

Governance/Compliance Missing model metadata violates foundational requirements across multiple AI governance standards:
  • NIST AI RMF (GOV-1, GOV-3): requires clear documentation of provenance, ownership, and model lineage to ensure accountability and transparency.
  • ISO/IEC 42001 (AI Management System): mandates complete and accurate technical documentation for all AI assets.
  • ISO/IEC 23894 (Risk Management): calls for reliable metadata to assess model sources, risks, and lifecycle controls.
  • EU AI Act (Technical Documentation Articles 9–13): requires detailed model information—including origin, supplier, and technical characteristics—as part of mandatory documentation.
Across these standards, the expectation is consistent: models must include complete metadata to establish provenance, trace responsibility, and support regulatory audits and lifecycle management. Security Incomplete metadata increases the likelihood of model tampering, unauthorized model substitution, or supply-chain attacks, because the model cannot be reliably tied to a known origin, build process, or maintainer. Missing fields also slow down incident response and root-cause analysis, making it harder to verify whether the model is legitimate, up-to-date, patched, or sourced from a trusted provider.

​
Explanation

Model metadata encodes provenance, ownership, and accountability. Fields like name, library, supplier, and manufacturer establish traceability across the model’s lifecycle. Missing metadata can lead to ambiguity in:
  • who created or maintains the model
  • what library it depends on
  • whether the model or agent originates from a trusted source
  • who is responsible for updates, patches, and incident response
This reduces explainability, weakens governance controls, and complicates the ability to detect or investigate supply-chain risks. High-quality metadata is foundational to model cards, system cards, and technical documentation as described by OpenAI, Anthropic, and EU AI Act requirements.

​
Specifications

Trigger The model is missing any of the following:
  • name is empty
  • library is empty and model is non-Managed
  • supplier is empty
  • manufacturer is empty
Severity
  • LOW — Missing name
  • MEDIUM - Missing library (for non-Managed models)
  • HIGH — Missing supplier/manufacturer
Applies to: Models