> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Missing model metadata

> Models are missing metadata fields such as name, library, supplier, or manufacturer.

Models are missing metadata fields such as name, library, supplier, or manufacturer.

## How to resolve

AI-SPM discovers AI assets via automated static code analysis and generates a comprehensive Software Bill of Materials (AI-SBOM). This issue occurs when required metadata, such as name, library, supplier, or manufacturer cannot be extracted or validated.

* **Manage access permissions**: Verify the scanner has read access to all relevant repositories, submodules, dependency files, and private registries. Confirm IAM roles, tokens, and storage permissions grant the required access.
* **Verify required metadata**: Ensure models are explicitly declared with a clear name, library, supplier, and a pinned, immutable version where possible (avoid floating tags such as `latest` or unversioned references). Also, review the repository for unsupported file formats or corrupted artifacts that may block metadata extraction.

## Risk

**Governance/Compliance**

Missing model metadata violates foundational requirements across multiple AI governance standards:

* NIST AI RMF (GOV-1, GOV-3): requires clear documentation of provenance, ownership, and model lineage to ensure accountability and transparency.
* ISO/IEC 42001 (AI Management System): mandates complete and accurate technical documentation for all AI assets.
* ISO/IEC 23894 (Risk Management): calls for reliable metadata to assess model sources, risks, and lifecycle controls.
* EU AI Act (Technical Documentation Articles 9–13): requires detailed model information—including origin, supplier, and technical characteristics—as part of mandatory documentation.

Across these standards, the expectation is consistent: models must include complete metadata to establish provenance, trace responsibility, and support regulatory audits and lifecycle management.

**Security**

Incomplete metadata increases the likelihood of **model tampering**, **unauthorized model substitution**, or **supply-chain attacks**, because the model cannot be reliably tied to a known origin, build process, or maintainer. Missing fields also slow down **incident response** and **root-cause analysis**, making it harder to verify whether the model is legitimate, up-to-date, patched, or sourced from a trusted provider.

## Explanation

Model metadata encodes **provenance**, **ownership**, and **accountability**. Fields like name, library, supplier, and manufacturer establish traceability across the model’s lifecycle. Missing metadata can lead to ambiguity in:

* who created or maintains the model
* what library it depends on
* whether the model or agent originates from a trusted source
* who is responsible for updates, patches, and incident response

This reduces explainability, weakens governance controls, and complicates the ability to detect or investigate supply-chain risks. High-quality metadata is foundational to model cards, system cards, and technical documentation as described by OpenAI, Anthropic, and EU AI Act requirements.

## Specifications

**Trigger**

The model is missing any of the following:

* name is empty
* library is empty and model is non-Managed
* supplier is empty
* manufacturer is empty

**Severity**

* **LOW** — Missing name
* **MEDIUM** - Missing library (for non-Managed models)
* **HIGH** — Missing supplier/manufacturer

**Applies to**: Models