Webinar Description
Key Takeaways
- Addresses governance gaps when open source AI models enter production software without adequate tracking or compliance controls.
- Covers vulnerability correlation, license obligations and provenance risks specific to AI models sourced from repositories like Hugging Face.
- Explains how to include AI models in Software Bill of Materials outputs using CycloneDX and SPDX standards.
- Designed for security engineers, DevSecOps professionals and compliance officers in technology, finance, healthcare and other regulated industries.
About the Event
This virtual webinar from Anchore examines the security and compliance challenges organisations face when deploying open source AI models in production environments. As AI model adoption accelerates, many organisations lack visibility into which models are present in their software, where those models originated and what license terms apply. The session features Anchore’s Senior Software Engineer and Chief Research Officer discussing practical approaches to extending existing software supply chain security practices to cover AI components.
Governance Gaps in AI Model Deployment
Traditional software composition analysis tools were not designed to handle AI models, leaving organisations with blind spots in their security posture. Open source AI models often arrive embedded in containers or as dependencies, making them difficult to detect and inventory. Without accurate tracking, security teams cannot correlate vulnerabilities to specific models or verify that license obligations are being met. This creates particular challenges for organisations in regulated industries where demonstrating compliance requires comprehensive documentation of all software components.
SBOM Integration and License Compliance
The webinar explores how to bring AI models under the same governance frameworks applied to other open source components. This includes generating SBOM outputs that account for AI models using established standards such as CycloneDX and SPDX. A particular focus is license risk, including potential copyleft exposure arising from training data. Attendees will learn how policy-as-code workflows can be extended to enforce consistent controls across both traditional software dependencies and AI models.
Who Should Attend
The session is intended for security architects, compliance managers, DevSecOps practitioners and software development teams responsible for securing AI-enabled applications. It is particularly relevant for organisations in technology, SaaS, financial services and healthcare sectors where regulatory requirements demand rigorous supply chain documentation. Those working to establish or mature AI governance programmes will find the content applicable to their compliance and risk management objectives.