OWASP Artificial Intelligence Security Verification Standard (AISVS)

The OWASP Artificial Intelligence Security Verification Standard (AISVS) is an open, community-driven catalogue of testable security requirements for AI-enabled systems. It gives developers, architects, security engineers, and auditors one shared checklist for designing, building, testing, and verifying AI applications across their whole lifecycle: training data, model development, deployment, agent orchestration, monitoring, and retirement.

AISVS is modeled on the OWASP Application Security Verification Standard (ASVS) and follows the same rule: every requirement must be verifiable, testable, and implementable. It is vendor-neutral, free to use, and published under the Creative Commons Attribution-ShareAlike 4.0 license.

AISVS 1.0 is available now

AISVS 1.0 was released in June 2026 at the OWASP Global AppSec conference in Vienna. It contains 191 requirements across 12 chapters and three appendices, and every requirement carries a verification level of 1, 2, or 3.

• Download the AISVS 1.0 PDF
• Read AISVS 1.0 online in its Markdown source form
• AISVS Research Wiki with the threats mitigated, verification approach, and tooling notes for every requirement
• Versioning and release policy

How to use AISVS

• Design. Use the requirements as a security checklist when architecting AI systems and agents.
• Development. Turn requirements into acceptance criteria, code review checks, and automated tests in CI/CD pipelines.
• Assessment. Use AISVS as the verification framework for AI penetration tests, red-team exercises, and audits.
• Procurement. Reference specific requirement IDs when evaluating AI vendors, third-party models, and MCP servers.

AISVS is intentionally narrow. It covers only what is specific to AI and ML systems, and it assumes that general application, infrastructure, and supply-chain security are verified in parallel against ASVS and the other standards that own those topics.

Verification levels

Every requirement is assigned one of three levels. Choose a target level based on the risk profile of the AI system; most production systems should aim for at least Level 2. AISVS levels are aligned with ASVS levels and are designed to be applied together at the matching level.

• Level 1: Baseline. Essential controls that every AI system should implement. For all AI applications, including internal tools and low-risk systems. 51 requirements.
• Level 2: Standard. Controls for systems that handle sensitive data or make consequential decisions. For production systems, customer-facing AI, and systems that process personal data. 95 requirements.
• Level 3: Advanced. Controls for high-assurance environments that face sophisticated attackers. For critical infrastructure, safety-critical AI, and regulated industries. 45 requirements.

Requirement chapters

1. C1: Training Data Integrity & Traceability
2. C2: Input Validation
3. C3: Model Lifecycle Management & Change Control
4. C4: Infrastructure, Configuration & Deployment Security
5. C5: Access Control & Identity for AI Components & Users
6. C6: Supply Chain Security for Models
7. C7: Model Behavior, Output Control & Safety Assurance
8. C8: Memory, Embeddings & Vector Database Security
9. C9: Orchestration & Agentic Security
10. C10: Model Context Protocol (MCP) Security
11. C11: Adversarial Robustness
12. C12: Monitoring, Logging & Anomaly Detection

Three appendices support the chapters:

• Appendix A: Glossary
• Appendix B: AI Security Controls Inventory, a cross-reference of every defense technique in AISVS
• Appendix C: AI-Assisted Secure Coding, controls for using AI coding tools safely

Referencing a requirement

Each requirement has an identifier of the form C<chapter>.<section>.<requirement>, for example C9.4.3. Because identifiers can change between versions, include the version when you cite one: v1.0-C9.4.3 refers unambiguously to requirement 9.4.3 of AISVS 1.0, “Verify that agent identity credentials rotate on a defined schedule.”

How AISVS relates to other standards

• OWASP ASVS covers web application security. AISVS extends the same approach to AI-specific threats and is meant to be applied alongside it.
• OWASP Top 10 for LLM Applications and OWASP Top 10 for Agentic Applications raise awareness of the most critical risks. AISVS supplies the detailed, testable controls that mitigate them.
• NIST AI RMF and ISO/IEC 42001 govern AI risk and management systems. AISVS provides the implementation-level security controls those frameworks point to.

AISVS is not a governance framework, not a risk management methodology, and not a list of recommended products.

Road Map

• Phase 1: Research and category list creation (Done)
• Phase 2: Requirement creation with community, partner, and subject-matter-expert input (Done)
• Phase 3: Beta release and pilot testing on real-world AI applications (Done)
• Phase 4: Final 1.0 release with full documentation (Done, June 2026)
• Phase 5: Continuous improvement (Current phase). Maintain AISVS as an open standard, grow the Research Wiki, and prepare the next minor release, 1.01, to address emerging threats, new AI architectures, and regulatory change.

Get involved

AISVS is built in the open, and every contribution counts, from a typo fix to a new requirement.

• Join the #project-aisvs channel on OWASP Slack. New to OWASP Slack? Get an invite at owasp.org/slack/invite.
• Open an issue to report a problem or propose a requirement, then follow the contributing guide to submit a pull request.
• Follow @OWASP_AISVS on X for release news.
• Report a vulnerability in the project’s own scripts or infrastructure through the security policy. Reporters are credited in the Hall of Fame.

Everyone participating in the project agrees to the OWASP Code of Conduct.