Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

AI model disclosure

← All articles

Optional transparency for bundled AI/ML models on your attestation page. Not a universal legal requirement.

SourceTrust's attestation page is built for open-source package and license transparency. The optional AI model section is a separate disclosure: it lists AI/ML models your product ships or bundles (weights, embeddings, on-prem checkpoints) and the license terms that apply to them. It does not replace your package inventory and is not detected from lockfiles.

Is this legally required?

There is no single law that requires every software vendor to publish an AI model list on a compliance page. Whether you should disclose depends on your contracts, your sector, how you distribute the product, and what buyers ask in security questionnaires. SourceTrust provides the section as optional procurement transparency. It is not legal advice and does not certify compliance with the EU AI Act or any other regulation.

When it helps

  • You bundle model weights, embeddings, or an on-prem checkpoint with the product.
  • Buyers or counsel ask which models you ship and under what license (Llama, Apache-2.0 model cards, custom vendor terms, etc.).
  • You want one place on the attestation page to answer "what AI is in the box?" next to your OSS component list.

When you can skip it

  • Your product only calls third-party APIs (hosted LLMs) and does not ship model files to customers.
  • No questionnaire or contract asks for bundled-model disclosure for this product.
  • All relevant AI dependencies are already covered elsewhere in your compliance process.

How it works in SourceTrust

  1. Open the project → Settings → Attestation.
  2. Turn on Show AI model license section.
  3. Add each model: name, optional provider and version, license name, optional license URL and notes.
  4. Save each model edit and save the section toggle on the Attestation tab. Then publish to record the enabled AI section in a snapshot. The section is shown when at least one model is listed; saving a model does not enable the section or publish it.
AI models are maintained separately from import and package review. Publishing freezes company details, resolved certification wording, the disclosure addendum, distribution scope and AI disclosures in the snapshot. Branding, product links and the separate legal contact remain live. Older revisions without frozen disclosures use live values, including when restored by rollback. See Help center → QR codes and signatures (QR codes and signatures) for the full list of optional page content.

Procurement teams may still ask about AI under separate questionnaires or evolving rules (for example technical documentation under the EU AI Act for certain providers). Use this section when a public attestation page is the right place for your answer. For everything else, rely on counsel and your own compliance process.