A security checklist for frontier AI models should cover seven areas: what data the model sees, what it can do, how it is supplied, how it is tested, how it is monitored, who is accountable and how you would stop it. Frontier here means the most capable general purpose models, which you usually rent rather than build.
Why does a frontier model need its own checklist?
Capability changes the failure modes. A model that can write code, call tools and read long documents can be steered by text, can leak what it was given and can take actions at machine speed. NIST's Generative AI Profile, AI 600-1, exists because some risks are unique to or worsened by generative AI, and it offers suggested actions for managing them.
The checklist below turns that guidance and the OWASP LLM Top 10 into questions you can answer in a review meeting. It does not rank vendors or judge any particular model.
1. Data
What goes into prompts, files and retrieval indexes? Classify it first. Decide which classes may leave your environment, and check the provider's terms on retention and training use. Remove secrets from context, since a model cannot leak what it never received.
2. Access and actions
List every tool, API and data store the model can reach, and the permissions behind each. Apply least privilege. Separate read from write. Require human approval for actions that spend money, delete data, send messages outside the company or change production. OWASP names excessive agency as a risk for exactly this reason.
3. Supply chain
Treat models, plugins, tool servers and datasets as dependencies. Record where each came from, pin versions, and review what a new tool server asks for before connecting it. NIST SP 800-218A, the SSDF community profile for generative AI and dual use foundation models, adds secure development practices for AI model development. It is aimed at model producers, AI system producers and the acquirers of those systems, so acquirers can use it to frame questions to suppliers.
4. Testing
Test before launch and after every model or prompt change. Include prompt injection through documents and web pages, attempts to extract system prompts, and attempts to make the model call tools in ways you did not intend. NIST AI 100-2 gives a shared vocabulary for these attack types.
5. Monitoring
Log prompts, outputs, tool calls and approvals with identifiers that tie one conversation together. Define what unusual looks like: sudden spikes in volume, repeated refusals, tool calls to new destinations. Decide who reviews alerts and how fast.
6. Accountability
Name an owner for each deployment, a reviewer for changes and an escalation path. Keep a register of what you run. Under the NIST AI RMF this is the Govern function.
7. Stop and recover
Write a switch that disables the feature, revokes its credentials and falls back to a manual process. Practise it. Decide how you would notify users if the system gave harmful output.
A constructed example
A software team connects a frontier model to their ticket system and repository so it can triage bugs and propose fixes. Running the list: the context included customer emails, so they strip personal data first. The model can read all repositories, so they cut it to three. It can open pull requests but not merge them. A new tool server for log search is pinned to a reviewed version. Tests include a ticket whose text tells the model to print environment variables. Everything is logged, and a feature flag turns the integration off.
How to check or apply this
- Run the seven areas as a one hour review for each AI deployment.
- Record the answers and the owner in your AI register.
- Fix gaps in order: access and actions first, then data, then monitoring.
- Rerun the review when the model, tools or data change.
- Keep test cases in version control and run them in CI.
- Revisit the OWASP and NIST sources every quarter, since both are updated.
Quick check
Do we need this if we only use a chat window?
Less of it. Data rules and accountability still apply. Access and agent controls matter once the model can call tools or touch your systems.
Which item should come first?
Actions. Limits on what the model can do contain damage even when other controls fail.
Sources
- NIST AI 600-1, Generative AI Profile
- NIST SP 800-218A, SSDF Community Profile for Generative AI
- NIST AI 100-2 E2025, Adversarial Machine Learning
- OWASP Top 10 for LLM Applications
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
