Ask the vendor five things: what format the file is in, where it came from, what code is needed to load it, how updates and fixes are delivered, and who to call about a security problem. A vendor that cannot answer these in writing is asking you to accept risk you cannot measure.
Why a vendor model is different
When a vendor sends weights, you are placing their artifact inside your environment. Python's pickle documentation says to only unpickle data you trust, and the Hugging Face pickle guide explains that pickle based files can run code on load. So the file format and the loader are part of the purchase decision, not an engineering detail left until after signing.
The question list
| Area | Question | A good answer looks like |
|---|---|---|
| Format | What file format are the weights in? | A data only format, or a stated reason and a mitigation |
| Format | Is any pickle based file included? | No, or an explanation and a hash |
| Provenance | Which base model and training data is this built from? | A named base model, license and a dataset summary |
| Provenance | Who built and signed the file? | A named team, with a way to verify |
| Integrity | How do we verify what we received? | Published hashes or signatures |
| Loader | What code is needed to load and run it? | A list of libraries and versions, with no unexplained custom code |
| Native code | Do you ship custom operator libraries or binaries? | A list, with source access where possible |
| Updates | How are new versions and fixes delivered? | A versioned channel with release notes |
| Security contact | Where do we report a flaw, and what is your response time? | A named contact and a stated process |
| Exit | If we stop, can we keep running what we have? | Clear terms on continued use and deletion |
Ask for things in writing
A call can establish good faith, but a written answer can be reviewed and kept as evidence. Put the answers in your vendor file next to the contract. If your security questionnaire does not mention models, add a short section.
Do not accept a certification as an answer
A vendor's attestation or certificate about their company does not describe the file they sent you. Ask what the report covers and whether it includes their AI features. See does a vendor's SOC 2 report cover its AI features.
What you do after delivery
- Hash the files and compare with the vendor's published values.
- Load in an isolated environment first, with no network and no real credentials.
- Record the version, source and owner in your inventory.
- Pin the exact version in config.
- Set a calendar check for the vendor's next release.
Try it yourself
Click through it at your own pace, or open it full screen. See how requirements map to evidence, the same approach as filing vendor answers.
Safeguard's compliance and evidence automation, with policies and gates, can help you keep vendor answers and software records in one place. Try the free scan.
Quick check
Is a vendor's company level report enough for a model file?
Not by itself. Ask what it covers, and check the file directly.
What is the single most revealing question?
What file format is it, and is any pickle based file included.
Sources
Last reviewed: 19 October 2026.
