# OUT-05 Model provider inventory

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-05

A model provider inventory is maintained, identifying which foundation models are in use for which agents, under which contractual terms, and with what data-use commitments.

The organization maintains a current inventory of all model providers used across its agent estate. For each provider-agent relationship, the inventory records the model version, contractual terms, data-use commitments, and any restrictions on use. This inventory is the foundation for supply-chain risk management and is referenced by OUT-09 and OUT-12.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-05: Inventory exists and covers all provider-agent relationships; entries are current within the documented cadence; contractual terms and data-use commitments are documented; inventory is referenced in vendor management reviews.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Inventory exists and covers all provider-agent relationships.
- Entries are current within the documented cadence.
- Contractual terms and data-use commitments are documented.
- Inventory is referenced in vendor management reviews.

## Framework mappings

- NIST AI RMF: MANAGE 3.1
- SOC 2 (TSC): CC9.2
- EU AI Act: Art. 15(2)
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites OUT-09 Vendor contractual requirements: https://humanintel.net/standard/out/out-09
- Cites OUT-12 Model version pinning: https://humanintel.net/standard/out/out-12
- Cited by OUT-06 Third-party integration inventory: https://humanintel.net/standard/out/out-06

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-05 Model provider inventory. Public review edition, July 2026. https://humanintel.net/standard/out/out-05