Store AI Models In A Non-Executable File Format
Artificial intelligence (AI) models must be saved using a file format that cannot run arbitrary code by itself. The goal is that loading a model never lets it execute hidden instructions on your systems.
Plain language
An AI model is the data file that powers a smart feature, such as a chatbot or an image classifier. Some common ways of saving these files can secretly carry program code inside them. When your system loads such a file, that hidden code can run automatically, which is called arbitrary code execution. This control requires that you store AI models in a file format that holds only the model's data and settings, never runnable program code. That way, when staff or systems open a model, the file cannot quietly run commands, install malware, steal data, or damage your systems. In plain terms: the model file should be inert data, not a program that springs into action the moment it is loaded.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
AI models are stored in a non-executable file format that does not allow arbitrary code execution.
Why it matters
If models are stored in formats that can run code, loading a model could trigger hidden commands that install malware, steal data, or damage systems.
Operational notes
Re-check the storage format every time a model is updated, retrained, or pulled from an external source, since a new file can reintroduce a code-bearing format.
Implementation tips
- The IT or machine learning team selects a safe storage format that holds only model data and weights, such as the safetensors format, rather than formats that can embed and run code when loaded.
- The system owner records which model file formats are approved and which are banned, then publishes this as a short standard that everyone building or buying AI features must follow.
- Engineers add an automated check to the deployment pipeline that inspects every model file's format before it is loaded, and blocks any file that is in a runnable or unknown format.
- The security lead configures systems and storage so they only accept the approved non-executable formats, rejecting model files that arrive in formats capable of running code.
- When a model is downloaded from an external source or a public model hub, a named person converts it into the approved non-executable format and confirms it carries no embedded code before it is used in production.
Audit / evidence tips
- AskWhich file format do you use to store your AI models, and does that format allow code to run when the model is loaded?Look atthe documented approved format and a stated reason it cannot execute codeGooda data-only format such as safetensors is named, with executable-capable formats explicitly excluded
- AskHow do you verify a model is in the non-executable format before it is deployed or loaded?Look ata documented validation step covering format and contentsGoodan automated pre-deployment check that confirms format and blocks anything runnable
- AskWhat stops a model in a code-bearing format from being loaded into production?Look atsystem or storage configuration that restricts accepted formatsGoodsettings that only accept approved formats and reject others by default
- AskHow do you handle models obtained from external or public sources?Look ata conversion and inspection step before useGoodexternal models are converted to the approved format and checked for embedded code before deployment
- AskCan you show a sample of model files currently in use?Look atthe actual file types and formats in productionGoodall sampled models are stored in the approved non-executable format with no code-bearing files present
Cross-framework mappings
How ISM-2072 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 7.10 | ISM-2072 requires AI models to be stored in a non-executable file format that prevents arbitrary code execution | |
| Annex A 8.26 | ISM-2072 requires AI model artefacts to be stored in a non-executable file format to prevent arbitrary code execution | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.