Source and training pipeline code
Model architecture, training loops, preprocessing, and evaluation logic. Necessary, but not sufficient.
AI & MODEL ESCROW · NEW
AI systems are not just code. Escrow them accordingly
A trained model weight is not in the source repository. Neither is the fine-tuning dataset, inference environment, prompt configuration, or evaluation harness. Castler custodies and verifies the full AI artifact stack and produces a signed Proof of Recovery.
Escrow scopeNew
WeightsLayer 1
InferenceLayer 2
PromptsLayer 3
EvaluationVerified
Custody mapped to signed evidence
WHAT IT IS
Your institution now depends on AI systems it cannot operate without the vendor.
Financial institutions, insurers, and large enterprises now use vendor-provided AI for credit scoring, fraud detection, KYC, claims, document intelligence, and risk modelling. These systems operate continuously and increasingly support critical decisions.
The institution often pays for access to a model or inference API while holding no model artefacts, no escrow rights, and no independent recovery path.
AI continuity requires custody before acquisition, model deprecation, API withdrawal, or regulatory audit makes access urgent.
WHAT NEEDS TO BE IN CUSTODY
An AI system has six layers. Standard escrow covers one.
Trained model weights
The numerical parameters that define model behaviour. They cannot be reconstructed from source code alone.
Fine-tuning datasets
Domain-specific data used to adapt the model. Without it, the model cannot be retrained or updated after recovery.
Inference environment
Containers, accelerators, memory, batching, serving configuration, and runtime dependencies.
Prompt configurations
System instructions, few-shot examples, retrieval configuration, and output formatting that define application behaviour.
Evaluation harness
Benchmarks, test sets, and validation logic required to confirm that the recovered model remains fit for purpose.
THE CASTLER APPROACH
Full AI artifact custody and agentic verification.
Castler treats the model as a complete operating system of artefacts, not a code repository. Custody and verification follow the full inference path.
What Castler custodies
Model architecture and training code
PyTorch, ONNX, TensorFlow, Safetensors, and GGUF weights
Fine-tuning datasets or cryptographic hashes
Inference environment specifications
Prompt templates and system instructions
Evaluation harness and benchmarks
Model cards and documentation
Verification pipeline
Agents provision an isolated inference environment, load the model weights, and execute the deposited evaluation harness. The run confirms that the model loads, produces outputs consistent with benchmarks, and operates within the declared resource profile.
Signed output
Signed Proof of Recovery with Model Load Report, Inference Verification Report, Benchmark Comparison, Resource Configuration Validation, Confidence Score, engineer seal, and public verification URL.
REGULATORY MANDATE
AI escrow requirements are emerging across every major jurisdiction.
EU AI Act
High-risk AI systems require documentation, transparency, human oversight, and operational controls that depend on retained access to the full model system.
EU DORA
AI vendors supporting critical ICT functions fall within third-party risk and recoverability requirements.
Evidence mapRBI IT Directions 2023 §12(f)
AI systems that qualify as critical applications fall within source-code access and continuity obligations.
Evidence mapSEBI CSCRF
AI used in market surveillance, risk, and client-facing functions is within the continuity scope for critical third-party applications.
Evidence mapFREQUENTLY ASKED
Questions about this escrow type
What model formats does Castler support?
PyTorch, ONNX, TensorFlow SavedModel, Hugging Face Safetensors, and GGUF are supported. Proprietary formats require a defined deposit specification.
Can Castler verify GPU models?
Yes. The deposited inference specification defines the required accelerator, memory, serving, and resource configuration.
What about foundation-model APIs?
When provider weights are unavailable, scope focuses on the application-controlled layer: fine-tuned weights, prompts, retrieval infrastructure, orchestration, and evaluation harness.
Is AI escrow required today?
Critical AI systems can already fall within RBI, SEBI, DORA, and sector continuity obligations. The EU AI Act adds AI-specific documentation and oversight requirements.
GET STARTED
Find out which AI systems in your estate need custody and verification.
A 15-minute briefing. We map your AI vendor estate, identify the artefact layers outside current escrow scope, and show you a verified AI Proof of Recovery.
Book a 15-min briefingISO 27001SOC 2 Type IIPCI DSS