Application security solutions provider Black Duck Software Inc. today announced the that it has added artificial intelligence model risk scanning to its Software Composition Analysis platform.

The capability to identify and analyze AI models, introduced in the company’s 2025.10.0 release, has been designed to address the growing need for enterprises to gain visibility into the usage, licensing and data origins of open-source AI models integrated into their software development processes.

Black Duck argues that as companies increasingly leverage AI models to drive innovation, they face significant challenges in managing the complex components. The new AI Model Risk Insights capability provides visibility into model usage across applications, including versions and datasets, even if they’re hidden or modified, to ensure that companies have a complete understanding of their AI model landscape.

Key features include AI model identification and CodePrint scanning that detects models from repositories like Hugging Face, even if they are not declared in build manifests or are intentionally obfuscated. CodePrint scanning is a technology developed by Black Duck that creates a unique “fingerprint” or signature of code and digital assets, similar to how a hash identifies a file, to detect known components, including open-source libraries.

License compliance and metadata display identifies model licenses to help ensure compliance with project requirements and includes a dedicated user interface screen that displays model-specific metadata, including model cards and training data insights.

The new scanning feature also supports integration and scalability that leverages CodePrint scanning and a Bill of Materials Engine for minimal setup in existing Black Duck workflows. In addition, it has regulatory compliance and governance covered with support for emerging standards like the European Union AI Act, the U.S. Executive Order on AI, and industry-specific guidelines.

“This innovation directly addresses the emerging security challenges of AI adoption, empowering companies to confidently integrate AI models securely while maintaining compliance and regulatory adherence,” said Chief Executive Jason Schmitt. “The capabilities now available through AI Model Risk Insights also represent a significant leap forward in Black Duck’s mission to help companies build and deliver secure and compliant software.”

AI Model Risk Insights is available as a new licensed feature within the Black Duck SCA platform.

Image: Black Duck