OpenSSF Community Day Europe 2026

AI/ML models remain outside established provenance frameworks such as SLSA, in‑toto, and SBOMs, leaving deployments without hardware‑rooted origin, signed attestations, or a verifiable chain of custody. This talk presents practical results from implementing verifiable AI provenance in an operational MLOps pipeline and highlights four gaps: fragmented lineage, unverifiable training environments, unsigned model artifacts, and non‑tamper‑evident pipeline history. We show how existing components—Marquez for lineage, IETF RATS attestation for environment integrity, SLSA plus Sigstore/cosign for artifact provenance, and adapters binding OpenLineage/MLflow events into signed RATS tokens—compose into a unified, auditable chain of custody. End‑to‑end evaluation demonstrates attestation‑gated workflows, reproducible promotion decisions, and detection of unverified or mis‑ordered stages. The result is a practical reference architecture for cryptographically anchored AI provenance that extends supply‑chain security across the ML lifecycle.