The question tests whether a supplier understands its own supply chain. A company building on another firm's frontier model inherits three things from it.
- Training data. What the model learned from, and how much of that is known.
- Terms. The provider's conditions, which sit underneath the supplier's contract with you.
- Update schedule. When the provider changes the model, the system behaves differently, with nothing in the supplier's software or yours changing at all.
The update nobody shipped
The third is the one that matters once a system is in production. A test passed last month describes last month's model. If the provider can swap what sits underneath, the product you approved and the product your people use today can quietly diverge.
A supplier who cannot answer is usually hiding nothing. More often they have never had to look. Either way, the answer tells you how much of the system is yours to govern.
Sentinel, an AI gateway, forwards requests to OpenAI, Anthropic, Google Gemini, and any OpenAI-compatible endpoint added as a custom provider. It sits between the person and the provider, so it does not change which model answers or what that model was trained on. Naming the provider underneath each tool stays the first thing to check.
Open or closed weights
Open weights means the trained numbers are published, so you can download the model, run it, and host it yourself. What stays out of view is what it was trained on and exactly how. Nearly every model marketed as "open" is open weights only, so the training data is closed in both cases. The difference is worked through in open weights vs. open source, and what a model weight is covers what the numbers themselves are.
How to ask it
Ask the same provider, update, and contract questions before approval.
- A good answer
- A named model, a named provider, a statement of whether the weights are open or closed, and whatever is actually known about the training data.
- An evasion
- "Proprietary technology." "Our own advanced AI." Almost nobody trains their own frontier model; most build on someone else's.
- The follow-up
- If the provider changed their model tomorrow, would I know?
What to check
- For each AI product in use, write down the model and the provider underneath it.
- Ask each supplier how they learn of a model change, and how and when they tell you.
- Find whose terms govern your data once it reaches the model provider. That is half of where your data goes.
Frequently asked questions
- Why does the model provider matter if you only buy the product?
- Whoever buys a product built on someone else's model inherits that provider's training data, terms, and update schedule. The provider's conditions sit underneath the supplier's contract with you, and the provider can change the model on its own schedule. Both are part of what you are approving, so ask about them before approval.
- What happens when the provider updates the model?
- The system behaves differently, with nothing in the supplier's software or yours changing at all. A test passed last month describes last month's model, so the product you approved and the product your people use today can quietly diverge. Ask each supplier how they learn of a model change, and how and when they tell you.
- What does a good answer to the provenance question look like?
- A named model, a named provider, a statement of whether the weights are open or closed, and whatever is actually known about the training data. Answers such as "proprietary technology" or "our own advanced AI" fall short, because almost nobody trains their own frontier model and most products are built on someone else's.
- Does an open-weights model tell you what it was trained on?
- No. Open weights means the trained numbers are published, so you can download the model, run it, and host it yourself. What stays out of view is what it was trained on and exactly how. Nearly every model marketed as open is open weights only, so the training data is closed in both cases.
- What should you check for the AI products you already use?
- For each product, write down the model and the provider underneath it. Ask each supplier how they learn of a model change and how and when they tell you. Then find whose terms govern your data once it reaches the model provider, which is half of the question of where your data goes.