Model Registries in Production and the 2026 Shift Toward LLM Weight Management and Multi-Cloud Catalogs

The premise of “one registry for all your models” worked when all your models were scikit-learn pipelines. A single Model Artifact was a pickle file. Governance meant a checkbox in a spreadsheet.

That stopped working.

A single LLM checkpoint is now multiple gigabytes of SafeTensors. Your bank needs a dual approval gate before anything touches production. Netflix built an entirely new graph architecture to map what trained what and what runs in production. These are not problems the Model Registry tooling of 2022 was built to solve.

The space is restructuring. Quickly.

The Registry Architecture Just Forked

Thesis: The 2026 shift isn’t about incremental features — it’s a structural split between classical ML artifact stores and a new category of LLM-native weight managers, and the gap is widening.

Mlflow 3.14.0, released June 17, 2026, added a Prompt Registry, multi-turn evaluation, and trace cost tracking (MLflow Docs). The same release cycle introduced RBAC for model permissions across teams in version 3.13. That’s not a feature update. That’s a platform repositioning.

The bigger signal: traditional Model Staging — the Staging → Production workflow teams have run for years — is deprecated since MLflow 2.9.0 and slated for removal in a future major release (MLflow Docs). The replacement is aliases and tags. More flexible. Harder to misuse. Already overdue.

Harbor v2.13+ is storing GGUF and SafeTensors weight files as OCI artifact layers (VMware Blog). A single TinyLlama 1.1B model compresses from 2.1 GB SafeTensors to 636 MB GGUF — the weight file is now infrastructure, not an experiment artifact. The OCI Distribution Spec was built for containers. It’s now the substrate for model weights. ORAS and KitOps handle the packaging. One registry, OCI-compliant, stores both.

That’s not coincidence. That’s convergence.

Three Platforms, One Structural Conclusion

The evidence isn’t theoretical. Three distinct platform decisions point the same direction.

Regulated industry: Federal Reserve interagency guidance SR 11-7 was replaced on April 17, 2026, with a five-pillar framework explicitly covering GenAI (Federal Reserve). Tier-1 material models now require dual approval — validator and committee — before promotion. All of it logged in Unity Catalog with attribute-based access control (Databricks Blog). Model Lineage requirements alone rule out any registry that can’t produce a complete audit trail from training data to production endpoint.

Platform engineering at scale: Netflix announced a graph-based Model Lifecycle Graph in May 2026, mapping datasets, models, features, evaluations, and production services into a single metadata architecture (InfoQ). No specific scale numbers were disclosed — the architectural choice is the signal. When your Experiment Tracking layer can’t answer “what data trained this model and what does it serve in production,” you build something that can.

Consumer platforms: Spotify uses Canary Deployment for new recommendation models — deploying to a small cohort first, with registry-tracked version management and approval status before full rollout. The registry isn’t just storage. It’s the promotion gate.

Three industries. The same architectural conclusion.

Who Moved First

The platforms that restructured early are in a strong position.

Databricks Unity Catalog combined with MLflow handles tiered approval gates and ABAC natively — the default path for regulated industries that need LLM Cost Management alongside governance. Harbor v2.13+ is the on-prem route for teams storing GGUF and SafeTensors directly. Hugging Face Enterprise Hub operates as the de facto registry for open-weight LLMs, with Model Gateway providing org-level gating and content-addressed storage.

LLM Observability tooling is maturing alongside the registry layer. OpenTelemetry trace integration is becoming standard — connecting model serving to the specific artifact that produced the inference.

You’re either running governance that can answer “what is in production, why, and who approved it” — or you’re not.

Who’s Already Behind

Teams still running MLflow Stages need a migration path. The deprecation notice has been live since v2.9.0. Removal is coming (MLflow Docs). Waiting is a choice, but not a free one.

Hugging Face users on JFrog Artifactory had a June 2026 deadline to migrate to the “Machine Learning” layout (HF Blog). Missing that deadline means operating outside the supported path.

Google’s Vertex AI is in a branding transition toward the Gemini Enterprise Agent Platform. API and SDK names may diverge during the transition — teams integrating against Vertex now should treat the naming as a variable, not a constant.

You’re either migrating now or debugging the gap later.

Security & compatibility notes:

• MLflow path traversal (CVE-2026-2614) and unauthenticated route access (CVE-2026-2652): Critical vulnerabilities in MLflow ≤ 3.9.0 allowing unauthenticated file reads and unprotected API access. Both fixed in 3.10.0.
• MLflow stored XSS (CVE-2026-33865) and authorization bypass (CVE-2026-33866): Vulnerabilities in MLflow ≤ 3.12.x enabling malicious YAML injection in the registry UI and unauthorized artifact downloads. Pin to 3.14.0 (current, MLflow Docs) to address all four CVEs.
• Model Stages: Deprecated since v2.9.0; removal planned in a future major release. Migrate to aliases + tags.
• Local file store: Now errors by default in MLflow 3.x; set MLFLOW_ALLOW_FILE_STORE=true to retain, or migrate to a supported artifact store backend.

What Happens Next

Base case (most likely): MLflow aliases + tags replace Stages across enterprise deployments. OCI-based weight storage via Harbor becomes standard for on-prem teams. The GenAI governance layer — Prompt Registry, RBAC, multi-turn eval — gets adopted by regulated industries first, then diffuses into general ML teams. Signal to watch: Enterprise MLflow deployments upgrading past 3.10.0 as the CVE surface forces migrations. Timeline: Late 2026 for most; 2027 for stragglers.

Bull case: OCI packaging via KitOps and ORAS standardizes across clouds. A true multi-cloud model catalog emerges — one registry, portable across providers, no lock-in. Signal: Major cloud providers ship native OCI model import/export in their managed platforms. Timeline: 2027–2028.

Bear case: Security incidents in self-hosted registry deployments create compliance exposure in regulated industries, slowing GenAI governance adoption. The CVE backlog for older MLflow versions is material. Signal: A financial institution reports a model artifact disclosure tied to an unpatched registry instance. Timeline: Could surface any quarter.

Frequently Asked Questions

Q: How do ML platform teams at companies like Netflix and Spotify use model registries to govern hundreds of production models?

A: Netflix announced a graph-based Model Lifecycle Graph in May 2026, mapping every dataset, model, feature, evaluation, and production service into a single metadata architecture. Spotify uses canary deployment with registry-tracked approval status before new recommendation models reach full rollout.

Q: What does a production MLflow model registry setup look like at a bank with strict audit trails and multi-stage approval gates?

A: Under the April 2026 interagency guidance replacing SR 11-7, Tier-1 material models require dual approval — validator plus risk committee — before promotion. All approvals log in Unity Catalog with attribute-based access control. MLflow manages artifact versioning; Unity Catalog owns the governance layer.

Q: How are model registries evolving in 2026 to handle LLM weights, GenAI artifacts, and multi-cloud model catalogs?

A: Two structural changes: the Staging → Production workflow is being replaced by alias + tag systems — MLflow deprecated Stages in v2.9.0. LLM weight files in SafeTensors and GGUF formats are moving into OCI-compliant artifact stores like Harbor v2.13+, using the same infrastructure as container images.

The Bottom Line

Three forces hit the model registry space simultaneously in 2026: LLM weight formats demanding OCI-native storage, a banking regulatory overhaul requiring audit-grade governance, and platform teams building graph-scale lineage systems. Teams that treated this as a tooling upgrade got caught by all three at once. The migration is not optional — it’s already overdue.