A hearing device (2, 2A, 2B) comprising a processing unit configured to compensate for hearing loss of a user of the hearing device; an interface; and a memory unit, wherein the memory unit has stored therein: a first primary customer device identifier; a first model certificate comprising a first customer identifier (CID_1_2); and second model data comprising a second model customer identifier (CID_2_2) and second model information data (MID_2) indicative of one or more available models for the hearing device, wherein the processing unit is configured to: verify the second model data; and upon successful verification of the second model data, operate the hearing device according to the second model information data, wherein to verify the second model data comprises to determine if the second model customer identifier corresponds to the first customer identifier and wherein the verification of the second model data is successful or at least partly successful when the second model customer identifier corresponds to the first customer identifier. a processing unit configured to compensate for hearing loss of a user of the hearing device; an interface; and a memory unit, wherein the memory unit has stored therein: a first primary customer device identifier; a first model certificate comprising a first customer identifier (CID_1_2); and second model data comprising a second model customer identifier (CID_2_2) and second model information data (MID_2) indicative of one or more available models for the hearing device, wherein the processing unit is configured to: verify the second model data; and upon successful verification of the second model data, operate the hearing device according to the second model information data, wherein to verify the second model data comprises to determine if the second model customer identifier corresponds to the first customer identifier and wherein the verification of the second model data is successful or at least partly successful when the second model customer identifier corresponds to the first customer identifier. wherein the memory unit has stored therein: a first primary customer device identifier; a first model certificate comprising a first customer identifier (CID_1_2); and second model data comprising a second model customer identifier (CID_2_2) and second model information data (MID_2) indicative of one or more available models for the hearing device, a first primary customer device identifier; a first model certificate comprising a first customer identifier (CID_1_2); and second model data comprising a second model customer identifier (CID_2_2) and second model information data (MID_2) indicative of one or more available models for the hearing device, wherein the processing unit is configured to: verify the second model data; and upon successful verification of the second model data, operate the hearing device according to the second model information data, verify the second model data; and upon successful verification of the second model data, operate the hearing device according to the second model information data, wherein to verify the second model data comprises to determine if the second model customer identifier corresponds to the first customer identifier and wherein the verification of the second model data is successful or at least partly successful when the second model customer identifier corresponds to the first customer identifier.