A hearing device comprising - a processing unit configured to compensate for hearing loss of a user of the hearing device; and - a memory unit, wherein the memory unit has stored therein: - a hearing device identifier; characterized in that the memory unit has stored therein: - model data comprising model information data indicative of available models for the hearing device, the model information data comprising first model information and a digital signature, wherein the model data comprises a model name and a model identifier, and wherein the processing unit is configured to: - verify the model data, wherein to verify the model data comprises to verify the digital signature of the model information data and wherein to verify the model data comprises to perform a check function based on the hearing device identifier, the model name and the model identifier, wherein to perform the check function comprises applying one or more hash functions, and to determine if a verification criterion based on the hearing device identifier, the model name and the model identifier is fulfilled, wherein verification of the model data fails if the verification criterion is not met, wherein the verification criterion is not met if the result of the check function does not match model information of the model information data, and - proceed to a model update mode being a non-operative mode where the hearing device does not operate as a hearing device, if verification of the model data fails. - a processing unit configured to compensate for hearing loss of a user of the hearing device; and - a memory unit, wherein the memory unit has stored therein: - a hearing device identifier; - a hearing device identifier; characterized in that the memory unit has stored therein: - model data comprising model information data indicative of available models for the hearing device, the model information data comprising first model information and a digital signature, wherein the model data comprises a model name and a model identifier, and - model data comprising model information data indicative of available models for the hearing device, the model information data comprising first model information and a digital signature, wherein the model data comprises a model name and a model identifier, and wherein the processing unit is configured to: - verify the model data, wherein to verify the model data comprises to verify the digital signature of the model information data and wherein to verify the model data comprises to perform a check function based on the hearing device identifier, the model name and the model identifier, wherein to perform the check function comprises applying one or more hash functions, and to determine if a verification criterion based on the hearing device identifier, the model name and the model identifier is fulfilled, wherein verification of the model data fails if the verification criterion is not met, wherein the verification criterion is not met if the result of the check function does not match model information of the model information data, and - proceed to a model update mode being a non-operative mode where the hearing device does not operate as a hearing device, if verification of the model data fails. - verify the model data, wherein to verify the model data comprises to verify the digital signature of the model information data and wherein to verify the model data comprises to perform a check function based on the hearing device identifier, the model name and the model identifier, wherein to perform the check function comprises applying one or more hash functions, and to determine if a verification criterion based on the hearing device identifier, the model name and the model identifier is fulfilled, wherein verification of the model data fails if the verification criterion is not met, wherein the verification criterion is not met if the result of the check function does not match model information of the model information data, and - proceed to a model update mode being a non-operative mode where the hearing device does not operate as a hearing device, if verification of the model data fails.