AI system supplier evaluation
Description
Due diligence assessment of AI system suppliers covering technical capabilities, responsible AI practices, and security posture.
Implementation Guidance
Evaluation Framework
Develop an AI supplier evaluation questionnaire covering: model development methodology, training data governance, bias testing practices, security controls (SOC 2, ISO 27001), incident response capabilities, and responsible AI commitments. Weight criteria based on organizational risk appetite.
Due Diligence Process
Conduct structured due diligence: review supplier documentation and certifications, assess technical capabilities through proof-of-concept, evaluate responsible AI maturity (published AI ethics principles, transparency reports, bias audits), and verify regulatory compliance claims.
Risk Classification
Classify third-party AI suppliers by risk: critical (core business decisions depend on their AI), significant (meaningful operational impact), and standard (limited scope or impact). Apply proportionate evaluation depth and ongoing monitoring based on classification.
Evidence Requirements
- Supplier evaluation questionnaire and scoring criteria
- Completed due diligence assessments per supplier
- Supplier risk classification register
- Proof-of-concept evaluation results