← Implementer
Module 7 of 11 · 15 min
Stage 3 · Turn requirements into working governance

Supplier and model governance

Control AI risk that enters through vendors and upstream models.

Learn

Tier suppliers by risk and role, define evidence requirements, capture model/service changes and build contract governance into renewals and onboarding.

For GPAI dependencies, ensure downstream teams receive enough information on capabilities, limitations and relevant risks to integrate responsibly.

Do not let procurement approval become a one-time event; cloud AI features can change after purchase.

Remember
  • •Govern the supply chain continuously.
  • •Evidence obligations belong in procurement.
  • •Track model and feature changes.
Client practice

Design a vendor due-diligence checklist for a recruitment AI SaaS provider.

Evidence you should be able to produce
Supplier registerDue-diligence checklistContract requirementsReview cadence
Source basis

EU AI Act supply-chain concepts plus ISO/IEC 42001 Annex A third-party/customer relationship themes.

← Previous moduleNext module →