# A.10.3 Suppliers

Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly. What an auditor asks for is supplier selection and requirements process scaled to what each supplier provides and its risk. For suppliers the evidence is the contract and the notice it produced.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.10.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly.

## Where generative AI changes the answer

A supplier of a generative model or a retrieval service controls the part of the system that most often changes, so the contract has to carry notice and evidence obligations.

## Who it binds

The procurement or supplier manager and the AI system owner.

## Evidence an auditor samples

- Supplier selection and requirements process scaled to what each supplier provides and its risk
- Supplier monitoring and evaluation records
- Integration documentation for supplied AI components
- Corrective action requests to suppliers and supplier-provided documentation

## The test you can run

Ask for the contract clause on model change notice, and for the last notice received.

## Common failures

- Supplied models integrated without documentation
- No corrective action route when a supplier's system misbehaves

## Before the draft publishes

Read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.