Suppliers

Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly. What an auditor asks for is supplier selection and requirements process scaled to what each supplier provides and its risk. For suppliers the evidence is the contract and the notice it produced.

What it asks

Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly.

Where generative AI changes the answer

A supplier of a generative model or a retrieval service controls the part of the system that most often changes, so the contract has to carry notice and evidence obligations.

Who it binds

The procurement or supplier manager and the AI system owner. For A.10.3 the named role is the owner of supplier selection and requirements process scaled to what each supplier provides and its risk.

Evidence an auditor normally samples

• Supplier selection and requirements process scaled to what each supplier provides and its risk
• Supplier monitoring and evaluation records
• Integration documentation for supplied AI components
• Corrective action requests to suppliers and supplier-provided documentation

The test you can run

Take supplier selection and requirements process scaled to what each supplier provides and its risk and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Supplied models integrated without documentation
• No corrective action route when a supplier's system misbehaves

Before the draft publishes

For A.10.3, read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident. The first artefact to produce is supplier selection and requirements process scaled to what each supplier provides and its risk.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.10.3 (suppliers) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.