Operating Model & Delivery ยท OPM-05
Supplier performance and exit
AI suppliers are managed against agreed performance measures, and each critical AI service has a tested route to exit or replace the supplier.
Why it matters
AI suppliers change their models, pricing and products often, and some may withdraw altogether. Regular performance management catches decline early, and a workable exit route stops the organisation being tied to a supplier that no longer serves it.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Suppliers are not actively managed once the contract is signed; there is no exit plan. |
| 2 Developing | Some suppliers are reviewed, but measures are informal and exit plans are missing or untested. |
| 3 Defined | Every AI supplier has an owner and agreed performance measures reviewed regularly, and each critical AI service has a documented exit plan. |
| 4 Managed | Supplier performance is reported and acted on, and exit plans for critical services are tested or rehearsed. |
| 5 Optimising | Supplier management and exit planning are refined from experience of supplier changes and exits. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- OPM-05.1 Every AI supplier has a named owner in the organisation.
- OPM-05.2 Every AI supplier has agreed performance measures that are reviewed on a set cycle.
- OPM-05.3 Each critical AI service has a documented exit plan covering data return and replacement.
Assessment questions
- Who manages each AI supplier, and what measures are they held to?
- If a critical AI supplier withdrew its service, what would you do and how long would it take?
- Has any exit plan been tested?
- Supplier performance reports and review records
- Exit plans for critical AI services, with any test results
How to reach Level 3
- Name an owner for every AI supplier relationship.
- Agree performance measures with each supplier, such as availability, response times, accuracy or support quality.
- Hold supplier reviews against those measures on a fixed cycle and record the outcome.
- Identify which AI services are critical and write an exit plan for each, covering how data is returned and what would replace the service.
Common pitfalls
- Treating exit planning as a contract clause rather than a plan someone could follow.
- Measuring only availability when the supplier's model quality is what matters to users.
Starter artefacts
- AI supplier register with owners
- Supplier review record
- Exit plan template for critical services
Ownership and sequence
- Accountable
- delivery lead
- Contributors
- business owner, data owner
- Depends on
- OPM-04
- Roadmap step
- 6
- Lifecycle
- operate, retire
Cross-references
| AI Cyber Security Code of Practice | 3.3 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Owner and responsibility partial |
| ISO/IEC 42001 | A.10.3 partial |
| JSP 936 Part 1 | para 203 partial; para 204 partial |
| NIST AI RMF 1.0 | GOVERN 6.2 partial; MANAGE 3.1 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.