Risk, Ethics & Compliance ยท RSK-09
Risk of AI from suppliers
Before AI in a bought product or service is used, and when it changes, the organisation assesses what it does, how it uses data, how the supplier changes the model, and what assurance the supplier offers.
Why it matters
Much of an organisation's AI arrives inside products it has bought, often switched on by a supplier update. The organisation carries the risk of that AI even though it did not build it, so it needs to understand it as well as it would its own.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | AI in bought products is not identified or assessed; it is accepted as part of the product. |
| 2 Developing | Some suppliers are asked about AI, but questions are ad hoc, cover only new purchases, or miss updates that add AI to existing products. |
| 3 Defined | Standard due diligence covers AI in new and existing bought products before use and at intervals, feeds each risk assessment, and keeps unregistered high-risk AI out. |
| 4 Managed | Gaps in supplier assurance are tracked to closure and reported, and reassessment results inform renewal and purchasing decisions. |
| 5 Optimising | Due diligence is refined from incidents and supplier experience, and the organisation's requirements shape what suppliers offer. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- RSK-09.1 A standard due diligence process covers AI in both new and existing bought products and services.
- RSK-09.2 The due diligence covers function, data use, model change, content safeguards, energy use and wider sustainability practice, and supplier assurance.
- RSK-09.3 Before AI from a supplier is used, its regulatory status is confirmed and the provider's instructions for use are obtained.
- RSK-09.4 Due diligence confirms that AI from others is consistent with the organisation's adopted principles.
- RSK-09.5 Due diligence results feed the risk assessment for each use of AI.
- RSK-09.6 Supplier AI risk is reassessed on significant change and at set intervals.
- RSK-09.7 High-risk AI that is not registered where the law requires it is not used, and the provider or distributor is told. HIR
Assessment questions
- How do you find out whether a bought product or service contains AI, including after an update?
- What do you ask suppliers about how their AI works, uses your data and changes over time?
- What assurance do suppliers provide, and what happens when it is not enough?
- The supplier AI due diligence questionnaire or process
- Completed due diligence records for recent purchases and updates
- Regulatory status checks and provider instructions for use, held for bought AI
How to reach Level 3
- Build a due diligence questionnaire covering function, data use, model change, content safeguards, energy use and wider sustainability practice, assurance, and consistency with the adopted principles (RSK-05).
- Apply it to AI in new and existing products and services, confirming regulatory status and obtaining the provider's instructions for use before use.
- Do not use high-risk AI that is not registered where the law requires it, and tell the provider or distributor.
- Feed the results into the risk assessment for each use (RSK-02) and reassess on significant change and at set intervals.
Common pitfalls
- Checking only new purchases and missing AI added to existing products by supplier updates.
- Accepting supplier marketing claims as assurance without asking for evidence.
Starter artefacts
- Supplier AI due diligence questionnaire
- Supplier AI reassessment schedule
Cross-references
| AI Cyber Security Code of Practice | 2.4 partial; 2.7 direct; 3.2 partial; 3.3 partial; 7.3 partial; 8.1 partial; 9.2 partial; 9.3 partial; 10.1 partial; 11.1 partial; 11.3 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Owner and responsibility partial; Scope supplier transparency partial |
| EU AI Act | Art 26(1) partial; Art 26(5) partial; Art 26(8) direct; Art 26(9) partial |
| GDS AI Playbook | P8 partial |
| ISO/IEC 42001 | A.10.3 direct |
| JSP 936 Part 1 | para 36 partial; para 113 partial; para 166 partial; para 198 partial; para 200 partial; para 201 partial |
| NIST AI 600-1 | R1 partial; R3 partial; R4 partial; R5 partial; R11 partial; R12 direct |
| NIST AI RMF 1.0 | GOVERN 6.1 direct; MAP 4.1 partial; MAP 4.2 partial; MEASURE 2.12 partial; MANAGE 3.1 direct |
| UK Data and AI Ethics Framework | Accountability 5 partial; Environmental sustainability 4 direct; SAT 3.7 partial; SAT 4.13 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.