{"slug":"third-party-ai-due-diligence","id":"AIPT-CTL-0025","title":"Vendor and third-party AI due diligence","kind":"process","kind_label":"Process","purpose":"Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.\n","description":"Procurement and onboarding include an AI questionnaire and evidence request tailored to the supplier's role: documentation and test results for a model, provenance for a dataset, conformity evidence and markings for a regulated system, security posture for a hosted service. Reviewers verify the answers against the organisation's minimum requirements, record findings and residual risks and decide whether to proceed, proceed with conditions or decline. Importers and distributors confirm the upstream party's paperwork is complete before the product moves. Supplier entries in the AI register are re-assessed at renewal and when the supplier reports a material change.\n","owner_role":"Procurement or vendor risk lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["6.5","2.2","7.3"],"evidence":[{"type":"supplier_assessment","title":"AI supplier due-diligence assessment","description":"Completed questionnaire, evidence review and decision for one supplier or component."},{"type":"register_entry","title":"AI supplier and component register","description":null},{"type":"approval_record","title":"Supplier onboarding decision","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.10.2, A.10.3","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1, 6.2; MAP 4.1, 4.2; MANAGE 3.1","note":null,"confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.19 to 5.22 Supplier relationships","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM03 Supply Chain","note":null,"confidence_level":"high"}],"obligations":[{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","relationship":"supports","note":"Identifies which suppliers fall within Article 25(4).","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"},{"slug":"eu-ai-act-art-26-8-public-authority-registration-before-use","title":"Public authorities must register their use of high-risk AI and must not use unregistered systems","relationship":"supports","note":"Verifies the provider's registration before purchase.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"},{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","relationship":"satisfies","note":"Onboarding verifies the provider's conformity assessment, documentation, marking and representative.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"us-new-york-city-local-law-144-bias-audit","title":"Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool","relationship":"supports","note":"Vendor supplies data and audit access for the tool.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit"}],"related_controls":["contractual-allocation-of-ai-duties","ai-system-inventory","conformity-assessment-and-registration"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence","context_url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence.md"}