Process Owner: Procurement or vendor risk lead Once per AI system

Vendor and third-party AI due diligence

Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.

Verified against the official source 26 Sep 2026 · reviewed by Bhaskar Bhatt

What this label means

Verified: — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review: — linked to the official source and in the queue for a reviewer to confirm.
Source-linked: — linked to the official source, not yet confirmed by a reviewer.

Download: JSON · Markdown

On this page 6 sections

Duties satisfied: 1; done properly, does the work
Duties supported: 5; contributes; the duty needs more
Jurisdictions: 3
Evidence items: 3

In brief

Vendor and third-party AI due diligence is a process, owned by the procurement or vendor risk lead and carried out for each AI system. 6 recorded duties in 3 jurisdictions rely on it, and it satisfies 1 of them outright. It produces 3 kinds of evidence an auditor can ask for.

How is it implemented?

Procurement and onboarding include an AI questionnaire and evidence request tailored to the supplier's role: documentation and test results for a model, provenance for a dataset, conformity evidence and markings for a regulated system, security posture for a hosted service. Reviewers verify the answers against the organisation's minimum requirements, record findings and residual risks and decide whether to proceed, proceed with conditions or decline. Importers and distributors confirm the upstream party's paperwork is complete before the product moves. Supplier entries in the AI register are re-assessed at renewal and when the supplier reports a material change.

Which legal duties does it serve?

Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.

European Union 3 duties

satisfies Legal requirement confidence high
Verify conformity before importing or distributing high-risk AI
EU AI Act · Articles 23 and 24 · applies from 2 Dec 2027

Onboarding verifies the provider's conformity assessment, documentation, marking and representative.
supports Legal requirement
Providers of high-risk AI must have written agreements with suppliers of components, tools and services
EU AI Act · Article 25(4) · applies from 2 Dec 2027

Identifies which suppliers fall within Article 25(4).
supports Legal requirement
Public authorities must register their use of high-risk AI and must not use unregistered systems
EU AI Act · Article 26(8); Article 49(3) and 49(4) · applies from 2 Dec 2027

Verifies the provider's registration before purchase.

New York (United States) 1 duty

supports Legal requirement
Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool
NYC Local Law 144 (automated employment decision tools) · NYC Administrative Code Section 20-871(a)(1); 6 RCNY Section 5-301 · applies from 5 Jul 2023

Vendor supplies data and audit access for the tool.

United States 2 duties

supports Voluntary confidence high
Establish AI governance policies, roles and accountability (Govern)
NIST AI RMF · GOVERN function

Third-party risk management outcomes.
supports Voluntary
Prioritise, respond to and monitor AI risks (Manage)
NIST AI RMF · MANAGE function

Third-party risk management outcomes.

What evidence shows it is operating?

Evidence this control produces
Evidence	Type	What it shows
AI supplier due-diligence assessment	Supplier assessment	Completed questionnaire, evidence review and decision for one supplier or component.
AI supplier and component register	Register entry
Supplier onboarding decision	Approval or sign-off record

Owner: Procurement or vendor risk lead. Frequency: once per ai system.

Which risks does it address?

Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.

6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
2.2 AI system security vulnerabilities and attacks Privacy & Security24 incidents · 112 risk entries
7.3 Lack of capability or robustness AI system safety, failures, & limitations305 incidents · 126 risk entries

Which standards clauses does it correspond to?

Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.

Framework references
Framework	Reference	Confidence
ISO/IEC 42001	Annex A.10.2, A.10.3	high
NIST AI RMF	GOVERN 6.1, 6.2; MAP 4.1, 4.2; MANAGE 3.1	high
ISO/IEC 27001	Annex A 5.19 to 5.22 Supplier relationships	medium
OWASP Top 10 for LLM Applications	LLM03 Supply Chain	high

Cite this record

AIPolicyTracker (2026). “Vendor and third-party AI due diligence” [AIPT-CTL-0025, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0025 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-CTL-0025: it never changes or gets reused, and its address keeps working if this page moves.

BibTeX

@misc{aipolicytracker2026_vendorandthirdpartyaidue,
  author       = {{AIPolicyTracker}},
  title        = {{Vendor and third-party AI due diligence}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/controls/third-party-ai-due-diligence}},
  url          = {https://aipolicytracker.org/controls/third-party-ai-due-diligence},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.

Governance card

Kind: Process
Owner: Procurement or vendor risk lead
Frequency: Once per AI system
Binding duties: 4 of 6
Review status: Verified against primary source

Confirm which of the duties above reach you (applicability check).
Assign the owner and the frequency.
Operate the control and keep the evidence listed.
Re-check when a duty changes (change log).

Related controls

AI system inventory and classification Process
Conformity assessment, declaration and registration Process
Contractual allocation of AI duties across the supply chain Contractual term

Report a correction How we verify

Frequently asked questions

Which legal duties does "Vendor and third-party AI due diligence" satisfy?

It is recorded as satisfying 1 and supporting 5 duties across European Union, New York (United States) and United States. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.

What evidence shows this control is operating?

AI supplier due-diligence assessment, AI supplier and component register and Supplier onboarding decision. Owner: Procurement or vendor risk lead. Frequency: once per ai system.