Vendor and supply-chain governance: AI obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

category: vendor_governance ×

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Reset

2 results

Legal requirement vendor governance European Union

Verify conformity before importing or distributing high-risk AI

EU AI Act · Articles 23 and 24

Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised representative where required, and must indicate their name and contact details on the system. Distributors must verify CE marking, the declaration of conformity and instructions, and refrain from making non-compliant systems available.

Source-linked Applies from 2 Aug 2026

Voluntary guidance vendor governance Australia

Provide contestability, supply-chain transparency and records (guardrails 7 to 9)

Australian Voluntary AI Safety Standard · Guardrails 7, 8 and 9

Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, models and systems; and keep and maintain records to allow third parties to assess compliance.

Source-linked