# AI Vendor Risk Questionnaire: [Vendor name] / [AI product]

> Due diligence questionnaire and assessment record for a supplier of an
> AI system, AI feature, general-purpose AI model or AI service. It
> covers the vendor profile, system description, model provenance and
> training data, data handling and residency, security (including the
> OWASP Top 10 for LLM Applications), evaluation evidence, bias and
> fairness, transparency, human oversight, incident and change
> notification, subprocessors and model dependencies, regulatory status
> under the EU AI Act (Regulation (EU) 2024/1689 as amended by
> Regulation (EU) 2026/1744, including Article 25 value chain duties),
> contract clauses, a scoring rubric and the decision. It supports
> ISO/IEC 42001:2023 Annex A controls A.10.2 and A.10.3 and the third
> party actions of NIST AI 600-1 (GOVERN 6.1 and 6.2). Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice.

<!--
Guidance: How to use this template
- Tier the vendor first (section 1). Send only the sections the tier
  requires; a low-tier writing aid does not need the full set.
- Send sections 2 to 15 to the vendor as a questionnaire. Keep sections
  16 to 19 internal: they hold your scoring, findings and decision.
- Ask for evidence, not just answers: reports, certificates, model cards,
  test results, contract drafts. Record what you received in the
  Evidence column.
- Use this alongside the general supplier security assessment
  (compliance/supplier-security-assessment); this questionnaire adds the
  AI-specific questions and does not repeat generic security controls.
- Re-assess at renewal, on any material model change by the vendor and
  after any incident involving the vendor.
-->

## Document control

<!-- Guidance: Identify the vendor, the product and version assessed, and the internal use case it serves. An assessment without a named use case cannot be scored, because risk depends on use. -->

| Field | Value |
|---|---|
| Document ID | [AIVRQ-001] |
| Version | [0.1] |
| Status | [Draft / Sent to vendor / Under review / Approved / Rejected / Superseded] |
| Owner | [@procurement-lead] |
| Approvers / reviewers | [@ai-governance-lead], [@security-lead], [@dpo], [@legal] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Vendor | [Legal name, registered address] |
| Product and version | [Name, version, model IDs] |
| Internal use case | [UC-ID, short description] |
| Internal business owner | [@business-owner] |
| Vendor contact | [Name, role, email] |
| Date sent / date returned | YYYY-MM-DD / YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Business owner | [@name] | [Accept / Accept with conditions / Reject] | YYYY-MM-DD |
| AI governance lead | [@name] | [Decision] | YYYY-MM-DD |
| Security lead | [@name] | [Decision] | YYYY-MM-DD |
| Data protection officer | [@name] | [Opinion] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Questionnaire prepared and sent |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Scored and approved with conditions |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Re-assessed after vendor switched underlying foundation model |

## Contents

<!-- Guidance: Keep this list aligned with the headings below. -->

1. [Assessment scope and tier](#1-assessment-scope-and-tier)
2. [Vendor profile](#2-vendor-profile)
3. [AI system description](#3-ai-system-description)
4. [Regulatory status and value chain roles](#4-regulatory-status-and-value-chain-roles)
5. [Model provenance and training data](#5-model-provenance-and-training-data)
6. [Data handling, privacy and residency](#6-data-handling-privacy-and-residency)
7. [Security](#7-security)
8. [Evaluation and performance evidence](#8-evaluation-and-performance-evidence)
9. [Bias and fairness](#9-bias-and-fairness)
10. [Transparency and documentation](#10-transparency-and-documentation)
11. [Human oversight and control](#11-human-oversight-and-control)
12. [Incident, vulnerability and change notification](#12-incident-vulnerability-and-change-notification)
13. [Subprocessors and model dependencies](#13-subprocessors-and-model-dependencies)
14. [Continuity and exit](#14-continuity-and-exit)
15. [Contract clauses](#15-contract-clauses)
16. [Scoring rubric](#16-scoring-rubric)
17. [Findings and remediation](#17-findings-and-remediation)
18. [Decision](#18-decision)
19. [Source mapping](#19-source-mapping)
20. [Glossary and references](#20-glossary-and-references)

## 1. Assessment scope and tier

<!-- Guidance: Internal section. Decide the tier before sending anything. The tier sets which sections are mandatory and who must approve. NIST AI 600-1 GV-6.1-005 suggests a use-case based supplier risk assessment; this table is one way to do it. -->

| Factor | Answer | Points |
|---|---|---|
| Does the AI output affect decisions about individuals (employment, credit, access to services, health)? | [Yes / No] | Yes = 3 |
| Will personal, confidential or regulated data be sent to the vendor? | [None / Internal / Personal / Special category or secret] | 0 / 1 / 2 / 3 |
| Is the system customer-facing or public? | [Yes / No] | Yes = 2 |
| Can the system take actions in our systems (agents, tools, write access)? | [Yes / No] | Yes = 2 |
| Is the use case in an AI Act Annex III area or a regulated product? | [Yes / No / Unsure] | Yes or Unsure = 3 |
| Is the vendor a single point of failure for a critical process? | [Yes / No] | Yes = 2 |

| Total points | Tier | Sections required | Approver |
|---|---|---|---|
| 0 to 3 | Low | 2, 3, 6, 12, 15 | Business owner |
| 4 to 8 | Medium | 2 to 13, 15 | Business owner and AI governance lead |
| 9 or more | High | All sections, plus evidence review or call with vendor | AI governance board |

Tier assigned: *Example:* High (11 points: personal data 2,
customer-facing 2, tool actions 2, single point of failure 2, Annex III
status unsure 3).

## 2. Vendor profile

<!-- Guidance: Sent to vendor. Establish who you are dealing with, including the entity that will sign the contract and process data. Pitfall: assessing the parent company while contracting with a reseller. -->

Answer guide for sections 2 to 15: answer each question in the Vendor
answer column and list supporting documents in the Evidence column. Mark
a question not applicable only with a reason.

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-PRF-01 | Legal entity, country of incorporation and the entity that will contract and process data | | |
| VQ-PRF-02 | Ownership, parent company and any change of control in the last 24 months | | |
| VQ-PRF-03 | Certifications held and their scope (for example ISO/IEC 42001, ISO/IEC 27001, SOC 2), with issuing body and expiry | | Certificates |
| VQ-PRF-04 | Name and role of the person accountable for AI governance | | |
| VQ-PRF-05 | Published AI policy or responsible AI principles | | Link |
| VQ-PRF-06 | Number of customers using this AI product in production and main sectors | | |
| VQ-PRF-07 | Relevant litigation, regulatory investigations or enforcement related to AI, privacy or security | | |

## 3. AI system description

<!-- Guidance: Sent to vendor. You need enough detail to map the system into your own risk assessment. Ask for an architecture diagram showing where your data goes. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-SYS-01 | Intended purpose of the product and uses the vendor does not support or prohibits | | Terms of use |
| VQ-SYS-02 | AI techniques used (for example LLM, classifier, recommender), modalities and whether outputs are generated or selected | | |
| VQ-SYS-03 | Architecture: models, retrieval, tools or agents, guardrails, and which components run where | | Diagram |
| VQ-SYS-04 | Level of autonomy: can the system take actions without human approval, and which actions | | |
| VQ-SYS-05 | Configuration options available to customers (model choice, temperature, filters, logging, data retention) | | Admin guide |
| VQ-SYS-06 | Known limitations, failure modes and conditions where performance degrades | | Model or system card |
| VQ-SYS-07 | Product roadmap items in the next 12 months that change AI behaviour or data use | | |

```mermaid
flowchart LR
  ORG["Our users and data"] --> API["Vendor product / API"]
  API --> GR["Vendor guardrails"]
  GR --> FM["Underlying model (vendor or upstream GPAI provider)"]
  FM --> SUB["Subprocessors (hosting, monitoring)"]
  API --> LOG["Vendor logs and retention"]
  API --> OUT["Outputs to our systems"]
```

## 4. Regulatory status and value chain roles

<!-- Guidance: Sent to vendor, reviewed by legal. Under the AI Act, roles (provider, deployer, importer, distributor, GPAI model provider) decide who owes which duty. Article 25 can turn a deployer into a provider of a high-risk system, for example by putting its name on it, substantially modifying it or changing its intended purpose so it becomes high-risk. Article 25(4) requires a written agreement between a high-risk provider and suppliers of tools, services, components or processes integrated into the system, except suppliers under a free and open-source licence (this exception does not cover GPAI models). Check the consolidated text. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-REG-01 | The vendor's role under the EU AI Act for this product (provider of an AI system, provider of a GPAI model, both, or not in scope) and the reasoning | | |
| VQ-REG-02 | Whether the product, or any intended use, is classified as high-risk (Article 6 and Annex III, or Annex I products), and the conformity assessment status | | Declaration of conformity, registration |
| VQ-REG-03 | Whether the vendor has screened the product against the prohibited practices in Article 5, including those added by Regulation (EU) 2026/1744 | | |
| VQ-REG-04 | How the product supports transparency duties under Article 50 (interaction disclosure, machine-readable marking of synthetic content) | | |
| VQ-REG-05 | If a GPAI model is provided or integrated: who the model provider is, whether it signed the GPAI Code of Practice, and what Article 53 documentation is available to downstream providers | | Model documentation |
| VQ-REG-06 | Whether the GPAI model is classified as having systemic risk (Article 51) and how Article 55 duties are met | | |
| VQ-REG-07 | Information, technical access and assistance the vendor will provide if we become a provider under Article 25(1) or need to meet deployer duties under Article 26 | | Draft agreement |
| VQ-REG-08 | Willingness to sign a written agreement under Article 25(4) where we are the high-risk provider and the vendor supplies a component | | |
| VQ-REG-09 | Other AI laws the vendor complies with in markets where we operate (for example US state laws, Korea AI Basic Act) | | |

Internal note: record our own role for this use case: [Deployer /
Provider (Article 25) / Integrator of a GPAI model into our own system].
High-risk obligations apply from 2 December 2027 (Annex III) and 2
August 2028 (Annex I) under the amended Article 113; check the
consolidated text.

## 5. Model provenance and training data

<!-- Guidance: Sent to vendor. You are checking that the vendor knows where its models and data come from and has the rights to use them. NIST AI 600-1 GV-6.1-009 suggests covering intellectual property, privacy and security in AI procurement due diligence. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-MOD-01 | Models used: name, version, developer, and whether trained in-house, fine-tuned from a third-party model or used as is | | AI-BOM or model list |
| VQ-MOD-02 | Sources and types of training, fine-tuning and evaluation data, and the legal basis or licence for each | | Datasheet or data summary |
| VQ-MOD-03 | For GPAI models: the public summary of training content and the copyright policy, including how rights reservations (opt-outs) are honoured | | Links |
| VQ-MOD-04 | Whether customer data, prompts or outputs are used to train or improve models, by default or with opt-in, and how to opt out | | |
| VQ-MOD-05 | Data quality and curation steps, including removal of personal data, illegal content and duplicate or synthetic data | | |
| VQ-MOD-06 | Indemnity offered for intellectual property claims arising from outputs, and its conditions | | Contract draft |
| VQ-MOD-07 | How model versions are identified to customers and how long a version stays available | | |

## 6. Data handling, privacy and residency

<!-- Guidance: Sent to vendor. Agree which data classes may be sent before scoring. Ask for the data processing agreement early; it often answers half of these questions. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-DAT-01 | Data categories processed (prompts, files, outputs, embeddings, logs, telemetry) and the purpose for each | | Data flow description |
| VQ-DAT-02 | Locations where data is stored and processed, including model inference and support access; options to restrict region | | Data residency statement |
| VQ-DAT-03 | Retention periods for each data category, including abuse-monitoring logs, and deletion on request or contract end | | |
| VQ-DAT-04 | Role under data protection law (processor or controller) and the data processing agreement offered | | DPA |
| VQ-DAT-05 | International transfer mechanisms used | | |
| VQ-DAT-06 | Isolation between customers in shared models, caches, vector stores and fine-tuned adapters | | |
| VQ-DAT-07 | Human review of customer content by vendor staff: when, by whom, and how customers can opt out | | |
| VQ-DAT-08 | Support for data subject requests concerning data held in logs, embeddings or fine-tuned models | | |

## 7. Security

<!-- Guidance: Sent to vendor. Use the general supplier security assessment for baseline controls; ask here about AI-specific threats. The OWASP Top 10 for LLM Applications 2026 (released August 2026) is the reference list: IDs LLM01:2026 to LLM10:2026 follow the published list; check the OWASP site for later editions. -->

| ID | Question | OWASP reference | Vendor answer | Evidence |
|---|---|---|---|---|
| VQ-SEC-01 | Defences against direct and indirect prompt injection, and how they are tested | LLM01:2026 Prompt Injection | | |
| VQ-SEC-02 | Controls preventing disclosure of other customers' data, secrets or training data in outputs | LLM02:2026 Sensitive Information Disclosure | | |
| VQ-SEC-03 | Limits on actions, tools and permissions the system can use, and human approval for high-impact actions | LLM03:2026 Excessive Agency | | |
| VQ-SEC-04 | Supply chain controls for models, datasets, libraries and plugins (provenance checks, signing, SBOM or AI-BOM) | LLM04:2026 Supply Chain | | |
| VQ-SEC-05 | Protection against data and model poisoning in training, fine-tuning and retrieval sources | LLM05:2026 Data and Model Poisoning | | |
| VQ-SEC-06 | Rate limits, quotas and cost controls against resource exhaustion and denial of wallet | LLM06:2026 Unbounded Consumption | | |
| VQ-SEC-07 | Protection of system prompts, hidden instructions and other non-user context from extraction | LLM08:2026 Hidden Context Exposure | | |
| VQ-SEC-08 | Access control, tenant isolation and poisoning defences for embeddings and vector stores | LLM09:2026 Vector and Embedding Weaknesses | | |
| VQ-SEC-09 | Validation and encoding of model output before it reaches browsers, code execution or downstream systems | LLM10:2026 Improper Output Handling | | |
| VQ-SEC-10 | Measures against misleading or false output presented as fact | LLM07:2026 Misinformation | | |
| VQ-SEC-11 | Independent AI red teaming: scope, frequency, last date and summary of findings | | | Red team summary |
| VQ-SEC-12 | Protection of model weights and fine-tuned adapters from theft or tampering | | | |
| VQ-SEC-13 | Security logging available to customers (prompts, tool calls, guardrail events) and export format | | | |

## 8. Evaluation and performance evidence

<!-- Guidance: Sent to vendor. Ask for evidence on tasks like yours, not only general benchmarks. NIST AI 600-1 MS-2.3-002 suggests evaluating claims of model capabilities with empirically validated methods. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-EVL-01 | Evaluation methods and datasets used for accuracy, robustness and safety, and the latest results | | Evaluation report |
| VQ-EVL-02 | Results for tasks, languages and domains matching our use case | | |
| VQ-EVL-03 | Hallucination or groundedness measurement and current rates | | |
| VQ-EVL-04 | Whether we may run our own evaluation and red team tests against the product, and under what terms | | Terms |
| VQ-EVL-05 | Regression testing performed before model or prompt changes are released | | |
| VQ-EVL-06 | Production monitoring for drift, degradation and abuse, and what is shared with customers | | |

## 9. Bias and fairness

<!-- Guidance: Sent to vendor. Ask what was measured, for which groups and with what outcome. "We are committed to fairness" is not evidence. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-BIA-01 | Groups and attributes for which performance or outcome differences were tested | | |
| VQ-BIA-02 | Metrics used and the latest results, including known gaps | | |
| VQ-BIA-03 | Mitigations applied in data, model or post-processing | | |
| VQ-BIA-04 | Support for our own fairness testing (access, test data handling, result sharing) | | |
| VQ-BIA-05 | Language and accessibility coverage, and known weaker languages | | |

## 10. Transparency and documentation

<!-- Guidance: Sent to vendor. Documentation is what lets you meet your own duties towards users and regulators. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-TRN-01 | Model card, system card or instructions for use, and update frequency | | Documents |
| VQ-TRN-02 | Explanations available for individual outputs (citations, reasons, confidence) | | |
| VQ-TRN-03 | Content provenance features (watermarking, metadata, C2PA manifests) for generated media | | |
| VQ-TRN-04 | Customer-facing transparency material we may reuse | | |
| VQ-TRN-05 | Public transparency or safety reports | | Links |

## 11. Human oversight and control

<!-- Guidance: Sent to vendor. Check that the product lets your people supervise it as your policy requires (human in the loop, on the loop or in command). -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-HUM-01 | Features to review, approve, edit or reject outputs before they take effect | | |
| VQ-HUM-02 | Ability to stop, pause or roll back the system and its agents | | |
| VQ-HUM-03 | Controls to configure or disable features, tools and data sources per customer | | |
| VQ-HUM-04 | Guidance and training material for our staff who oversee the system | | |

## 12. Incident, vulnerability and change notification

<!-- Guidance: Sent to vendor. NIST AI 600-1 GV-6.2-007 suggests contracts that request notification of serious incidents and address changes over time such as fine-tuning and drift; GV-6.2-003 suggests incident response plans for third-party GAI. Ask for concrete deadlines. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-INC-01 | Definition of an AI incident the vendor uses and examples | | |
| VQ-INC-02 | Notification deadline and channel for security incidents and AI incidents affecting us | | Contract or SLA |
| VQ-INC-03 | Process for serious incident reporting to authorities where the vendor is a provider under the AI Act, and how customers are informed | | |
| VQ-INC-04 | Vulnerability disclosure policy and bug bounty for AI issues | | Link |
| VQ-INC-05 | Advance notice period for model, prompt, guardrail or data use changes that may alter behaviour | | |
| VQ-INC-06 | Change log and version pinning options | | |
| VQ-INC-07 | Post-incident reports shared with customers | | Sample report |

## 13. Subprocessors and model dependencies

<!-- Guidance: Sent to vendor. Many AI products wrap a model from an upstream GPAI provider. Map that chain, because a change upstream reaches you without your vendor changing anything. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-DEP-01 | List of subprocessors involved in AI processing (model providers, hosting, monitoring, human review), with location | | Subprocessor list |
| VQ-DEP-02 | Upstream GPAI models used, their providers and the contract terms that pass through to us | | |
| VQ-DEP-03 | Fallback if an upstream model is withdrawn, changed or degraded | | |
| VQ-DEP-04 | How subprocessors are assessed for AI risk, and notice given before adding one | | |
| VQ-DEP-05 | Open-source models or components used and how their licences and vulnerabilities are tracked | | |

## 14. Continuity and exit

<!-- Guidance: Sent to vendor. NIST AI 600-1 GV-6.2-006 suggests testing rollover and fallback, which may include manual processing. Plan the exit before you depend on the vendor. -->

| ID | Question | Vendor answer | Evidence |
|---|---|---|---|
| VQ-EXT-01 | Availability commitment and support hours | | SLA |
| VQ-EXT-02 | Business continuity and disaster recovery arrangements for AI services | | |
| VQ-EXT-03 | Export of our data, configurations, prompts, fine-tuned adapters and logs on exit, and format | | |
| VQ-EXT-04 | Deletion confirmation at contract end, including backups and fine-tuned models | | |
| VQ-EXT-05 | Notice period before discontinuing the product or a model version | | |

## 15. Contract clauses

<!-- Guidance: Internal checklist, shared with the vendor as a draft. NIST AI 600-1 GV-6.1-004 and GV-6.1-006 suggest contracts covering content ownership, usage rights, quality, security and provenance, and the right to evaluate third-party processes. Tick each clause as agreed, negotiated or refused. -->

| ID | Clause | Status | Contract reference |
|---|---|---|---|
| CL-01 | Purpose limitation: our data used only to provide the service; no training without written opt-in | [Agreed / Negotiating / Refused] | |
| CL-02 | Ownership of inputs and outputs, and licence to use outputs | | |
| CL-03 | Data residency, retention and deletion commitments | | |
| CL-04 | Security requirements, including AI-specific testing and right to receive test summaries | | |
| CL-05 | Notification of security and AI incidents within [x hours] | | |
| CL-06 | Advance notice of material model or behaviour changes and version pinning | | |
| CL-07 | Audit or evidence rights, including independent assessment reports | | |
| CL-08 | AI Act cooperation: documentation, information and assistance (Articles 25 and 26), and the Article 25(4) agreement where applicable | | |
| CL-09 | Transparency support: disclosure and marking features for Article 50 | | |
| CL-10 | Intellectual property indemnity for outputs | | |
| CL-11 | Subprocessor approval and flow-down of obligations | | |
| CL-12 | Service levels, support and continuity | | |
| CL-13 | Exit assistance, data export and deletion certificate | | |
| CL-14 | Liability allocation that does not shift vendor-caused AI harms to us unexpectedly | | |

## 16. Scoring rubric

<!-- Guidance: Internal section. Score each answered question, then each section. Set weights by tier before reading the answers, so the result is not tuned afterwards. Weights below are an example. -->

Score each question: 0 = no answer or unacceptable; 1 = partial, no
evidence; 2 = adequate with evidence; 3 = strong, independently
verified. Section score = average of its questions times the weight.

| Section | Weight (High tier) *Example* | Average (0 to 3) | Weighted | Minimum to pass |
|---|---|---|---|---|
| 4 Regulatory status | 15 | | | 2.0 |
| 5 Provenance and training data | 10 | | | 1.5 |
| 6 Data handling | 15 | | | 2.0 |
| 7 Security | 20 | | | 2.0 |
| 8 Evaluation | 10 | | | 1.5 |
| 9 Bias and fairness | 5 | | | 1.0 |
| 10 Transparency | 5 | | | 1.5 |
| 11 Human oversight | 5 | | | 1.5 |
| 12 Incidents and change | 10 | | | 2.0 |
| 13 Dependencies | 5 | | | 1.5 |
| Total | 100 | | [0 to 300] | |

| Weighted total | Outcome |
|---|---|
| 240 or more, all minimums met | Accept |
| 180 to 239, or one minimum missed with a remediation plan | Accept with conditions |
| Below 180, or a minimum missed in sections 4, 6, 7 or 12 without a plan | Reject or escalate |

A "0" on any of VQ-REG-03, VQ-DAT-04, VQ-MOD-04 or VQ-INC-02 blocks
acceptance regardless of total.

## 17. Findings and remediation

<!-- Guidance: Internal section. Record each gap, the agreed fix and the date. Track open items in the vendor management system. -->

| Finding ID | Question | Finding | Risk | Remediation | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| FND-001 *(Example)* | VQ-INC-05 | No advance notice of model changes; vendor updates the model behind a fixed API name | High | Contract clause CL-06 with 30 days' notice; our regression evaluation on each change | [@legal] | YYYY-MM-DD | Open |
| FND-002 *(Example)* | VQ-DAT-03 | Abuse-monitoring logs retained 30 days outside the EU | Medium | Zero-retention option enabled; DPA annex updated | [@dpo] | YYYY-MM-DD | Closed |
| FND-003 *(Example)* | VQ-SEC-11 | Red team summary older than 12 months | Medium | Vendor to share new summary; we run our own test before go-live | [@security-lead] | YYYY-MM-DD | Open |

## 18. Decision

<!-- Guidance: Internal section. Record the outcome, the conditions and the next review date. Feed the decision into the AI system inventory and the Statement of Applicability evidence for A.10.3. -->

| Item | Value |
|---|---|
| Tier | [Low / Medium / High] |
| Weighted score | [x / 300] |
| Outcome | [Accept / Accept with conditions / Reject] |
| Conditions | *Example:* FND-001 and FND-003 closed before production use |
| Our AI Act role confirmed | *Example:* Deployer; no Article 25 trigger because we do not rebrand or modify the system |
| Next review | *Example:* At renewal or on notice of a model change, whichever is first |
| Decided by | [@name], YYYY-MM-DD |

## 19. Source mapping

<!-- Guidance: Internal section. Shows auditors that the questionnaire covers the controls and actions it claims to support. -->

| Section | ISO/IEC 42001:2023 Annex A | NIST AI 600-1 suggested actions | EU AI Act |
|---|---|---|---|
| 1 Tier | A.10.3 | GV-6.1-005 | Art. 6, Annex III |
| 2 Vendor profile | A.10.3 | GV-6.1-007 | |
| 4 Regulatory status | A.10.2 | GV-6.1-009 | Art. 5, 25, 26, 50, 51, 53, 55 |
| 5 Provenance | A.7.3, A.7.5, A.10.3 | GV-6.1-009, MP-4.1-007 | Art. 53(1)(c), (d) |
| 6 Data handling | A.7.2, A.10.3 | GV-6.1-009 | Art. 10 (high-risk) |
| 7 Security | A.10.3 | GV-6.1-009, MG-3.1-002 | Art. 15 (high-risk) |
| 8 Evaluation | A.6.2.4, A.10.3 | MS-2.3-002, MG-3.1-005 | Art. 13, 15 |
| 10 Transparency | A.8.2, A.10.3 | MG-3.1-005 | Art. 13, 50, 53(1)(b) |
| 12 Incidents and change | A.8.4, A.10.2 | GV-6.2-003, GV-6.2-007 | Art. 26, 73 |
| 13 Dependencies | A.10.2, A.10.3 | GV-6.2-001, GV-6.2-004 | Art. 25(4), 53(1)(b) |
| 14 Continuity and exit | A.10.3 | GV-6.2-006 | |
| 15 Contract clauses | A.10.2 | GV-6.1-004, GV-6.1-006, GV-6.2-007 | Art. 25(4) |

## 20. Glossary and references

<!-- Guidance: Define terms the vendor and internal reviewers may read differently. -->

| Term | Meaning |
|---|---|
| Provider | Under the AI Act, the party that develops an AI system or GPAI model and places it on the market or puts it into service under its own name |
| Deployer | Under the AI Act, the party using an AI system under its authority in a professional activity |
| GPAI model | General-purpose AI model that can perform a wide range of tasks and be integrated into many systems |
| Value chain | The suppliers, components, models and data that together make up an AI system |
| AI-BOM | Machine-readable inventory of models, datasets and components in an AI system |
| Red teaming | Structured adversarial testing to find failures and vulnerabilities |

References:

- Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744,
  consolidated text on EUR-Lex; Articles 5, 6, 10, 13, 15, 25, 26, 50,
  51, 53, 55, 73, 113
- NIST AI 600-1, Generative AI Profile, July 2024, GOVERN 6.1 and 6.2,
  https://doi.org/10.6028/NIST.AI.600-1
- ISO/IEC 42001:2023, Annex A controls A.10.2, A.10.3, A.10.4
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project,
  https://genai.owasp.org/
- Related templates: [Supplier security assessment](supplier-security-assessment.md),
  [Statement of Applicability (ISO/IEC 42001)](iso-42001-statement-of-applicability.md),
  [AI policy (ISO/IEC 42001)](iso-42001-ai-policy.md),
  Generative AI risk profile (`ai-data/genai-risk-profile`),
  AI risk assessment (`ai-data/ai-risk-assessment`),
  AI use case intake (`ai-data/ai-use-case-intake`)

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the AI Act) as amended by Regulation
(EU) 2026/1744, in particular Article 25 on responsibilities along the
AI value chain, and on NIST AI 600-1 (July 2024), GOVERN 6.1 and 6.2
suggested actions; EU legislative texts are free to reuse and NIST
publications are public domain in the United States. Provisions and
actions are summarised in original wording. ISO/IEC 42001:2023 is a
copyrighted standard and is cited by control number only, with no text
reproduced. Section 7 references the OWASP Top 10 for LLM Applications
2026 by the OWASP GenAI Security Project, licensed under Creative
Commons Attribution-ShareAlike 4.0
(https://creativecommons.org/licenses/by-sa/4.0/); only entry IDs and
short names are used, with attribution, and any OWASP descriptive
material you adapt into this template must be shared under CC BY-SA 4.0.
Check the current consolidated text, NIST publication and OWASP list
before use. This is a documentation format, not legal advice. Template
licence: MIT.