AI Supplier Assessment

Blank template

1. Provider and service
2. Approved intended use
3. Customer data handled
4. Retention and training use
5. Sub-processors and locations
6. Security and access
7. Model and service version
8. Change notification and rollback
9. Performance and limitations
10. Incident and continuity response
11. Contractual responsibilities
12. Conclusion and actions

Completed fictional example

Fictional teaching example: This is not an executed or approved validation record.

Provider and service

Fictional hosted document-review model service

Approved intended use

Propose source-linked validation-document comments for qualified review

Customer data handled

Permitted validation documents; no patient or production records

Retention and training use

Zero retention and no customer-data training by contract

Sub-processors and locations

Approved processing region and listed sub-processors

Security and access

Encrypted transport, tenant isolation, role-restricted API key

Model and service version

Pinned service alias with provider change record; exact weights unavailable

Change notification and rollback

Advance notice for material behavior change; prior version subject to availability

Performance and limitations

Provider benchmark is contextual only; customer challenge set controls acceptance

Incident and continuity response

Notification, export, manual review fallback, and service suspension defined

Contractual responsibilities

Provider secures service; customer controls use, sources, roles, review, and release

Conclusion and actions

Conditionally suitable with locked population, local evaluation, monitoring, and stop criteria