# AI Supplier Assessment

Version 2.0 · Updated 2026-09-21 · Assessment

Assess the AI provider, service boundary, data handling, changes, performance information, security, continuity, and responsibilities.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

Before approved AI use and after material supplier, model, data, security, or contract change.

## Information needed before starting

- Approved AI use and data flows
- Provider terms, evidence and subcontractor information
- Version/change controls and customer responsibilities

## Field instructions

- **Provider and service:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Approved intended use:** Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- **Customer data handled:** Record the agreed responsibilities, permitted data use, locations and third parties. Identify the supporting contract/source and any unresolved dependency.
- **Retention and training use:** Identify the applicable retention basis, accountable record owner and retrieval method. Confirm obligations and test retrieval before deletion or ending supplier access.
- **Sub-processors and locations:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Security and access:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Model and service version:** Record the exact version/release and effective date from an authoritative source, including configuration identifiers needed to reproduce the assessment.
- **Change notification and rollback:** Identify the controlled transition or recovery plan, decision owner and evidence of restoration/retrieval. State how incomplete work is detected and reconciled.
- **Performance and limitations:** State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
- **Incident and continuity response:** Identify the controlled transition or recovery plan, decision owner and evidence of restoration/retrieval. State how incomplete work is detected and reconciled.
- **Contractual responsibilities:** Record the agreed responsibilities, permitted data use, locations and third parties. Identify the supporting contract/source and any unresolved dependency.
- **Conclusion and actions:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Define the specific system, service, change, population, and intended use.

Complete each field from available records and accountable interviews; record unknowns rather than guessing.

Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.

Adapt the structure to the organization’s approved procedures and document-control process.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| Provider and service | Fictional hosted document-review model service |
| Approved intended use | Propose source-linked validation-document comments for qualified review |
| Customer data handled | Permitted validation documents; no patient or production records |
| Retention and training use | Zero retention and no customer-data training by contract |
| Sub-processors and locations | Approved processing region and listed sub-processors |
| Security and access | Encrypted transport, tenant isolation, role-restricted API key |
| Model and service version | Pinned service alias with provider change record; exact weights unavailable |
| Change notification and rollback | Advance notice for material behavior change; prior version subject to availability |
| Performance and limitations | Provider benchmark is contextual only; customer challenge set controls acceptance |
| Incident and continuity response | Notification, export, manual review fallback, and service suspension defined |
| Contractual responsibilities | Provider secures service; customer controls use, sources, roles, review, and release |
| Conclusion and actions | Conditionally suitable with locked population, local evaluation, monitoring, and stop criteria |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Provider and service | ____________________ |
| Approved intended use | ____________________ |
| Customer data handled | ____________________ |
| Retention and training use | ____________________ |
| Sub-processors and locations | ____________________ |
| Security and access | ____________________ |
| Model and service version | ____________________ |
| Change notification and rollback | ____________________ |
| Performance and limitations | ____________________ |
| Incident and continuity response | ____________________ |
| Contractual responsibilities | ____________________ |
| Conclusion and actions | ____________________ |

## Related guidance

- [Read the related practical guide](https://csvtocsa.com/learn/guidance/ai-supplier-and-change-assessment)

Canonical page: https://csvtocsa.com/templates/ai-supplier-assessment