# AI Supplier Assessment

Version 2.0 · Updated 2026-09-21 · Assessment

Assess the AI provider, service boundary, data handling, changes, performance information, security, continuity, and responsibilities.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

Before approved AI use and after material supplier, model, data, security, or contract change.

## Information needed before starting

- Approved AI use and data flows
- Provider terms, evidence and subcontractor information
- Version/change controls and customer responsibilities

## Field instructions

- **Provider and service:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Approved intended use:** Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- **Customer data handled:** Record the agreed responsibilities, permitted data use, locations and third parties. Identify the supporting contract/source and any unresolved dependency.
- **Retention and training use:** Identify the applicable retention basis, accountable record owner and retrieval method. Confirm obligations and test retrieval before deletion or ending supplier access.
- **Sub-processors and locations:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Security and access:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Model and service version:** Record the exact version/release and effective date from an authoritative source, including configuration identifiers needed to reproduce the assessment.
- **Change notification and rollback:** Identify the controlled transition or recovery plan, decision owner and evidence of restoration/retrieval. State how incomplete work is detected and reconciled.
- **Performance and limitations:** State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
- **Incident and continuity response:** Identify the controlled transition or recovery plan, decision owner and evidence of restoration/retrieval. State how incomplete work is detected and reconciled.
- **Contractual responsibilities:** Record the agreed responsibilities, permitted data use, locations and third parties. Identify the supporting contract/source and any unresolved dependency.
- **Conclusion and actions:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Define the specific system, service, change, population, and intended use.

Complete each field from available records and accountable interviews; record unknowns rather than guessing.

Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.

Adapt the structure to the organization’s approved procedures and document-control process.

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Provider and service | ____________________ |
| Approved intended use | ____________________ |
| Customer data handled | ____________________ |
| Retention and training use | ____________________ |
| Sub-processors and locations | ____________________ |
| Security and access | ____________________ |
| Model and service version | ____________________ |
| Change notification and rollback | ____________________ |
| Performance and limitations | ____________________ |
| Incident and continuity response | ____________________ |
| Contractual responsibilities | ____________________ |
| Conclusion and actions | ____________________ |

## Related guidance

- [Read the related practical guide](https://csvtocsa.com/learn/guidance/ai-supplier-and-change-assessment)

Canonical page: https://csvtocsa.com/templates/ai-supplier-assessment