# AI supplier assessment

Decide which supplier evidence supports your use and which responsibilities or gaps remain local.

Adapt this worksheet to your applicable procedures, intended use and requirements. Fictional examples are teaching material, not execution evidence.

## Field instructions

- **Supplier and service:** Record the assessed legal/service entity, application boundary and contract identifiers.

- **Intended use and data:** Link the approved use and proposed data categories.

- **Available evidence:** Identify capability, development, security and service evidence with versions and limitations.

- **Data handling:** Assess retention, training use, access, location, subcontractors and deletion arrangements.

- **Version and changes:** Record identifiers, change notifications, version pinning and local response.

- **Availability and recovery:** Define support, outage handling, export and recovery responsibilities.

- **Local evidence gaps:** State what supplier information does not prove for local users and configuration.

- **Disposition and owner:** State restrictions, required actions, owner and reassessment triggers.

## Completed fictional example

Fictional SUP-01 for a hosted model used only with synthetic evaluation documents.

| Assessment area | Available evidence / responsibility | Gap and disposition |
| --- | --- | --- |
| Service | Capability note and observed model identifier retained | Public benchmark is not local protocol-review evidence |
| Data | Synthetic study data and restricted access | Assess terms before real data is permitted |
| Changes | Identifier logged; contractual pinning not established | SUP-G01 remains open; establish usable notification and assessment arrangements |
| Recovery / records | Local timeout checks and exportable study records | Approve production support, retention and recovery responsibilities separately |
| Local ownership | Manufacturer owns use, sources, configuration, users and release | Expanded reliance withheld until material evidence and supplier gaps are addressed |

## Blank worksheet

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Supplier and service | ____________________ |
| Intended use and data | ____________________ |
| Available evidence | ____________________ |
| Data handling | ____________________ |
| Version and changes | ____________________ |
| Availability and recovery | ____________________ |
| Local evidence gaps | ____________________ |
| Disposition and owner | ____________________ |

### Blank results or assessment rows

| Assessment area | Available evidence / responsibility | Gap and disposition |
| --- | --- | --- |
| ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ |