# AI supplier assessment

Version 2.0 · Updated 2026-09-21 · Assessment

Decide which supplier evidence supports your use and which responsibilities or gaps remain local.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

Use when you need to decide which supplier evidence supports your use and which responsibilities or gaps remain local.

## Information needed before starting

- Defined AI use, authority limits and assessed configuration
- Controlled sources and independent reference results relevant to this worksheet
- Applicable risk assessment, acceptance basis and responsible reviewers

## Field instructions

- **Supplier and service:** Record the assessed legal/service entity, application boundary and contract identifiers.
- **Intended use and data:** Link the approved use and proposed data categories.
- **Available evidence:** Identify capability, development, security and service evidence with versions and limitations.
- **Data handling:** Assess retention, training use, access, location, subcontractors and deletion arrangements.
- **Version and changes:** Record identifiers, change notifications, version pinning and local response.
- **Availability and recovery:** Define support, outage handling, export and recovery responsibilities.
- **Local evidence gaps:** State what supplier information does not prove for local users and configuration.
- **Disposition and owner:** State restrictions, required actions, owner and reassessment triggers.

## Completed fictional example

Fictional SUP-01 for a hosted model used only with synthetic evaluation documents.

| Assessment area | Available evidence / responsibility | Gap and disposition |
| --- | --- | --- |
| Service | Capability note and observed model identifier retained | Public benchmark is not local protocol-review evidence |
| Data | Synthetic study data and restricted access | Assess terms before real data is permitted |
| Changes | Identifier logged; contractual pinning not established | SUP-G01 remains open; establish usable notification and assessment arrangements |
| Recovery / records | Local timeout checks and exportable study records | Approve production support, retention and recovery responsibilities separately |
| Local ownership | Manufacturer owns use, sources, configuration, users and release | Expanded reliance withheld until material evidence and supplier gaps are addressed |

## Related guidance

- [Read chapter 10: AI Supplier Assessment](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-10-requirements-and-acceptance-criteria-for-probabilistic-systems)

- [Read chapter 17: AI Change Control](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-17-change-control-and-revalidation-triggers)

- [Read chapter 20: AI Release Decision: Complete Case Study](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-20-end-to-end-case-study-and-inspection-readiness)

Canonical page: https://csvtocsa.com/worksheets/ai-supplier-assessment