AI systems
Vendors & dependencies
Third-party models and services remain part of the governed AI System's risk and evidence chain.
What to record
- Vendor, product, model, or service details and their relationship to an AI System.
- Assessments, risks, contractual or technical evidence, and responsible owners.
- Relevant changes in provider, model, terms, data handling, or service behavior.
Change impact
A material vendor change can invalidate assumptions, controls, or evidence. Review affected systems, regenerate governance work where needed, and seek a new decision when the prior approval no longer applies.