Vendors & dependencies

Record a vendor

• Choose Add Vendor, or rely on the project wizard, which adds each named provider automatically.
• The vendor page groups AI systems and dependencies, risk assessment, contract, DPA and evidence, findings, risks and incidents, and supplier change history.
• Use Add versioned vendor offering and Link a governed dependency to connect specific products and models to your AI Systems.

AI risk assessment

Open AI Risk Assessment, answer each question Yes, Partial or No, and choose Save assessment. A high-risk result creates a Risk. A missing DPA for a vendor that processes personal data creates a GDPR Article 28 finding.

Vendor changes

1. 1Use Record vendor material change and give a source reference. The change waits for validation.
2. 2When validated, AIGovernr opens a reassessment case for every dependent asset (due in 1 day if critical, otherwise 7) and moves active decisions to Review Required.
3. 3Complete the reassessment and request a new decision where needed.

Continuous oversight shows provider concentration, assurance expiring within 90 days and observed changes across vendors.