ISO 42001 Annex A.10.3: Evaluate AI Suppliers for the Actual Use

What control A.10.3 requires in practice

Control A.10.3 asks the organisation to set up a process that makes sure what it takes from suppliers, whether services, products or materials, fits its approach to responsible AI development and use. It is a process requirement, so a one-time vendor check does not meet it. Annex B guidance explains that suppliers can provide datasets, algorithms or models, software components or entire systems, and that the organisation should weigh supplier type and risk when choosing suppliers, setting requirements and deciding how much ongoing evaluation is needed. It expects the integration of supplied components to be documented, the supplier to provide adequate documentation, and corrective action to be required when supplied items do not perform as intended or cause unacceptable impacts. The outputs are the process, supplier evaluations and records of follow-up.

Evaluate what the supplier actually provides

Annex B.10.3 considers suppliers of datasets, models, libraries, components and complete systems. It links supplier type and risk with selection, requirements and ongoing evaluation, and addresses integration documentation and responses to unsuitable performance. The guidance must be considered under clause 6.1.3(e), with tailoring allowed by B.1.

Different supplies can create different dependencies. A small data component may be highly consequential, while a widely used platform may be constrained to a narrow low-impact purpose. Supplier size or contract value alone is not a sufficient basis for evaluation depth.

Why control A.10.3 matters to the business

Dependence on suppliers is where AI risk often hides. A small data feed or preprocessing component can change results as much as the headline model, yet it may receive no scrutiny because its contract value is low. A supplier process matched to the real integration lets a business choose partners with open eyes, ask for evidence that bears on its own use and respond when a supplier changes something. It also prevents overreliance on certificates and demonstrations that do not cover the intended purpose. Auditors check that evaluation depth reflects risk and that supplier issues lead to decisions about local use.

How to implement control A.10.3

Scale the scrutiny to what is supplied and how it will be used. Proportionality matters: a low-risk supplier needs a light touch, while a data or model supplier behind a consequential decision deserves deeper evidence, and the depth chosen should be explained in the supplier record.

1. Classify suppliers by what they provide: data, model, component, infrastructure or complete service.
2. For each category, define the questions that matter to your integration, such as evaluation evidence, limits, support and change notice.
3. Review supplier assurance, such as certificates and benchmarks, against the scope and purpose you actually need.
4. Document how each supplied item is integrated into your system, so effects of changes can be traced.
5. Agree how updates and incidents are notified and how you will assess them locally.
6. When performance or impact is unsatisfactory, request corrective action with a stated expected outcome and check whether it worked.
7. Decide, with authority, on your own operating conditions while a supplier issue is open.

Illustrative IT example: general assurance misses the intended use

Illustrative manufacturing example: a component change affects inspection

A manufacturer relies on an external image-processing component within an AI inspection workflow. The supplier changes a preprocessing function, altering the information passed to the model. The manufacturer initially treats the update as routine because the AI model is unchanged.

The supplier process should make relevant changes visible and connect them with local assessment and evaluation. Integration documentation helps the organisation understand where the supplied component affects results. A component supplier can matter as much as the provider of the main AI service.

Set requirements that can be evaluated

Identify information and performance needs appropriate to the relationship. Relevant documentation, change information and support arrangements may be important. Avoid a generic questionnaire that asks every supplier the same questions without relating answers to the use.

Determine how ongoing monitoring works. A supplier that met initial requirements can later change its service or fail to provide needed support. Connect material findings with risk reassessment and operational decisions.

Respond when the supplied item no longer fits

The guidance addresses requiring corrective action where supplier performance or impacts are inconsistent with the organisation's responsible approach, potentially working with the supplier. Make the issue and expected outcome clear and follow whether the response is effective.

The organisation also needs an authorised decision about its own use while the issue remains. A supplier promise to investigate is not proof that current operating conditions are acceptable. Consider the actual risks, requirements and available options.

Evidence and common mistakes