AI Control Library / CF-03: AI Supply Chain & Third-Party Risk
Designation: Core | Control types represented: Operational
Control requirement
Establish an AI supply chain risk management policy covering selection, acquisition, integration, operation, change and exit for externally sourced AI components and services. Require risk-based approval, assigned responsibility and evidence proportionate to the dependency.
Why this matters
Buying a service or downloading a model introduces more than a software dependency. The organization also depends on the supplier’s data practices, security decisions, update process and ability to continue providing the required capability.
How the control types work together
Operational controls establish the supplier assessment, ownership, agreement and review processes described here. They work when the assigned parties perform the required activities and use evidence to guide decisions.
When it applies
Purchased and free models, hosted services, datasets, libraries, evaluation services, plugins, APIs and subcontracted AI operations, including embedded AI features.
Tailor review depth to information sensitivity, granted authority and business dependence. Record what the organization can test directly, what relies on provider evidence and how material visibility gaps affect the acceptance decision.
Ownership
The supplier-risk program owner is accountable; AI system owners, procurement, security and relevant business functions implement the policy.
Implementation guidance
- Define covered AI dependencies and risk tiers using information sensitivity, authority, business criticality and the consequences of supplier failure.
- Set minimum due diligence, evidence, contractual and approval requirements for each tier; address free downloads and embedded features as well as purchases.
- Require named internal ownership, shared-responsibility review, change notification and practical exit or containment arrangements.
- Integrate the policy into acquisition and lifecycle gates, reviewing exceptions and reassessing after material supplier or service changes.
How to verify it
Use representative deployment records and authorized controlled tests. Establish the assessed service, artifact version and acceptance conditions before interpreting results; do not extend evidence beyond the boundary it covers.
| Test | Expected result |
|---|---|
| Trace a high-impact AI dependency | Required risk review and approval preceded consequential integration. |
| Inspect an externally sourced component acquired outside procurement | The policy still identifies an owner and assessment route. |
| Review supplier exit readiness | The organization can restrict, replace or safely suspend the affected functionality. |
Record a finding when a required result cannot be demonstrated or actual practice differs materially from the accepted conditions. Assign corrective action and verify the affected boundary before closing the issue.
Evidence to retain
- Approved supply chain policy
- Risk-tier and approval criteria
- Acquisition and exception records
- Reassessment and exit decisions
Protect supplier-confidential information, credentials and personal data in these records. Preserve enough version and scope information to establish which service or artifact the evidence supports.
If the control fails
Escalate unreviewed material dependencies to supplier-risk and system owners. Hold new consequential access or restrict existing exposure until the required assessment and decision are complete.
Example in practice
Hypothetical example: A team adds a free summarization plugin to a customer platform. The policy brings it into scope because it can read client records, even though there is no purchase order or negotiated contract.
Related controls
- CF03-005: AI Supply Chain Inventory
- CF03-006: AI Supply Chain Risk Assessment
- CF03-007: AI Supply Chain Contractual Requirements
Framework mappings
- CSA AICM (STA-01)
- NIST AI RMF (GOVERN 1.1, MAP 1.6)
- EU AI Act (Art. 9(2))
- ISO 42001 (Cl. 6.1, A9.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant supplier, component, contract, access or deployment changes. Reassess material incidents and new evidence, updating acceptance conditions and verifying corrective actions where required.
Back to AI Supply Chain & Third-Party Risk
Version 1.0