AI Control Library / CF-03: AI Supply Chain & Third-Party Risk
Designation: Core | Control types represented: Operational and Technical
Control requirement
Assess data security across AI supplier processing and integration paths, including prompts, retrieved material, outputs, logs, retained content and downstream transfers. Verify protections and customer-configurable boundaries against the approved data use.
Why this matters
Sensitive information may leave the organization through logging, support access or a secondary model call even when the primary endpoint is approved. Data security review must follow the full processing path.
How the control types work together
Operational controls define acceptance, responsibility and response. Technical controls verify artifacts, observe actual use or enforce data and action boundaries. The process must cover the same deployment that the technical mechanisms protect.
When it applies
AI services handling organizational information, including hosted inference, retrieval connectors, evaluation tools, monitoring services and supplier support processes.
Tailor review depth to information sensitivity, granted authority and business dependence. Record what the organization can test directly, what relies on provider evidence and how material visibility gaps affect the acceptance decision.
Ownership
The data and system owners are accountable; security, privacy and supplier specialists assess boundaries and evidence.
Implementation guidance
- Map information categories and transfers across inference, retrieval, storage, logging, support and material subcontractor paths.
- Assess identity boundaries, tenant isolation, access, encryption, retention, deletion and training-use settings for the actual service configuration.
- Test customer-controlled permissions and egress using authorized non-sensitive data; evaluate supplier evidence for controls that cannot be directly observed.
- Record residual exposure and required configuration, then revisit the assessment after connectors, data categories or service terms change.
How to verify it
Use representative deployment records and authorized controlled tests. Establish the assessed service, artifact version and acceptance conditions before interpreting results; do not extend evidence beyond the boundary it covers.
| Test | Expected result |
|---|---|
| Trace a representative data flow | All material destinations and retention points are identified. |
| Test a user or tenant boundary | The integration prevents unauthorized retrieval or disclosure within the assessed scope. |
| Inspect deletion and logging arrangements | Evidence or explicit limitations support the accepted handling conditions. |
Record a finding when a required result cannot be demonstrated or actual practice differs materially from the accepted conditions. Assign corrective action and verify the affected boundary before closing the issue.
Evidence to retain
- Data-flow and classification records
- Supplier security and handling evidence
- Configuration and boundary tests
- Residual-risk and change reviews
Protect supplier-confidential information, credentials and personal data in these records. Preserve enough version and scope information to establish which service or artifact the evidence supports.
If the control fails
Escalate unknown sensitive-data destinations or failed access boundaries to security, privacy and service owners. Suspend the affected transfer while containment and handling conditions are established.
Example in practice
Hypothetical example: A summarization service keeps a debug copy of prompts in a separate monitoring tool. Assessment identifies the additional destination and disables content logging before confidential documents are connected.
Related controls
- CF03-005: AI Supply Chain Inventory
- CF03-007: AI Supply Chain Contractual Requirements
- CF05-004: AI Data Flow Documentation
Framework mappings
- CSA AICM (STA-15)
- NIST AI RMF (MAP 1.6, MEASURE 2.7)
- EU AI Act (Art. 28)
- ISO 42001 (Cl. 8.3, A9.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant supplier, component, contract, access or deployment changes. Reassess material incidents and new evidence, updating acceptance conditions and verifying corrective actions where required.
Back to AI Supply Chain & Third-Party Risk
Version 1.0