Conduct vendor due diligence

Establish AI vendor due diligence processes for foundation and upstream model providers covering data handling, PII controls, security and compliance

Keywords

Vendor Due Diligence

Open-Source

Foundation Models

Upstream Models

Application

Mandatory

Frequency

Every 12 months

Type

Preventative

Crosswalks

Article 23: Obligations of Importers

Article 24: Obligations of Distributors

A.10.3: Suppliers

MAP 4.2: Internal risk controls

LLM03:25 - Supply Chain

STA-01: Supply Chain Risk Management Policies and Procedures

STA-08: Supply Chain Inventory

STA-09: Supply Chain Risk Management

STA-10: Primary Service and Contractual Agreement

STA-11: Supply Chain Agreement Review

STA-12: Supply Chain Compliance Assessment

STA-13: Supply Chain Service Agreement Compliance

STA-14: Supply Chain Governance Review

STA-15: Supply Chain Data Security Assessment

Control activities

Typical evidence

Defining assessment criteria for foundational or upstream AI models. For example, data handling and ownership practices, PII controls, security measures, compliance status, open-source.

Conducting documented assessments. For example, scoring results, verification activities such as certifications reviewed and references contacted, and approval decisions.

Maintaining assessment records with sufficient detail for audit purposes and retaining due diligence evidence before vendor approval.

E006.1 Documentation: Vendor due diligence

Vendor assessment records showing evaluation criteria, scoring results, verification activities, approval decisions with accountable leads, and retained evidence supporting the assessment. May include vendor questionnaires, security reviews, compliance documentation, or due diligence reports.

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."