AI Vendor Management Policy

How to use this document

• What it is for. This is a base policy setting how vendors that supply AI, or use AI to provide services to the organization, are selected, assessed, contracted, monitored and offboarded. It adds AI-specific requirements (use of data to train models, model changes, bias, the vendor chain, exit) to your general procurement and third-party management process without replacing it.
• Who should own it. The AI lead, with procurement or third-party risk management as operational coordinator, and with information security, Legal and the data protection officer. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Before adopting it, decide: which processes you treat as critical functions (Section 5); which contract clauses are non-negotiable and which allow fallbacks (Section 8 and aid E); how often each vendor tier is reviewed (Section 10); and who approves exceptions (Section 16).
• Fields to complete. Replace the bracketed fields and complete the periods marked [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Relationship with other documents. The "AI Tool Adoption Policy" decides whether a tool may be used; this policy decides on what terms its supplier is contracted and monitored. Each vendor's tier uses the single risk scale (Low, Medium, High) of the "AI System Inventory". Use it together with the "AI Vendor Due Diligence Checklist", the "AI Data Processing Agreement (DPA)" and the "AI Vendor and Audit Register", which is the single vendor register.
• Country variants. This document has no country variants. Some industries and countries add requirements (for example, ICT vendor registers in financial services or requirements for hiring-tool vendors); aid H lists them as optional clauses and "Related regulatory references" points to the applicable laws.
• Review. Have Legal and the data protection officer validate the minimum clauses, and information security the technical requirements.
• Approval and publication. Have it approved by management or the AI committee, record the approval in "Version history" and communicate it to procurement, contract managers and AI tool owners.

AI Vendor Management Policy

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 [ORGANIZATION NAME] relies on third parties for much of its AI capability: models, platforms, software with built-in AI and services that use AI. That reliance brings risks that general procurement processes do not always catch: the vendor using our data to train its models, changing the model without notice, its system producing biased outputs on our behalf, its own dependence on other vendors we do not know about, or our inability to exit the contract without losing data or service.

1.2 This policy sets the minimum requirements to manage those risks throughout the vendor relationship: selection, due diligence, contracting, operation, changes, incidents and exit. Using a vendor does not transfer our responsibility toward customers, affected people or authorities.

2. Scope

2.1 This policy applies to any vendor in one or more of these categories:

a) Model and API providers: supply AI models, general-purpose or specialized, accessible by API or for self-hosting.
b) AI software vendors: supply applications or platforms whose operation depends on AI, including AI features added to software already licensed.
c) AI infrastructure and platform providers: cloud, model development and operations platforms, vector databases and orchestration services.
d) Service providers that use AI: consultancies, contact centers, marketing, recruiting or analytics agencies that use AI to deliver the service with our data or on our behalf.
e) Data providers: supply data to train, fine-tune, validate or feed AI systems, including labeling.

2.2 It applies to every phase of the relationship and to all staff who select, contract or manage these vendors.

2.3 This policy supplements the general procurement, third-party management, information security and privacy policies. In case of conflict, the most demanding requirement applies.