AI Vendor and Audit Register

How to use this document

• What it is for. This is a base register that brings together in one place the organization's AI vendors with their tier, the provenance of the models they supply, the data they process, the status of their contracts and data processing agreements, the documentation and assurance reports received, the assessments and audits performed, open findings and next review dates. It includes the definition of each field with instructions and a completed example, and traffic-light rules.
• Who should own it. The AI lead, with procurement or third-party risk management as operational coordinator, and with Legal, the data protection officer, information security and the owners of each system. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide what counts as an AI vendor (Section 2), how each vendor's tier is assigned (Section 3, which applies the "AI Vendor Management Policy"), the assessment frequency by tier (Section 8) and which tool holds the register (controlled spreadsheet, third-party management module or the IT vendor register).
• Fields to complete. Configure the fields in Sections 4, 5 and 6 in your tool. The "Example" columns show a fictitious language model vendor integrated into customer service. Replace the bracketed text, such as [ORGANIZATION NAME], [RESPONSIBLE FUNCTION], [VENDOR] and [COMPLETE].
• Country variants. This document has no country variants. Financial entities subject to rules on registers of technology service providers, and organizations that must sign data processing agreements with their processors, should check in "Related regulatory references" which fields their rules require and add them.
• Review. Ask Legal and the data protection officer to validate the fields in block D, and information security to validate blocks A6 to A9 and the assessment frequency.
• Approval. The register format and its rules are approved by the [AI COMMITTEE] or the procurement committee. The register is a living internal document; record format changes in "Version history," not row updates.

AI Vendor and Audit Register

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Register owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Register location	[COMPLETE: tool or link]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 [ORGANIZATION NAME] keeps this register as the single source of information on its AI vendors and on the assessments and audits it performs on them, for procurement, legal, privacy, security, risk management, audit and process owners.

1.2 The register shows at any time which vendors take part in the organization's AI systems, what data they receive, under what contractual terms, with what assurances, what risks they present, which findings remain open and when they are due for review.

2. What is recorded

2.1 The following are recorded as AI vendors:

a) vendors of AI models or services accessed through an interface (APIs);
b) software or cloud service vendors with AI features enabled by the organization;
c) developers, integrators or consultants that build, fine-tune or operate AI systems on the organization's behalf;
d) vendors of datasets or labeling services used to train or evaluate models;
e) [OPTIONAL] vendors of audit, testing or monitoring services for AI systems.

2.2 Vendors are recorded in any status: under assessment, approved, approved with conditions, under review and retired. Retired vendors are not deleted.

2.3 This is the single register of AI vendors: other documents do not keep their own vendor lists. Open-weight models the organization downloads and runs with no vendor do not appear here but in the "AI System Inventory" and the "Third-Party and Open-Weight Model Provenance Sheet"; the third-party cloud where they run is a vendor.

2.4 Each vendor has one row in the vendor register (Section 4). Each assessment or audit has one row in the assessment register (Section 5) and each finding, one row in the findings register (Section 6).