Procurement
Operational controls for procurement, with maturity levels, evidence requirements, and implementation guidance.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, including the 18 procurement controls on this page.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
7 controls matching filters
Vendor AI Incident Notification Requirements
Require AI vendors to notify the organization of incidents affecting their AI systems within defined timeframes and with specified information.
Vendor Governance Change Monitoring
Monitor vendor changes to governance structures, safety leadership, and policies. Assess their effects on deployed system risks.
AI Vendor Financial Stability Assessment
Assess vendors’ financial stability and organizational viability during selection and recurring reviews. Consider market consolidation, regulatory costs, and dependence on further investor funding.
AI Safety Index and Benchmark Monitoring
Track external safety indices, benchmarks, and independent evaluations for your AI vendors and models. Include material findings in initial and recurring vendor risk assessments.
AI Platform Conflict-of-Interest Assessment
Assess conflicts when an AI vendor also supplies oversight, monitoring, or safety evaluations for its own models. Ensure governance decisions can be made without depending entirely on vendor-controlled evidence.
AI Evaluator and Auditor Independence Assessment
Before relying on an outside AI evaluation, audit, or safety assessment, check that the assessor is qualified and independent of the vendor. Discount findings that fail the check.
Vendor Regulatory and Legal Exposure Notification Standard
Require AI vendors to notify you, on a set timeline, when the vendor itself faces a regulatory investigation, an adverse government safety finding, a material legal proceeding, or discontinues a product you depend on, and trigger a compliance-impact reassessment when they do.