Procurement
Operational controls for procurement, with maturity levels, evidence requirements, and implementation guidance.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, including the 18 procurement controls on this page.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
10 controls matching filters
AI Vendor Due Diligence
Assess AI vendors against security, governance, and compliance criteria before procurement and at defined intervals during the vendor relationship.
AI Contractual Requirements
Set minimum AI vendor contract terms for data handling, transparency, audit rights, and incident notification.
AI Procurement Risk Assessment
Assess technical, legal, privacy, and operational risks before approving an AI system or service purchase. Document the findings.
Vendor Safety Commitment Verification
Check whether vendors honor published safety commitments, voluntary pledges, and contractual duties throughout the relationship.
Vendor Model Update Disclosure and Re-Assessment Protocol
Require disclosure of material vendor model updates, including capability changes, safety results, and revised model cards (vendors' published model fact sheets). Trigger internal reassessment when updates affect prior due diligence.
AI Vendor Concentration Risk Assessment
Assess dependence on a small number of AI vendors or underlying model providers. Document supplier alternatives supporting continuity if a primary provider fails, suspends access, or becomes unavailable.
Federal AI Procurement Submission and Review Process
Set a process for federal AI procurement submissions. Track voluntary pre-deployment evaluation commitments becoming mandatory and update procurement workflows accordingly.
Shadow AI and Third-Party Widget Inventory and Classification
Discover and classify AI built into cloud software (SaaS), browser extensions, and code running in web pages. Apply appropriate processing and vendor-risk controls to these shadow AI sources.
Procurement-Stage AI Governance Conditions
Set governance conditions that must be met before AI procurement finishes. Include contractual standards, whistleblowing policies, and internal approval triggers.
AI Developer Tool Data Boundary Controls
Define which coding assistants and AI developer tools the enterprise permits, including what data they may transmit. Evaluate data boundaries before deployment and whenever vendor policies change.