Requirement
"The organization shall establish a process to ensure that its usage of services, products or materials provided by suppliers aligns with the organization's approach to the responsible development and use of AI systems."[1]
Explanation
Suppliers can provide anything from training data and model components to complete AI systems, each carrying different risks. This control requires a process ensuring supplied services, products and materials align with the organization's responsible-AI approach. Auditors expect supplier selection criteria, risk-based monitoring, documentation requirements, and evidence that corrective action is required when a supplier falls short.
Implementation Guidance
- Organizations developing or using an AI system can utilize suppliers in a number of ways, from sourcing datasets, machine learning algorithms or models, or other components of a system such as software libraries, to an entire AI system itself for use on its own or as part of another product (e.g. a vehicle).
- Organizations should consider different types of suppliers, what they supply, and the varying level of risk this can pose to the system and organization as a whole in determining the selection of suppliers, the requirements placed on those suppliers, and the levels of ongoing monitoring and evaluation needed for the suppliers.
- Organizations should document how the AI system and AI system components are integrated into AI systems developed or used by the organization.
- Where the organization considers that the AI system or AI system components from a supplier do not perform as intended or can result in impacts to individuals or groups of individuals, or both, and societies that are not aligned with the responsible approach to AI systems taken by the organization, the organization should require the supplier to take corrective actions. The organization can decide to work with the supplier to achieve this objective.
- The organization should ensure that the supplier of an AI system delivers appropriate and adequate documentation related to the AI system (see B.6.2.7 and B.8.2).
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.10.3
- ISO/IEC 42001:2023 Annex B, B.10.3 (implementation guidance)
