Third-party vendor oversight
Overview
Section titled “Overview”Compliance program → Vendors is the record of the third parties behind your AI systems in the current environment. Every vendor Shield360 sees in AI traffic (the AI inventory’s vendors) is listed automatically. Vendors that never appear in traffic, such as data providers and firms providing actuarial, claims, MGA, audit or other professional services, are added by hand. For each vendor it records:
- Vendor: the category (AI model or platform provider, data provider, professional service provider, other), the professional service it provides, whether you judge it material, its status (active, exempt, offboarded), the services it provides and who manages the relationship.
- AI systems and models: the AI inventory’s systems and models the vendor supplies or operates, and for each whether you purchased it, whether it was built for you and whether you can modify it.
- Contract: start, end and renewal dates, whether it renews automatically, and whether the contract gives you audit rights, obliges the vendor to cooperate with regulatory inquiries, restricts how the vendor uses your data, requires notice of material model changes and discloses subcontractors.
- Due diligence: the due diligence questionnaire’s date and result, assurance reports (SOC 2, SOC 1, ISO/IEC 27001, ISO/IEC 42001 or other, with their period and expiry), when model documentation and bias or validation evidence were received, and insurance with its expiry.
- Risk and review: a risk rating with its reason, the review cadence, the last review and the next one, and links to governance findings about the vendor.
- Documents: references to the contract, questionnaire, reports and certificates: a name, where the document is kept and its date.
A vendor is keyed by the AI inventory’s vendor key (for example vendor:openai). A vendor added by hand is keyed the same way from its name, so if it later appears in AI traffic, the record and the inventory’s vendor are the same vendor.
Record a vendor
Section titled “Record a vendor”Open Compliance program → Vendors. Vendors seen in AI traffic and not yet recorded show Seen in AI traffic.
Select a vendor seen in traffic to record it, or select Add vendor for one that never appears in traffic.
Record the category, services, AI systems, contract terms, due diligence, risk rating and the date of the last review. Add references to the documents.
The list shows the vendor’s due diligence status and anything missing or expiring.
Recording and changing vendors needs the Maintain the AI inventory permission; viewing and exporting them needs View the AI inventory. Removing a record keeps a vendor seen in AI traffic on the list, unrecorded.
Due diligence status
Section titled “Due diligence status”| Status | Meaning |
|---|---|
| Current | Every check the procurement standard requires is met. |
| Expiring | Every check is met, but something lapses within the standard’s warning period (60 days by default). |
| Missing | A required check is missing or has expired. A vendor seen in AI traffic with nothing recorded is missing everything. |
| Not in scope | The vendor is exempt or offboarded, or the standard covers material vendors only and this one is not material. |
The next review is the last review plus the cadence. A vendor that was never reviewed has no next review, so a standard that requires a periodic review finds it missing.
Vendor procurement standard
Section titled “Vendor procurement standard”The procurement standard is your organisation’s: one standard for every environment. It lists the checks every vendor must pass, how long a questionnaire stays valid, how many days before an expiry to warn, and whether it covers only material vendors. It also records a summary and a reference to the policy document.
| Check | Met when |
|---|---|
| Questionnaire | A questionnaire with a satisfactory result (with or without conditions) was completed within the standard’s validity period |
| SOC 2 or ISO report | An assurance report is current: before its expiry, or within twelve months of the end of its period when no expiry is given |
| Model documentation | Model documentation was received. Asked only of vendors that provide AI or supply or operate an AI system |
| Bias and validation evidence | Bias or validation evidence was received. Asked only of vendors that provide AI or supply or operate an AI system |
| Insurance | Insurance with an expiry date that has not passed |
| Risk rating | A risk rating and the reason for it |
| Periodic review | The next review date has not passed |
| Contract in force | A contract is recorded and has not ended, or renews automatically |
| Audit rights, regulatory cooperation, data-use restrictions, subcontractors disclosed | The contract is recorded to have the term |
| Model change notice | The contract requires notice of material model changes. Asked only of vendors that provide AI or supply or operate an AI system |
Until a standard is approved, vendors are checked against a default baseline: questionnaire, SOC 2 or ISO report, risk rating, periodic review, audit rights and regulatory cooperation.
Change the standard
Section titled “Change the standard”Select Procurement standard on the Vendors page, change the checks and settings, set the effective date and select Save draft. The draft starts from the latest version.
Another member with the Maintain the AI inventory permission selects Approve draft. Nobody approves a draft they last changed. A draft with no effective date takes effect on the day it is approved.
Every version is kept with who drafted and approved it. The standard in force is the latest approved version whose effective date has come.
Controls
Section titled “Controls”Two checks on Controls read the vendor records:
| Check | Met when |
|---|---|
AI vendors have current due diligence (third_party.due_diligence) | Every vendor in scope has the due diligence checks the standard requires (questionnaire, report, model documentation, validation evidence, insurance, risk rating, review), none expired. Names each vendor that falls short and what it lacks. |
Vendor contracts contain audit and cooperation terms (third_party.contract_terms) | Every vendor in scope has a contract recorded to give audit rights and a duty to cooperate with regulatory inquiries, whatever else the standard requires. |
Both are not applicable when no vendor is in scope. They back ISO/IEC 42001 A.10.3, NIST AI RMF GOVERN-6.1 (and MANAGE-3.1 for due diligence) and SOC 2 CC9.2, and are recorded in the daily control history like the other checks.
Reminders
Section titled “Reminders”The daily control job raises two alerts through your alert channels:
| Alert | Raised |
|---|---|
vendor.review_overdue | Once per review date, when an active vendor’s next review day has passed |
vendor.evidence_expiring | Once per expiry date, when an active vendor’s assurance report, insurance, questionnaire (twelve months after its date) or contract expires within 30 days or has expired |
An alert carries the vendor’s name when it is plain text, what lapses and the date; nothing else you typed. It links to the vendor.
Export
Section titled “Export”Export CSV and Export JSON download the vendors the filters match. The CSV has one row per vendor. The JSON has each vendor’s oversight summary, the same shape other Shield360 reports read, with the standard it was judged against. Each export is recorded in the audit log.
| Method | Path | Notes |
|---|---|---|
GET | /api/governance/vendors | Filters: status (current, expiring, missing, not_applicable), category, asset (an AI inventory key), unrecorded=1, q. options=1 adds the AI systems and open findings a vendor may link to, with the manage permission. |
POST | /api/governance/vendors | Records a vendor. Pass vendorKey for a vendor seen in AI traffic; without it the key is made from name. |
GET | /api/governance/vendors/{id} | The record, its checks against the standard in force, its AI systems by name and its findings’ statuses. |
PATCH | /api/governance/vendors/{id} | Changes fields. Audited with the names of the fields changed, never their values. |
DELETE | /api/governance/vendors/{id} | Removes the record. |
GET | /api/governance/vendors/export | format (csv or json) and the list filters. |
GET | /api/governance/vendors/standard | Every version, the draft, and the standard in force. |
PUT | /api/governance/vendors/standard | Saves the draft: requirements, materialOnly, questionnaireMaxAgeMonths, expiringWithinDays, summary, documentName, documentLocation, effectiveDate. |
POST | /api/governance/vendors/standard | { "action": "approve" } or { "action": "discard" }. |
Every request acts on your current environment and its organisation; an id from another environment is not found. Malformed JSON and invalid values are refused with 400.
Next steps
Section titled “Next steps”- AI inventory: the vendors, systems and models seen in use.
- Controls: the checks and frameworks the vendor records back.
- Findings: raise and track issues with a vendor.