# AI supplier assessment

Version 2.0 · Updated 2026-09-21 · Assessment

Decide which supplier evidence supports your use and which responsibilities or gaps remain local.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

Use when you need to decide which supplier evidence supports your use and which responsibilities or gaps remain local.

## Information needed before starting

- Defined AI use, authority limits and assessed configuration
- Controlled sources and independent reference results relevant to this worksheet
- Applicable risk assessment, acceptance basis and responsible reviewers

## Field instructions

- **Supplier and service:** Record the assessed legal/service entity, application boundary and contract identifiers.
- **Intended use and data:** Link the approved use and proposed data categories.
- **Available evidence:** Identify capability, development, security and service evidence with versions and limitations.
- **Data handling:** Assess retention, training use, access, location, subcontractors and deletion arrangements.
- **Version and changes:** Record identifiers, change notifications, version pinning and local response.
- **Availability and recovery:** Define support, outage handling, export and recovery responsibilities.
- **Local evidence gaps:** State what supplier information does not prove for local users and configuration.
- **Disposition and owner:** State restrictions, required actions, owner and reassessment triggers.

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Supplier and service | ____________________ |
| Intended use and data | ____________________ |
| Available evidence | ____________________ |
| Data handling | ____________________ |
| Version and changes | ____________________ |
| Availability and recovery | ____________________ |
| Local evidence gaps | ____________________ |
| Disposition and owner | ____________________ |

### Blank results or assessment rows

| Assessment area | Available evidence / responsibility | Gap and disposition |
| --- | --- | --- |
| ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ |

## Related guidance

- [Read chapter 10: AI Supplier Assessment](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-10-requirements-and-acceptance-criteria-for-probabilistic-systems)

- [Read chapter 17: AI Change Control](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-17-change-control-and-revalidation-triggers)

- [Read chapter 20: AI Release Decision: Complete Case Study](https://csvtocsa.com/ai-assurance-academy/ai-in-csv-csa-chapter-20-end-to-end-case-study-and-inspection-readiness)

Canonical page: https://csvtocsa.com/worksheets/ai-supplier-assessment