Many suppliers now use AI, often switched on inside software you already buy. SupplierVault records, for each supplier, whether they use AI with your data or in what they deliver, what it does, whether your data trains their models, whether it makes decisions about people, and who approved it. The AI in use page brings it together with a red, amber or green status for each supplier.
Where to find it
- On a supplier: Risk and compliance tab, section AI use.
- Across all suppliers: AI in use in the Lifecycle menu.
If you answered No to "Do any suppliers use AI with your data or in what they deliver?" in the setup questions, the AI section is hidden.
Record a supplier's AI use
- Open the supplier, go to Risk and compliance and find AI use.
- Answer "Does this supplier use AI with our data, or in what they deliver to us?": Not asked yet, Yes, No, or Asked, not confirmed. Include AI features inside software you already use, such as assistants, summaries or automatic scoring.
- If Yes, fill in the details (below).
- Click Approve AI use or Don't approve.
The details
| Field | Notes |
|---|---|
| What the AI does for us | In plain words, e.g. "summarises support tickets". |
| Models and providers underneath | e.g. the AI company whose model they use. |
| Is our data used to train AI? | Not known, No, Only if we opt in, Yes. |
| Where the AI processes our data | Country or region. |
| Does it make or support decisions about people? | Yes or No. |
| Human check before decisions take effect? | Yes, No, Not applicable. |
| Tells us before adding AI features or AI sub-processors? | Yes or No. |
| EU AI Act category (if it applies) | Not assessed, Not in scope, Minimal risk, Limited risk (transparency duties), High risk, Prohibited practice. |
| ISO/IEC 42001 certified? | If Yes, add the expiry date. |
| Last AI terms check | Check once a year, and whenever the supplier announces AI features or changes its AI terms. Use Record AI terms check today. |
| Conditions or notes | Any conditions attached to approval. |
Approving or not approving
- Approve AI use records the date and your name, and sets the last terms check to today if it was blank. If the AI use assessment form applies to this supplier, it's marked approved too.
- Don't approve records the decision and creates a task "AI use not approved for …: agree changes or an alternative" for the AI governance team, assigned to the supplier manager (or Procurement), due in 7 days.
- Once decided, the button changes to Re-approve.
The decision is recorded against the person signed in, and noted in the supplier's activity.
AI use assessment form
If the intake answer to "Will the supplier use AI with our data, or to make or support decisions about people?" is Yes, the supplier must complete the AI use assessment form, approved by your AI governance team. It blocks go-live. It asks the same questions as above plus whether they hold ISO/IEC 42001 certification. Your AI governance team adds the EU AI Act category and any conditions of approval. Suppliers can complete it through the supplier portal.
How the status is worked out
Live means Active, Under review or Offboarding.
| Status | When |
|---|---|
| Green "No AI" | The supplier is recorded as not using AI. |
| Amber "Not confirmed" | Asked, not confirmed: ask whether the supplier uses AI. |
| Red "Act now" | Prohibited AI practice; AI use not approved; your data is used to train AI; high-risk AI without approval; a live supplier using AI without approval; ISO 42001 expired. |
| Amber | AI assessment to approve (not live yet); not known if your data trains AI; decisions about people without a human check; terms never checked or last checked over 12 months ago (live); terms check due within 45 days; ISO 42001 expiring within 45 days. Labelled "Attention" if approved, otherwise "Awaiting approval". |
| Green "Approved" | Approved and none of the above apply. |
Live suppliers that aren't green appear in Needs attention as "AI needs action" (red) or "AI needs attention" (amber).
The AI in use page
- A banner counts suppliers that haven't been asked about AI yet, with links to up to 12 of them.
- The table lists only suppliers recorded as using AI, sorted red, amber, green then by name. Columns: Supplier, Status and why, What the AI does, Models and providers (with where data is processed), Trains on our data, Decisions about people (with or without a human check), EU AI Act, ISO 42001 and Last terms check.
- Search by supplier, what the AI does or provider. Tick Include closed suppliers to see closed ones.
- Edit in place to update details without opening each record. Download spreadsheet (CSV with data location, human check, approval and conditions) and Print.
Effect on risk
Using AI adds 1 point to a supplier's inherent risk, and AI that makes or supports decisions about people adds another. See Third-party risk.
Which plan includes it
AI governance is included from the Professional plan.
Good to know
- Suppliers marked "Asked, not confirmed" don't appear in the table, only in their own record's status.
- SupplierVault records your decisions. It doesn't decide whether an AI use is lawful; check with your legal or data protection lead.
- Clause wording for AI is in the "AI clauses checklist" template under Templates.
Related
- Third-party risk
- Onboarding
- The AI assistant (SupplierVault's own assistant, which is different)