Due diligence on your suppliers' AI

Almost every supplier is now an AI supplier. The CRM summarises calls, the claims platform suggests a reserve, the HR system ranks applicants, and each of them arrived as a feature in a release note rather than as a new contract. For a regulated firm, that means a question it has to answer for every one of them: before we rely on this, do we know what it does, what it touches, and who signed it off?

Most teams answer it with a questionnaire, sent as a spreadsheet, chased by email, scored by hand and filed somewhere. It works until someone asks for the record. Deliverd now does the whole of it in one place, as AI suppliers under Agent governance, alongside the AI system register and the ICT third-party register you already keep there.

How it works

1. You classify, not the supplier. The Service Owner answers your own internal questions about how you will use the service: is AI really being consumed, how sensitive the data is, how much the output matters to customers and decisions, how much a person still controls. Fixed rules turn the answers into a class and an internal risk tier, named as your question set names them, with the reasons beside them.
2. The supplier gets the questions its class calls for. A low-risk use gets a short set, or none at all; a high-risk use gets the full one. The supplier answers as a guest of your organisation, from a link, with no account to create: a determination and an explanation with references to their evidence for each question, saved as they type.
3. You assess every answer. Each one is marked Satisfactory, Exception, Remediation required or Pending evidence or review. An exception or a remediation needs an owner and a target date, so nothing open is left without a name on it.
4. The tier routes the sign-off. The result goes for approval to whoever the tier names: a business owner for a low tier, a working group or a committee above it, or several reviewers in turn and side by side. Your question set decides the route, and the sign-off is an ordinary Deliverd approval, answered in Slack, Teams, email or the app, with who decided and when kept on it.
5. A date to look again. Every sign-off sets a review date, offered from the tier, or from the contract's end in the ICT register if that comes sooner. Open exceptions at sign-off make it Approved with conditions rather than a clean approval.

The lines it holds

The supplier never assigns the class. Their answers are evidence you assess, question by question. Nothing a supplier writes changes your classification. Once the questions have gone out, your internal answers are fixed, because a different class would have asked different questions; a changed classification is a new assessment.

A person decides. The classification is the Service Owner's judgement about your own use, so an API key or an agent is refused every write. An agent can help with plenty around it. It does not get to say how risky its own supplier is.

The law is read on its own. You can record an EU AI Act reading for the supplier's service, separately from your internal tier. Where your question set says so, a high-risk or prohibited reading, or a critical function recorded against the supplier in the ICT register, moves the assessment to its highest class whatever the internal answers say. A low score never suppresses a legal finding. For a prohibited practice, nothing goes to the supplier at all: the next step is Legal.

The rules do not drift. The classification is a pure function of the answers, and the question set's version is stored with every assessment, so the same answers give the same class today and when someone looks at the record years from now.

Reassessing

A decision is not the end of it. You can reassess a supplier for a Contract renewal, a Material change, a Scheduled due-diligence refresh or an Incident. A reassessment starts from the earlier answers, and the decided assessment stays as it was, marked as reassessed, so the history of every supplier's AI is there in order. When a review date passes, the assessment says so.

Your own questions

Every firm's due diligence questions are its own: written by its risk and legal teams, mapped to its policies, and argued over for months. We did not want to replace them with ours. So AI suppliers runs on your organisation's own question set, with your classes, your scoring, your routes and your wording, agreed with you and set up for your organisation. If you would like to try it, get in touch and we will set one up with you.

It is part of Compliance Mode on the Business and Enterprise plans, and the governance guide has the details.