> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# E006: Conduct vendor due diligence

export const InlineClock = ({city, timeZone}) => {
  const [time, setTime] = useState('--:--:--');
  useEffect(() => {
    const update = () => setTime(new Intl.DateTimeFormat('en-US', {
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
      hour12: false,
      timeZone
    }).format(new Date()));
    update();
    const id = setInterval(update, 1000);
    return () => clearInterval(id);
  }, [timeZone]);
  return <div className="aiuc-footer-clock">
      <span className="aiuc-footer-clock-city">{city}</span>
      <span className="aiuc-footer-clock-time">{time}</span>
    </div>;
};

Establish AI vendor due diligence processes for foundation and upstream model providers covering data handling, PII controls, security and compliance

<div className="aiuc-requirement-overview">
  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-taxonomy">
    <div className="aiuc-requirement-overview-group">
      <div className="aiuc-requirement-overview-label">Keywords</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Vendor Due Diligence</span>
        <span className="aiuc-requirement-overview-pill">Open-Source</span>
        <span className="aiuc-requirement-overview-pill">Foundation Models</span>
        <span className="aiuc-requirement-overview-pill">Upstream Models</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-details">
    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Application</div>
      <span className="aiuc-requirement-overview-pill">Mandatory</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Frequency</div>
      <span className="aiuc-requirement-overview-pill">Every 12 months</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Type</div>
      <span className="aiuc-requirement-overview-pill">Preventative</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Capabilities</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Universal</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-crosswalks">
    <div className="aiuc-requirement-overview-label">Crosswalks</div>

    <div className="aiuc-requirement-crosswalk-grid">
      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">EU AI Act</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="EU regulation classifies AI systems by risk levels (minimal, limited, high, unacceptable) with corresponding compliance obligations" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/eu-ai-act" title="This article states that before selling a high-risk AI system, importers must ensure it meets all regulations. This includes checking that the system has passe…">Article 23: Obligations of Importers</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that before selling a high-risk AI system, distributors must ensure it meets certain standards, including having a CE marking and a copy of…">Article 24: Obligations of Distributors</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">ISO 42001</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="International standard for AI management systems (AIMS) covering responsible AI development and deployment" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/iso-42001" title="The organization shall establish a process to ensure that its usage of services, products or materials provided by suppliers aligns with the organization's app…">A.10.3: Suppliers</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">NIST AI RMF</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="US government framework for managing AI risks throughout the AI lifecycle with four core functions: Govern, Map, Measure, Manage" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/nist-ai-rmf" title="Internal risk controls for components of the AI system including third-party AI technologies are identified and documented.">MAP 4.2: Internal risk controls</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">OWASP Top 10</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Curated list of the most critical security threats to LLM and generative AI systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/owasp-top-10" title="LLM supply chains face risks in training data, models, and platforms, causing bias, breaches, or failures. Unlike traditional software, ML risks include third-…">LLM03:25 - Supply Chain</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">CSA AICM</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Cloud Security Alliance’s AI Controls Matrix provides security controls framework specifically designed for AI/ML systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/csa-aicm" title="Establish, document, approve, communicate, apply, evaluate, and maintain policies and procedures for supply chain risk management. Review and update the polici…">STA-01: Supply Chain Risk Management Policies and Procedures</a>
          <a href="/crosswalks/csa-aicm" title="Develop and maintain an inventory of all supply chain relationships.">STA-08: Supply Chain Inventory</a>
          <a href="/crosswalks/csa-aicm" title="Periodically review risk factors associated with supply chain relationships.">STA-09: Supply Chain Risk Management</a>
          <a href="/crosswalks/csa-aicm" title="Service agreements must incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope, characteristics and location of business rela…">STA-10: Primary Service and Contractual Agreement</a>
          <a href="/crosswalks/csa-aicm" title="Review supply chain agreements at least annually, or upon significant changes.">STA-11: Supply Chain Agreement Review</a>
          <a href="/crosswalks/csa-aicm" title="Define and implement a process for conducting internal assessments to confirm conformance and effectiveness of standards, policies, procedures, and service lev…">STA-12: Supply Chain Compliance Assessment</a>
          <a href="/crosswalks/csa-aicm" title="Implement policies requiring all service providers throughout the supply chain to comply with information security, confidentiality, access control, privacy, a…">STA-13: Supply Chain Service Agreement Compliance</a>
          <a href="/crosswalks/csa-aicm" title="Periodically review the organization's supply chain partners' IT governance policies and procedures.">STA-14: Supply Chain Governance Review</a>
          <a href="/crosswalks/csa-aicm" title="Define and implement a process for conducting security assessments periodically for all organizations within the supply chain.">STA-15: Supply Chain Data Security Assessment</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">OWASP AIVSS</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="OWASP AI Vulnerability Scoring System enables organizations to quantify how agentic capabilities amplify security risks" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/owasp-aivss" title="Compromised models, libraries, or third-party tools">Agent Supply Chain and Dependency Risk</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">IBM AI Risk Atlas</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Comprehensive taxonomy of risks associated with ML models, GenAI, and AI Agents from IBM Research" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Determining AI agents' compliance is complex and there might not be enough information to assess whether the agentic AI system is compliant with applicable leg…">IBM 16: Agentic AI - AI agent compliance</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Data provenance refers to the traceability of data (including synthetic data), which includes its ownership, origin, transformations, and generation. Proving t…">IBM 34: Training Data - Uncertain data provenance</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Terms of service, license compliance, or other IP issues may restrict the ability to use certain data for building models.">IBM 39: Training Data - Data usage rights restrictions</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Terms of service, licenses, or other rules restrict the use of certain models.">IBM 88: Non-Technical - Model usage rights restrictions</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">Cisco AI Security Framework</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Comprehensive AI threat landscape taxonomy identifying 19 attacker objectives with 150+ subtechniques from Cisco" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/cisco-ai-security-safety-framework" title="Actors manipulate an agent system to introduce or executive unauthorized agent instances, malicious agent code, or fake agent capabilities by inserting mislead…">AITech-4.1: Agent Injection</a>
          <a href="/crosswalks/cisco-ai-security-safety-framework" title="Actors insert malicious code, backdoors, or vulnerabilities into third-party dependencies, plugins, extensions, or libraries used by models/agents/AI applicati…">AITech-9.3: Dependency / Plugin Compromise</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">OWASP Agentic Top 10</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Curated list of the most critical security threats to autonomous AI agent systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/owasp-agentic-top-10" title="Compromised tools, plugins, MCP services, model APIs, datasets, open-source packages, and external agents introduce vulnerabilities that agents may unknowingly…">ASI04 - Agentic Supply Chain Vulnerabilities</a>
        </div>
      </div>
    </div>
  </section>
</div>

<section className="aiuc-requirement-control-evidence">
  <div className="aiuc-requirement-control-evidence-headings">
    <h2>Control activities</h2>
    <h2>Typical evidence</h2>
  </div>

  <div className="aiuc-requirement-control-evidence-group">
    <div className="aiuc-requirement-control-evidence-label">
      <span>Should include</span> <span className="aiuc-help-marker" data-tooltip="Organizations must demonstrate core controls to meet the requirement. Auditors may accept alternative implementations that achieve equivalent outcomes." tabIndex="0">?</span>
    </div>

    <div className="aiuc-requirement-control-evidence-row">
      <div className="aiuc-requirement-card aiuc-requirement-control-card">
        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Defining assessment criteria for foundational or upstream AI models.</strong> For example, data handling and ownership practices, PII controls, security measures, compliance status, open-source.</p>
        </div>

        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Conducting documented assessments.</strong> For example, scoring results, verification activities such as certifications reviewed and references contacted, and approval decisions.</p>
        </div>

        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Maintaining assessment records with sufficient detail for audit purposes and retaining due diligence evidence before vendor approval.</strong></p>
        </div>
      </div>

      <div className="aiuc-requirement-card aiuc-requirement-evidence-card">
        <div className="aiuc-requirement-evidence-title">E006.1 Documentation: Vendor due diligence</div>
        <p>Vendor assessment records showing evaluation criteria, scoring results, verification activities, approval decisions with accountable leads, and retained evidence supporting the assessment. May include vendor questionnaires, security reviews, compliance documentation, or due diligence reports.</p>

        <div className="aiuc-requirement-evidence-meta">
          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Category</div>
            <a href="/evidence/operational-practices">Operational Practices</a>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Typical location</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Vendor Contracts</span>
              <span className="aiuc-requirement-evidence-pill">Internal processes</span>
            </div>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Capabilities</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Universal</span>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>

  <p className="aiuc-requirement-alternative-evidence">Organizations can submit alternative evidence demonstrating how they meet the requirement.</p>
</section>

<div className="aiuc-footer">
  <span className="aiuc-footer-corner aiuc-footer-corner-tl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-tr">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <div className="aiuc-footer-strip">
    <span className="aiuc-footer-mono">37.782274° N -122.392147° W</span>
    <span className="aiuc-footer-strip-center">FIG. A (SITE INDEX)</span>

    <span />
  </div>

  <div className="aiuc-footer-row-main">
    <div className="aiuc-footer-wireframe-cell">
      <svg className="aiuc-footer-wireframe" fill="none" stroke="currentColor" strokeWidth="0.4" viewBox="0 0 200 150">
        <rect height="130" width="180" x="10" y="10" />

        <rect height="40" width="60" x="20" y="20" />

        <rect height="40" width="40" x="90" y="20" />

        <rect height="40" width="40" x="140" y="20" />

        <rect height="60" width="60" x="20" y="70" />

        <rect height="60" width="90" x="90" y="70" />

        <line strokeDasharray="2,2" x1="20" x2="180" y1="65" y2="65" />

        <line strokeDasharray="2,2" x1="85" x2="85" y1="20" y2="60" />

        <circle cx="50" cy="40" r="6" />

        <circle cx="110" cy="40" r="6" />

        <circle cx="160" cy="40" r="6" />
      </svg>
    </div>

    <div className="aiuc-footer-wordmark-cell">
      <div className="aiuc-footer-wordmark">Artificial Intelligence Underwriting Company</div>
    </div>

    <div className="aiuc-footer-clocks">
      <InlineClock city="SFO" timeZone="America/Los_Angeles" />

      <InlineClock city="NYC" timeZone="America/New_York" />

      <InlineClock city="LON" timeZone="Europe/London" />
    </div>
  </div>

  <div className="aiuc-footer-row-sub">
    <div className="aiuc-footer-codeblock-cell">
      <div className="aiuc-footer-codeblock">
        <span className="aiuc-footer-codeblock-header">Code</span>
        <span className="aiuc-footer-codeblock-header">Structural unit</span>
        <span className="aiuc-footer-codeblock-code">a.</span>
        <span className="aiuc-footer-codeblock-text">AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.</span>
        <span className="aiuc-footer-codeblock-code">b.</span>
        <span className="aiuc-footer-codeblock-text">Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.</span>
        <span className="aiuc-footer-codeblock-code">c.</span>
        <span className="aiuc-footer-codeblock-text">Crosswalks to AI regulations, standards, and security frameworks.</span>
        <span className="aiuc-footer-codeblock-code">d.</span>
        <span className="aiuc-footer-codeblock-text">Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.</span>
      </div>
    </div>

    <div className="aiuc-footer-columns-cell">
      <div className="aiuc-footer-columns">
        <div>
          <div className="aiuc-footer-column-header">I. Standard</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/">Overview</a></li>
            <li><a className="aiuc-footer-column-link" href="/crosswalks">Crosswalks</a></li>
            <li><a className="aiuc-footer-column-link" href="/evidence">Evidence</a></li>
            <li><a className="aiuc-footer-column-link" href="/changelog">Changelog</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">II. Learn</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/learn/about">About AIUC-1</a></li>
            <li><a className="aiuc-footer-column-link" href="/learn/contribute">Contribute</a></li>
            <li><a className="aiuc-footer-column-link" href="/scoping">Scoping</a></li>
            <li><a className="aiuc-footer-column-link" href="/faq">FAQ</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">III. Office</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/consortium">Consortium</a></li>
            <li><a className="aiuc-footer-column-link" href="/contact">Contact</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/privacy">Privacy policy</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/terms">Terms of use</a></li>
          </ul>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-footer-strip-bottom">
    <span className="aiuc-footer-mono">100</span>
    <span>© AIUC — ALL RIGHTS RESERVED</span>
  </div>

  <span className="aiuc-footer-corner aiuc-footer-corner-bl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-br">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>
</div>