Suppliers & Third-Party Risk (ISO 42001 Annex A.10.3)

Maintain the vendor master list, perform inherent vs residual 5×5 risk assessments via the staged workflow, and manage the four Phase 2C deepening dimensions: sub-processor chains (GDPR Art. 28), evidence attachments (DPAs / SOC 2 / ISO certs), AI system linkage, and canonical review scheduling.

Where it lives

Open Governance → AIMS Scope & Context → Suppliers.

Available on Professional and Enterprise tiers when ISO 42001 is enabled for your organization.

Open the deepening drawer

From the Suppliers list, click the open icon on a supplier row to open the deepening drawer. The drawer has four panels:

Sub-processors — record the supplier's downstream processors with role, region, country, DPA on-file flag, DPA link, and active/retired status.
Evidence — two stacked panels:
- Uploaded files — upload real binary files (PDFs, DOCX, images, ZIPs; 25 MB max each) such as DPAs, SOC 2 reports, and certifications. Files are stored in a private storage bucket at<org_id>/<supplier_id>/<file>, hashed server-side (SHA-256), and downloaded via short-lived (5-minute) signed URLs. Upload and delete are restricted to OrgAdmin and WorkflowAdmin; everyone in the org can view and download.
- Linked Documented Information records — attach existing Documented Information entries (DPAs, certifications, assessment reports, contracts) with a link_type tag for cross-module traceability.
AI Systems — map the supplier to the AI systems they underpin with asupplier_role (Model Provider / Data Processor / Hosting / Fine-Tuner / Integrator / Other) for blast-radius reporting.
Review — pick a review cadence (Weekly / Monthly / Quarterly / Semi-annual / Annual / Custom days) and use Mark reviewed today to stamplast_reviewed_at and compute next_review_due via the canonical scheduling helper.

Audit codes

Every action emits an org-scoped audit row mirrored to the platform log:

SUBPROCESSOR_ADDED / SUBPROCESSOR_UPDATED / SUBPROCESSOR_REMOVED
SUPPLIER_EVIDENCE_LINKED / SUPPLIER_EVIDENCE_UNLINKED — Documented Information links
SUPPLIER_FILE_EVIDENCE_UPLOADED / SUPPLIER_FILE_EVIDENCE_DOWNLOADED /SUPPLIER_FILE_EVIDENCE_DELETED — binary files in thesupplier-evidence bucket. Downloads are emitted automatically by the canonical signed-URL issuer.
SUPPLIER_AISYSTEM_LINKED / SUPPLIER_AISYSTEM_UNLINKED
SUPPLIER_MARK_REVIEWED — distinct from the existing Stage-2 workflow codeSUPPLIER_REVIEWED to avoid collision.
SUPPLIER_REGISTER_EXPORTED — reserved for future register-level exports.

KPIs

The deepening helpers expose a single roll-up consumed by the Suppliers tab:

Total / Active suppliers
Suppliers with at least one sub-processor / evidence link / AI system link
Overdue and due-soon review counts
DPA coverage % — share of active suppliers with a DPA on file either on their own record or via at least one sub-processor.