Skip to content

Lifecycle & third parties

Third parties & value chain: what AI regulations require

Supplier contracts, shared responsibilities, processors.

16 requirements · 10 regulations · 7 checks

Requirements by regulation

EUAI Act2

EX-026

Value chain Art. 25

EX-031

GPAI obligations Art. 53

EUDORA1

DORA-28

ICT third-party risk: register of information, clauses, exit strategy Art. 28-30

EUNIS21

NIS2-21

Cyber risk-management measures, incl. supply chain Art. 21

EUPLD1

PLD-08

Substantial modification (retraining, fine-tuning): becoming a manufacturer Art. 8(2)

USNIST AI RMF5

GOVERN-6.1

Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights. GOVERN

GOVERN-6.2

Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk. GOVERN

MAP-4.1

Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights. MAP

MAP-4.2

Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented. MAP

MANAGE-3.1

AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented. MANAGE

COColorado AI Act1

CO-02

Documentation to deployers (risks, data, evaluations) §6-1-1702(2)

USUS federal1

USF-04

Procurement: data rights, lock-in prevention, performance M-25-22

BRPL 23382

BR-16

Value-chain cooperation Arts. 18 §3, 32

BR-17

General-purpose and generative AI Arts. 29, 30

INTLISO 420011

ISO-A.10

Third-party and customer relationships A.10

Checks in this theme

Most shared first

Code	Check	Used by
CHK-THIRDPARTY-POL	Policies address third-party AI/data risks, incl. IP, transparency and testing	DORA RGPD ISO 42001 NIS2 NIST AI RMF US federal
VER-026-F-01	Contractual responsibilities documented between provider and third parties	AI Act PL 2338 RGPD ISO 42001 PLD
VER-031-G-02	Documentation for downstream providers compliant with Annex XII	AI Act PL 2338 SB 53
VER-026-D-01	Role qualification analysis (provider/deployer/distributor) carried out	AI Act PLD
CHK-THIRDPARTY-CONTINGENCY	Contingency/redundancy for high-risk third-party failures and ongoing third-party monitoring	DORA NIST AI RMF
CHK-COMPONENTS	Legal risks and internal controls for AI components, incl. third-party, are identified	NIST AI RMF
NEW-DORA-02	AI vendor listed in the DORA register of information	DORA

Related themes

Post-deployment monitoring Incidents & corrective action Authorities & registration Intellectual property

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.