{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"AI Governance","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-14","description":"Govern supplier relationships that provide AI systems, components, or data through a documented process that verifies supplier alignment with the organization's responsible-AI requirements. Ensure the organization's responsible development and use of AI considers customer needs and expectations, and provide customers with the information they need to use AI systems responsibly. Retain supplier evaluations and customer communications as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"AI Governance","guidance":[],"members":[{"control_id":"A.10.3","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.10.4","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"E006","coverage":"partial","delta":"assess foundation and upstream model providers against explicit data-handling, PII-control, security, and compliance criteria, and retain the due-diligence evidence","framework":"aiuc-1","relationship":"intersects_with"}],"statement":"Govern supplier relationships that provide AI systems, components, or data through a documented process that verifies supplier alignment with the organization's responsible-AI requirements. Ensure the organization's responsible development and use of AI considers customer needs and expectations, and provide customers with the information they need to use AI systems responsibly. Retain supplier evaluations and customer communications as evidence.","title":"Manage responsible AI with suppliers and customers","unified_id":"UC-AI-14"},"id":"uc:UC-AI-14","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-14","sourceIds":["aiuc-1","iso-42001"],"sourceUrl":null,"title":"UC-AI-14 — Manage responsible AI with suppliers and customers","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:254a973c44f526141714557d5fc1a3b22fc0fd41d3c1f275f8eb79b3a4cfc78b","properties":{"rationale":"Supplier-alignment governance mitigates the vendor lock-in and ethical-exposure the emerging-tech adoption risk names.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-strategic-innovation-emerging-tech-025a931b.json","targetId":"risk:strategic-innovation-emerging-tech","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4746f726ca42899e12c82606705973809f9ec547fb6c7126256ccf7ff504038e","properties":{"rationale":"Verifying supplier alignment and evaluating AI suppliers is the direct control against backdoored/compromised third-party models, data and provider concentration.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6350b10e2b49ef13e41a2bda66b9bc49cd6456729146b8450a14bd838bd47e64","properties":{},"sourceDetailPath":"/data/v1/records/wf-g1-14bc355c.json","sourceId":"wf:G1","targetDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","targetId":"uc:UC-AI-14","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7253efa1cf03494d97c7deb695251f2702932af2763430ad7d7a451fbae5c477","properties":{"control_id":"A.10.4","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-10-4-fb62881c.json","targetId":"ctrl:iso-42001:A.10.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:73eabbd49ef8768c825eabfa0a2f752c1ffb584843834ec8d45c76a6dce4a9e6","properties":{"control_id":"A.10.3","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-10-3-ab692346.json","targetId":"ctrl:iso-42001:A.10.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:87243083e287079021d3db3a8b8a212afe8de29351e04e6d13124956be3ec35f","properties":{"rationale":"Governing supplier-provided data verifies its quality before it is used in models.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-poor-training-data-quality-95872765.json","targetId":"risk:ai-poor-training-data-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9a5105a347165d25ae8d5a13d9b6be3a3e0feeea9c38686bcd280c2b403f2210","properties":{},"sourceDetailPath":"/data/v1/records/wf-r14-7e8a3e13.json","sourceId":"wf:R14","targetDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","targetId":"uc:UC-AI-14","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ad87d00947f292fb318324aa72b131a1b8c125d69a4a403aa5c92b87ce61c7ad","properties":{"rationale":"Supplier vetting reduces backdoored or poisoned third-party models and components entering the pipeline.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-adversarial-poisoning-attacks-ea7df068.json","targetId":"risk:ai-adversarial-poisoning-attacks","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dadba8095e99ffd7e92198bac506ab1dd4ad19cf0bb742d44e096f3eba524948","properties":{"control_id":"E006","coverage":"partial","delta":"assess foundation and upstream model providers against explicit data-handling, PII-control, security, and compliance criteria, and retain the due-diligence evidence","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e006-362f564d.json","targetId":"ctrl:aiuc-1:E006","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e15d5339038dbda4e2e476ff11a6fa9dddcc48cb6e56d2d1e25f8e0d368492d5","properties":{"rationale":"Supplier evaluations and customer communications allocate and evidence responsibility across the relationship.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fe5fb2d0b9f833028d3ee5649b061fff395c489c09f35e09e21775ff96e85cb6","properties":{},"sourceDetailPath":"/data/v1/records/wf-d59-b3ddf606.json","sourceId":"wf:D59","targetDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","targetId":"uc:UC-AI-14","type":"tests"}],"schemaVersion":1}