Procurement, Vendor Management and Open Models

All courses / AI Governance / Module 2 / Chapter 7

Learning objectives

After the lesson the participant can:

• Explain how Article 25 of the AI Act can make a purchasing organisation the provider of a high-risk AI system.
• Design vendor due-diligence questions that ask for an artefact and name the obligation each supports.
• Identify where lock-in hides in AI and the control that contains each form.
• Review a draft model-supply contract against the clause table, marking each clause present, a gap or missing, with its enforcing control.

Key concepts

Artefacts rather than assurances

The remedy for weak vendor assessment. The schema records what the organisation has received, not what the vendor has claimed; a model card is an artefact, a statement that the vendor follows responsible AI principles is not.

Evaluation set as specification

Under Article 42 of Directive 2014/24/EU an authority cannot specify a named vendor's model. The versioned test cases and acceptance thresholds are therefore the lawful way to express a requirement that would otherwise be a brand name.

Register of information

The register of all ICT contractual arrangements that Article 28 of DORA requires financial entities to maintain. For a bank or insurer, the vendor assessment schema is its source for AI providers.

Exit strategy

A document in the repository that names each dependency, the replacement path, the estimated time and the evidence that the path has been exercised. The chapter states that an exit strategy never rehearsed is a hope.

Open-weight versus open-source AI

Many models called open have downloadable weights but restrictive licences and no description of training data. The Open Source AI Definition also requires sufficiently detailed training data information, complete training and inference code, and the parameters.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Mode 0 is the case procurement most often misses, because no purchase takes place. Which of your existing software agreements would let a supplier switch on an AI feature without notice?
2. Hansa Mutual records a clause as a gap when it cannot verify it through its own gateway, evaluation service or evidence pipeline, even if the wording is acceptable. What would that rule do to your current contracts?
3. Open-weight models offer control at the price of competence and infrastructure, proprietary models capability at the price of dependency. For which of your use cases does each side of the trade-off weigh most?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Why is the evaluation set, according to the chapter, more than a quality tool for a public authority?

   1. Because it replaces the conformity assessment the provider would otherwise perform
   2. Because the AI Act requires deployers to publish it with the tender documents
   3. Because it lets the authority negotiate the price after the award decision
   4. Because it is the lawful way to express a requirement that would otherwise be a brand name
   Show the answer

   D. Because it is the lawful way to express a requirement that would otherwise be a brand name
   Article 42 of Directive 2014/24/EU requires specifications in performance or functional terms. The authority must specify what the system must do and how well, so the evaluation set carries the requirement a brand name cannot.

2. The AI Act exempts providers of general-purpose AI models released under a free and open-source licence from some documentation duties. Whose relief is that, as the chapter puts it?

   1. The downloading organisation's, which is thereby not a deployer
   2. The provider's, not the downloading organisation's
   3. Both parties', as long as the model is self-hosted in the Union
   4. Neither party's, once the model is used in production
   Show the answer

   B. The provider's, not the downloading organisation's
   The relief under Article 53(2) is the provider's. Deploying the model in a high-risk system still makes the organisation a deployer, and modifying and rebranding it may make it a provider under Article 25.

3. In Hansa Mutual's review of draft v3 of the agreement with Model Provider Alpha, what was the outcome?

   1. Not ready for signature, with 4 clauses missing and 8 gaps
   2. Approved with a time-limited exception owned by the platform head
   3. Ready for signature, subject to an on-site audit within a year
   4. Rejected, with the provider replaced by a self-hosted model
   Show the answer

   A. Not ready for signature, with 4 clauses missing and 8 gaps
   The checklist ends with the outcome not ready for signature: 4 MISSING and 8 GAP, with a re-review after draft v4. Examples are the 30-day update notice against a required 90 and the missing training content summary.