Supplier, Contract and Sovereignty Tools

All courses / Tools / Module 3 / Chapter 9

Learning objectives

After the lesson the participant can:

Assess a model provider by recording what was received, not what was claimed.
Draft tender requirements that each state a verification the buyer can run and a consequence on failure.
Distinguish the model-origin assessment, the sovereignty requirements profile and the sovereignty decision matrix by the decision each supports.
Design an exit plan with triggers, a second source and a dated exit test.

Key concepts

Vendor assessment record: An artefact of AI Governance, Chapter 7, that assesses a model provider against AI Act and contract criteria and records, per artefact, whether it was received. A missing artefact blocks the contract or becomes a recorded exception with an owner.
Procurement security requirements annex: A versioned tender annex, family SECREQ, in which every requirement has an identifier, a level (mandatory or weighted), a catalogue link, a verification with an owner and a consequence on failure.
Operations annex: An annex to a managed-service contract, family OPA, from AI Operations: change notice, incident transparency, observer rights, a provider AI declaration with sampling, a stop right, a test calendar and an exit with a transition period.
Model-origin assessment record: A record, family GEO, that scores a model or provider across five categories: legal access, continuity, behaviour, supply chain and regulatory. The overall rating is the highest category score, not the average.
Exit and substitution plan: A plan, family EXIT, that keeps a second source ready so that a sanction, ruling or supplier failure is an operational event and not a crisis. The exit test gives the plan evidence: a date, an elapsed time and a quality gate.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Supplier and sovereignty artefacts by identifier

Match each identifier family of Chapter 9 with the artefact it names.

Interactive exercise 2 · Scenario

A feature nobody bought

Choose what the procurement lead should do, following the chapter's section across the usage modes.

Teaching plan

15 min	Present Figure 9.1, the supplier lifecycle with exit test, and the five families. Open with the observation of AI Governance that buying AI is buying an obligation.
20 min	Read the tender annex for a supplier boundary (requirements S4.1 to S4.5) and the annex MS-2. Participants identify the test the buyer can run without the supplier's cooperation.
15 min	Teach sovereignty and exit: the assessment GEO-2026-017 of Hansa Mutual, the profile for tender NR-2026-031 of Nordvik Region, and the three definitions of the exit plan.
30 min	Exercise: groups write four testable requirements and an exit plan outline for one AI supplier.
10 min	Groups exchange requirements and try to find one that cannot be verified by the buyer; the room rewrites it.

Discussion

In the model-origin example, how a model is run mattered more than where its developer is established. What does that imply for a policy that bans suppliers by country?
AI Purple says a clause that lets the provider tell its staff which alerts are tests is not an injected test. Why does this clause most often fail in negotiation, and what is lost when it does?
Mode 0 is the case procurement most often misses because no purchase takes place. What change control would catch a supplier switching on an AI feature in an existing product?

Written exercise

Exercise · 30 minutes

Testable requirements and an exit plan for one supplier

Choose one supplier of an AI service to your organisation, or the supplier of Nordvik Region's benefits-triage system at renewal. Write four requirements in the form of the procurement security requirements annex: identifier, level (mandatory or weighted), the control it links to, the verification the buyer can run and its owner, and the consequence on failure. Make one requirement put the stop path outside the supplier. Then outline an exit and substitution plan: the triggers, the second source, what must be portable (prompts, evaluation suite, data), the drilled switch time you would aim for, and the date and form of the first exit test.

Deliverable: A four-row requirements annex with verification and consequence per row, and a one-page exit plan with triggers, second source and a scheduled exit test.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

How is the overall rating of a model-origin assessment record derived from its five category scores?
Show the answer
A. It is the highest category score, not the average
The chapter states that the overall rating is the highest category score, not the average; the record gives a score and a rationale for each of the five categories.
In the sovereignty requirements profile, which requirements are made mandatory?
Show the answer
C. Only what the legal analysis makes non-negotiable; everything else is weighted
Only what the legal analysis makes non-negotiable is mandatory; everything else, including a Gaia-X self-description, is weighted, which keeps the tender open to competition. A mandatory failure excludes the tender.
Which requirement does the first item of the worked procurement security requirements annex for Nordvik Region set?
Show the answer
D. Named stop holders can suspend the ranking function without the supplier's staff or software taking part
In the worked example the first requirement puts the stop path outside the supplier: named stop holders can suspend the ranking function without the supplier's staff or software taking part, verified by a drill at acceptance and in operation.