Please explain your processes for managing AI as our supplier

It should be a routine contract renewal. But as part of the process, your customer has sent a standard letter asking for details on two key questions:

Do you use AI when processing our data and, if so, how is that protected?
How do you ensure you don’t pass AI risk to us via your products / services?

Such letters are increasingly common and when one arrives is not the best time to be just starting to think about these questions. Your customer is looking for a plan and also evidence that it has been operating for some time. A document that was downloaded from the Internet yesterday probably won’t cut it.

Why your customer asked

Many companies, particularly larger ones, are required by their regulators,
shareholders or boards to formally review their AI risk. Their internal processes they can control, but attention is increasingly moving towards the supply chain. Large companies don’t want to import AI risk from their suppliers. So, they need evidence that reasonable steps are being taken, there is a clear process should something go wrong and, if there are gaps, at the very least there is a credible plan to address them.

Why you should care

Enhanced vendor management that takes into account AI is increasingly being deployed as a mandatory requirement. You may have a long-standing supply arrangement with a major customer but that can be put on hold, or worse, cancelled if your company is deemed to be a risk. Typically companies will provide perhaps two weeks to respond to a request. That is plenty of time to respond if you have done the groundwork but very unlikely to be sufficient if you are starting from scratch (particularly if the company is looking for evidence of ongoing management).

What you need

The processes are broadly the same for all AI management projects and will resonate with organisations that have formal data protection processes in place.
Typically you will be required to demonstrate: 

You know what AI is in your business (most companies underestimate this. It’s not just the AI your IT department has deployed but also the AI embedded in existing products, and the “shadow AI” – essentially any AI the business has not sanctioned, including cloud-based AI services being used unofficially by staff, particularly the free ones)

You know which AI services touch your customer’s data, and on what terms – where the data goes, who can see it and whether it can be used for training. This is usually the first thing a customer asks. 
You have identified, recorded and actively manage your risks. A properly managed risk register is normally central to this. 
You have processes in place that provide clear lines of ownership and responsibility. Knowing exactly who approves what is key here. There is a clear incident management process if something were to go wrong. When an incident is reported at 10pm on a Friday night is not the time to be making up your response as you go along. 
You can evidence that these processes are reviewed (properly, not just upping the revision number on a document once a year). For example, you might be expected to show the new risks that have been added and the ones that have been changed or removed. 
Your staff know their responsibilities around AI. A customer will want confidence that if they share confidential data with you, it won’t appear on a public AI chatbot because someone used it to make an appealing presentation.

For large companies, this can be a substantial activity. For smaller organisations, it can be much simpler but still effective. The important thing is to be able to demonstrate that you have at least something in place and that it is actively managed, not just written and parked on a shelf. And be honest: your answers may end up in the contract, so a gap with a credible plan is far better than a claim you can’t back up.

Your customers will increasingly ask you to demonstrate that you have appropriate AI governance processes in place.
While it may not appear urgent, this is an area where preparation now saves huge heartache later. Two weeks is not long enough to be able to demonstrate a coherent AI management process.
AI governance is not optional. While the trigger may be a letter from your customer, having pragmatic AI governance will be a “must have” for all businesses large and small, both for internal risk management and for broader compliance. If you have not done so, now is the time to start.

To explore further

Take a look at our Resources page with many  other helpful articles on AI and governance

Try our tools and solutions

Discover Akili’s tools and solutions designed to help you understand,
assess and govern AI with confidence.