How to Audit Your AI Suppliers: A Board-Level Checklist for UK Organisations

Under the EU AI Act and the UK's own AI governance framework, the organisation deploying an AI system carries responsibility for its outputs — regardless of whether the system was built in-house or supplied by a third party. If an AI-assisted decision causes harm to a customer, employee, or member of the public, "the supplier did it" is not a defence that regulators or courts will accept.

UK councils face additional exposure under public sector equality duties. An AI system used in benefits processing or planning decisions must be demonstrably fair and human-overseen. If your supplier cannot show you the evidence, you cannot demonstrate compliance.

Every supplier whose platform you use should be able to answer these questions in writing. If they cannot, or will not, that is itself a risk finding.

Does your platform use AI or automated decision-making? Require a specific yes or no answer covering all modules you use, not a generic marketing response.

What data does the AI system process? Identify whether your customer data, employee data, or any regulated data category is used as input to their AI systems.

Where is the AI model hosted and who controls it? Many SaaS suppliers use third-party AI models from providers whose data processing terms may conflict with your own obligations under UK GDPR.

What is your incident response process for AI errors? AI systems produce incorrect outputs. You need to know how your supplier detects, reports, and corrects errors — and whether you will be notified.

What human oversight exists? For any AI system making or informing decisions that affect people, ask how human review is built into the process and who carries accountability when the system is wrong.

What is your EU AI Act compliance position? This is not only relevant if you have EU operations. Suppliers who cannot answer this question are operating AI systems without adequate governance — which is a risk you inherit.

The time to ask these questions is before you sign a contract, not after you have onboarded a platform. Add an AI disclosure clause to your standard supplier terms requiring written confirmation of AI use, data processing, and compliance position before any contract is executed.

Existing suppliers should be audited at the next contract renewal point. Where contracts do not include review clauses, request a meeting to complete the audit voluntarily. Suppliers with good governance practices welcome this. Those with poor practices will resist it — which tells you everything you need to know about their risk management culture.

Simon Steggles is a Fractional AI Director helping UK SMEs and councils build AI governance frameworks that are practical, board-ready, and compliant. Services from £3,500 per month.