Vendor AI disclosure request

What it is

The Vendor AI disclosure request is the artifact that satisfies RUAIH focus area 3 — Risk and bias reduction — at the control level.

Who signs it

Supply chain, counter-signed by the AI committee.

A document without a signature is a draft. An assessor is checking that someone with authority put their name to it.

What an assessor asks for

A standard question set, answered in writing, retained with the contract. Blanks are a finding.

What goes in it

• Intended use and the populations the tool was developed on
• Known risks, biases and limitations
• How the tool was tested and validated, and by whom
• Bias detection performed during development
• Whether the vendor will tune or validate against a local sample
• Monitoring and retraining cadence, and how you are notified of a model update
• Subprocessors and data flows
• HTI-1 source attributes where the tool is a predictive decision support intervention

The most common failure

Sending it after selection. Its value is as a discriminator between finalists, and a vendor who cannot answer it is telling you something you needed to know before the contract.

Where this sits

See the RUAIH crosswalk for how this control maps across CHAI’s playbooks and the NIST AI RMF.