Control A.10.3: Suppliers
Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly.
What control A.10.3 asks
Set up a process so that the services, products or materials the organization obtains from suppliers fit its approach to developing and using AI systems responsibly.
Why it matters for privacy
A supplier can change a model, a retention period or a subprocessor without telling you. The contract and the review are the only controls that reach it.
Where the draft lands: treatment through the contract. Most AI systems depend on a supplier. The draft's treatment of privacy risk has to reach the supplier relationship.
Basis for A.10.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Treating the risk: data and third parties.
Evidence for control A.10.3
This is the evidence an auditor or a privacy reviewer asks to see. For control A.10.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Suppliers Supplier selection and requirements process scaled to what each supplier provides and its risk
- Suppliers Supplier monitoring and evaluation records
- Suppliers Integration documentation for supplied AI components
- Suppliers Corrective action requests to suppliers and supplier-provided documentation
Where control A.10.3 commonly fails
- Supplied models integrated without documentation
- No corrective action route when a supplier's system misbehaves
What to do about control A.10.3 before the draft lands
Add privacy terms to AI supplier contracts: data use, retention, subprocessors, model change notice, audit rights and deletion on exit. Review the supplier at a fixed interval.
The requirement for control A.10.3 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.10.3
- Control A.7.2, Data for development and enhancement of AI system
- Control A.7.3, Acquisition of data
- Control A.7.4, Quality of data for AI systems
- Control A.7.5, Data provenance
← Control A.10.2 | Control A.10.4 →
Open the full index. The public record behind control A.10.3 shows the scope and the lifecycle.
Source for control A.10.3: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.