Supplier Control under prEN 18286: Managing Third-Party Risks in High-Risk AI QMS

Target Audience

Procurement, supply-chain and vendor management professionals working with AI suppliers
AI governance, risk & compliance (GRC) officers responsible for third-party oversight
Quality & assurance leads implementing prEN 18286 Clause 8.4
Data Protection Officers (DPOs) and legal teams drafting supplier contracts
AI engineers and technical leads evaluating foundation models, datasets, tools or cloud providers
Anyone who has completed the prEN 18286 Fundamentals, Overview or QuickStart and now needs to operationalise supplier controls

Duration & Format

Core delivery: 1 intensive day virtual (09:00�16:30 GMT+1, ~7 contact hours)
Delivery style: Hands-on workshop � every participant builds real supplier evaluation scorecards, contract clauses and monitoring plans during the session

Course Overview

Clause 8.4 of prEN 18286 (�Control of externally provided processes, products and services�) is one of the most critical and AI-specific sections of the standard. It requires organisations to evaluate, select, monitor and re-evaluate every supplier of datasets, foundation models, tools, plugins, cloud services or any externally provided component that feeds into a high-risk AI system.

With rising supply-chain attacks (model poisoning, dataset tampering, API compromise, library backdoors), supplier control is no longer optional � it is a mandatory, risk-based process that directly supports Article 17 QMS, Article 9 risk management, Article 10 data governance and Article 15 cybersecurity.

This 1-day practical workshop turns prEN 18286 Clause 8.4 (plus related clauses and Annex guidance) into ready-to-deploy controls. You will leave with customised templates, contractual language, monitoring dashboards and a 30-day supplier oversight plan � everything needed to demonstrate proportionate, auditable supplier control to notified bodies and market-surveillance authorities.

Learning Objectives

By the end of the day, participants will be able to:

Map prEN 18286 Clause 8.4 requirements to the specific risks of AI supply chains (dataset tampering, model poisoning, API abuse, provenance gaps).
Design and apply risk-based supplier evaluation and selection criteria tailored to high-risk AI systems.
Draft enforceable contractual clauses that address AI Act obligations (data quality, bias mitigation, incident reporting, audit rights, termination triggers).
Build ongoing supplier monitoring and re-evaluation processes, including performance KPIs, embedding drift alerts and third-party audit rights.
Integrate supplier controls into the wider prEN 18286 QMS, risk management system and post-market monitoring plan.
Produce a complete supplier oversight evidence package (scorecards, contracts, monitoring logs) ready for internal audit or notified-body review.
Develop a personalised 30-day action plan to bring existing suppliers into compliance.

Course Structure

Morning: Theory to Templates (09:00�12:30)

Clause 8.4 deep-dive + AI-specific supply-chain risks
Supplier evaluation & selection scorecard workshop (live template creation)
Risk-based classification of suppliers (critical vs non-critical)

Afternoon: Contracts, Monitoring & Rollout (13:30�16:30)

Contractual clauses masterclass � AI Act compliant language you can use immediately
Monitoring dashboard and re-evaluation process design
Incident response for supplier breaches (poisoning, leakage, drift)
Personalised 30-day rollout plan + full evidence package review

Teaching Methods

Live template-building workshops (scorecards, contracts, monitoring plans)
Real-world case studies (third-party model poisoning, dataset tampering incidents)
Group exercises and peer review of drafted supplier controls
Downloadable toolkit: supplier scorecard, contract clause library, monitoring template, 30-day checklist

Prerequisites

Recommended: Completion of the prEN 18286 Fundamentals or Overview course
Alternative: Basic familiarity with EU AI Act Article 17 and supply-chain concepts
Participants are encouraged to bring one real supplier relationship (model vendor, dataset provider or cloud service) for the exercises

Key Takeaway

This intensive 1-day workshop turns prEN 18286 Clause 8.4 from a regulatory requirement into a practical, defensible supplier oversight programme. You leave with immediately usable templates, contract language and a 30-day action plan that protects your high-risk AI systems from third-party risks while satisfying notified-body expectations under the EU AI Act.