Suppliers: the value chain, agreements and the IFU handoff

AI systems rarely live with one party. The EU AI Act sets out a chain of responsibility — provider → importer → distributor → deployer — with obligations handing off along it, and Art. 25(4) expects a provider of a high-risk system and the third parties supplying it with tools, components or services to agree in writing the information, capabilities, access and support the provider needs to meet its own obligations. Suppliers (under Do the work) is the register of those third parties.

The register

One row per supplier — model providers, processors, hosts — with its kind, where the processing happens, whether a written agreement is on file, its status (Active · Under review · Offboarded) and its next review date. The header counts how many suppliers have no written agreement, because that is the gap Art. 25(4) and GDPR Art. 28 both name. New supplier opens the form: name, kind, what you use them for, where the processing happens (this feeds the transfer question), the agreement link, contact and review date.

Three regimes read this one register: Art. 25(4), GDPR Art. 28 (the processor contract) and, if you run the ISO/IEC 42001 programme, its supplier controls. A supplier is entered once.

What the supplier states about itself

Aria can read what a supplier states on its own website: the homepage and at most five of its trust, security, privacy, legal, DPA and sub-processor pages. It prepares the facts it finds, each with the sentence that says it and a link to the page, plus anything to look at (no DPA page, no sub-processor list, no EU residency option). Nothing is saved until an admin or compliance manager approves it on the supplier's page. A certification is shown as stated by the supplier, never as held.

Aria does this when a supplier it proposed is approved onto the register. For any other supplier, an admin or compliance manager presses Research this supplier on the supplier's page. Aria starts from the supplier's website on its register entry, or from Veritome's list of common suppliers if the entry has none. With neither, add the website first. While Aria reads, the page says so; the facts appear for review, usually within a minute. If the website cannot be read (it is down, or asks automated readers to stay away), the page says that too.

Facts read more than 90 days ago show Checked dd.mm.yyyy · Check again. Checking again reads the pages afresh and prepares a new set for approval, which replaces the saved facts when approved. Each workspace can start 20 supplier readings a day. Each reading you start uses one Aria request from your monthly allowance, whether or not you approve what it found; the reading Aria starts when it adds a supplier you approved counts only once you accept something Aria prepared.

The supplier record and its assessment

Opening a supplier shows the facts, the systems that depend on it, the controls that satisfy the supplier duties, and an append-only list of assessments. An assessment is six questions, each citing what it answers: the written agreement (Art. 25(4)); whether processing stays in the EU/EEA or a transfer mechanism is in place (GDPR Art. 44); the sub-processor list and change notice (GDPR Art. 28(2)); documented and reviewed security measures (GDPR Art. 32); agreed incident and breach notification terms (Art. 73 and GDPR Art. 33); and whether the supplier's use of your data for its own model training is excluded or governed (Art. 10). The outcome — Approved · Conditional · Rejected — is recorded with a summary and a next-review date, and the record is never edited afterwards.

Article 13 — instructions for use (IFU)

Providers of high-risk systems must give deployers instructions for use: what the system does, its capabilities and limitations, the human oversight it expects, its accuracy and known risks, and how to keep it running safely. The IFU is the operating manual the deployer relies on to use the system lawfully — and, under Art. 26(9), the information a deployer shall use when carrying out its GDPR data-protection impact assessment.

• If you are the provider — work the Art. 13 obligation in the drawer; it links to the printable Art. 13 IFU package, which lays out provider identity, intended purpose and the Art. 13(3) elements as a clean A4 document (Cmd/Ctrl+P). Hand it to your deployers; the same package appears on Documents as the Instructions for use row.
• If you are the deployer — the engine gives you the receiving obligations (Art. 26(1): use the system in accordance with its instructions) and, where you are running a GDPR DPIA, the drawer's reuse card reminds you that Art. 26(9) tells you to draw on those instructions.

Article 23 — importers

If you bring a non-EU provider's high-risk system into the EU market, Art. 23 makes you verify, before placing it, that the provider has carried out the conformity assessment (Art. 43), drawn up the technical documentation (Art. 11), affixed the CE marking (Art. 48), issued the EU declaration of conformity (Art. 47) and appointed an authorised representative (Art. 22). The engine generates each check as its own obligation on the importer's record, with a structured form for the provider's details, the authorised representative, the CE marking date, the declaration reference and the market-placement date.

Article 24 — distributors

Distributors must check the CE marking, the declaration of conformity and the instructions for use are present before making a high-risk system available, and must not make one available they have reason to think is non-conformant. The checks appear automatically as obligations when your role is distributor — no configuration needed.