Document control
Document ID: B-034
Author(s): GRC & Compliance Team
Version: 1.0
Date: 09-Nov-2026
Disclaimer:
This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.
| Document Title | Supplier and Third-Party AI Assessments | ||||
|---|---|---|---|---|---|
| Document Id | SecureXcel/AIMS/B-034 | Current Version | 1.0 | Date of Release | 09-Nov-2026 |
| Classification | Internal | Author | GRC & Compliance Team | ||
| Reviewed by | GRC & Compliance Lead | ||||
| Approved by | Management Representative | AI Governance Committee (AIGC) | |||
| Designation |
Revision History
| Version | Date | Author | GRC & Compliance Team | GRC & Compliance Lead | Management Representative |
|---|---|---|---|---|---|
| 1.0 | 30/09/2026 | GRC Lead | GRC Head | AIGC | Initial version |
1. Purpose
This record provides a documented assessment of third-party AI components and services used by SecureXcel AI Services, ensuring that applicable suppliers are evaluated against defined security, compliance, and AI-related requirements. It serves as evidence of supplier due diligence and supports ongoing monitoring of third-party AI suppliers in accordance with the organisation’s supplier management process.
2. Scope
Covers third-party AI models and libraries (from the Approved Software Tools / Open-Source AI Models Register), the URL-reputation API integration named in the SecureXcel AI Services Impact Assessment Report, and security-testing suppliers. General enterprise software (approved source-code repository, approved change and workflow management platform) is out of scope of this AI-supplier record unless it directly supplies or processes data for an AI system.
3. Suppliers Assessed
| Supplier / component | Category | Licence / contract type | Notes |
|---|---|---|---|
| Meta — Llama 3.1 (Llama-3.1-8B-Instruct) | Open-source model | Llama 3.1 Community Licence | Base model, internal pilot use only per the Approved Software Tools register; on-premises air-gapped inference, no data leaves SecureXcel infrastructure |
| Approved open-source embedding / language model | Open-source model | Apache 2.0 | Fine-tuned, on-premises inference |
| Scikit-learn — k-means, Isolation Forest | Open-source library | 3-clause BSD | Trained in-house, on-premises CPU |
| XGBoost | Open-source library | Apache 2.0 | Trained in-house, on-premises CPU |
| Qwen — Qwen3-VL-8B-Instruct | Open-source model | Apache 2.0 | Trained in-house, on-premises CPU |
| Approved external URL-reputation / threat-intelligence service | Third-party service (URL reputation lookup) | Commercial API agreement | Integrated into the CTA (Call-to-Action) Engine for malicious-link detection, per AIIA A.10.3 |
| CERT-In empanelled VAPT auditor(s) | Security testing service | Engagement per audit cycle | Provides external annual VAPT per the AIIA security architecture; internal quarterly VAPT run in-house |
| Third-party takedown partner(s) | Partner integration (Third-Party Takedown API Module) | Partner agreement(s) | Supplier name(s) and agreement references to be confirmed with Vendor Management and added at next register update |
4. Completed Vetting Checklist
Applying the B-008 Appendix C checklist to each supplier above:
| Vetting requirement | Approved third-party foundation model | Approved open-source model | Approved external URL-reputation / threat-intelligence service | CERT-In VAPT partner |
|---|---|---|---|---|
| 1. Documentation commitment (A.6.2.7): model card, licence terms and known limitations available | Pass — public model card and licence | Pass — public model card and licence | Pass — API documentation available | N/A — service, not a model |
| 2. Data governance alignment (A.7.4, A.7.5): data quality and provenance traceable | Pass — no SecureXcel data sent to supplier (on-prem inference) | Pass — no SecureXcel data sent to supplier (on-prem inference) | Review — URLs submitted for lookup; confirm no message content beyond the URL is sent | N/A |
| 3. Responsibility allocation (A.10.2): liability for defects allocated | Pass — open-source licence terms apply | Pass — open-source licence terms apply | Review — confirm liability terms in the commercial API agreement | Review — confirm liability terms in the engagement letter |
| 4. Alignment with prohibited uses | Pass — internal pilot use only, no prohibited use identified | Pass — internal pilot use only, no prohibited use identified | Pass — fraud/phishing detection is the intended use | N/A |
| 5. Ongoing monitoring access (A.6.2.6): logs/telemetry available | Pass — on-premises, full internal telemetry | Pass — on-premises, full internal telemetry | Review — confirm API usage logs are retained per B32 | Pass — VAPT reports retained as audit evidence |
“Review” items above are not failures; they are the specific points Procurement / Vendor Management confirms and closes at the next register update, which is due within 60 days of this issue.
5. Maintenance
- Reviewed whenever a new AI-relevant supplier, model or API is added (also update the AI System Inventory, B28, and Model and Change Register, B30).
- Owner: Procurement / Vendor Management, with the AI System Owner confirming technical accuracy.
6. Compliance with ISO 42001:2023
| Requirement | Where met | Clause |
|---|---|---|
| Suppliers of AI components assessed | Whole document | A.10.3 |
| Responsibilities allocated between supplier and organisation | Section 4, item 3 | A.10.2 |