Supplier due diligence (clause 4.1)

Clause 4.1 requires detailed due diligence before you procure a third-party AI system that will have a material impact on service delivery. It applies whether the AI is the product or is embedded in something broader. The clause asks for four things as a process: request information from the supplier in writing, follow up in writing where needed, record and assess what you were given, and record the extent of any practical testing for fitness for purpose. Open a tool from the Tool Register and the Supplier Due Diligence section sits at the bottom of its record.

​

The six questions

Clause 4.1 sets a minimum of six written questions. guardbook records your supplier’s response to each.

1. Environmental impact of the AI system
2. Stakeholders involved in developing the AI system
3. Compliance with applicable data and confidentiality laws
4. Permissions obtained where data and content relating to individuals were used
5. Accuracy, relevance and diversity of the training datasets, known gaps and bias risks
6. Type and extent of the third-party provider’s liability

Each question has a free-text box for what the supplier actually told you, and a Supplier response marker:

• Provided
• Only limited information
• Not provided

Every question starts as Not provided. Change the marker for each question the supplier did answer. Anything left as Not provided becomes a risk when you sign.

​

Gaps are the point, not a failure

Suppliers frequently answer some of these badly and some not at all. That is expected, and the standard has a rule for it: where a supplier provides no or only limited information, the firm must identify the risks arising from what is missing and record them in the risk register. So marking a question as Not provided is the correct answer when that is the truth. What is not acceptable is marking it Provided when the supplier said nothing useful.

​

Practical testing

A separate required field. Record how far the tool has been practically tested for fitness for purpose at your firm. If you have not tested it, enter “none”. The clause asks you to keep a record of the extent of testing carried out, and “none” is a record. An empty box is not.

​

Draft and sign

Save draft at any point. Signing requires:

• a substantive response, at least 20 characters, for every question marked Provided. Questions marked as a gap need no text
• practical testing completed
• the named accountable person: full name, an RICS designation of AssocRICS, MRICS or FRICS, and a membership number of at least six characters with no spaces
• the accountable person’s full name typed exactly into the confirmation box

Once signed, the record appears in your evidence pack and in the explanation you can give a client under clause 4.4. The signed record is read-only. Resubmit archives it and opens a new draft pre-filled from the old one. Use it when a supplier finally answers a question they previously ducked. guardbook does not close the earlier gap risk for you, so update or close it in your Risk Register. Until you sign the new version, the tool has no signed due diligence, and your evidence pack will show that.