NIST AI RMF, GovernGOVERN 6.1

Applying a vendor product does not remove the need for the same vetting, approval, ongoing validation, decommissioning and documentation as for in-house models; seek adequate technical documentation from the vendor, set policies on selecting, monitoring and retaining vendor models, and develop contingency plans for material models.

The CBJ expects you to evaluate external AI solutions rigorously according to the criticality of the model, to put explicit clauses on responsibilities and liability, data privacy, intellectual property, bias mitigation, explainability and standards, and audit rights into vendor contracts, and to require an AI Bill of Materials from third-party vendors when applicable (section 7.1).

The Commission says that if you use third-party AI systems you should secure sufficient documentation and assurances on model behavior and compliance, and where appropriate consider system redundancy, mechanical monitoring of AI inputs and outputs, and kill switches that can deactivate the AI system under predefined conditions.

Specify in a performing artist's labor contract the conditions and remuneration for any use of their image or voice through AI systems or other technology.

Your AIS Program should address your process for acquiring, using, or relying on third-party data and AI Systems, including due diligence and, where appropriate and available, contract terms for audit rights, cooperation with regulators, prompt written notice of unauthorized access, and clear responsibilities for safeguarding data (guidelines 4.1 to 4.3).

Where you rely on third-party vendors or cloud service providers for AI and ML, conduct due diligence on the provider's reputation in AI, governance, security and data protection practices, include contract provisions for access to relevant information, audit rights and compliance with CBUAE requirements, and remain responsible for outsourced AI functions (Sections 6(e) and 9(a)).

Have the board approve the model risk management policy, set a model risk appetite and receive regular reports on the firm's model risk profile against it, allocate responsibility for the framework to the relevant Senior Management Function holder or holders and reflect it in their Statements of Responsibilities, document roles and responsibilities for each stage of the model lifecycle, and, for third-party vendor models, satisfy yourself that they have been validated to the same standards as your own and validate your own use of them (Principle 2).

If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.

If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model.

If you test with deployers or prospective deployers, inform them of all aspects of the testing relevant to their decision to participate, give them the instructions for use of the system referred to in Article 13, and conclude an agreement specifying your roles and responsibilities to ensure compliance with the provisions for testing in real world conditions and with other applicable Union and national law (Article 60(4), point (h)).

If you collaborate with the police forces on research or testing of AI for police activity, the collaboration must include clauses excluding the sharing of sensitive operational data and your acquisition or use, even indirect, of AI systems, hardware and software, or AI-integrated devices trained for police activity, except where synthetic data or masked or pseudonymised real data is used (art. 4, comma 2).

The collaboration agreement must state who owns the intellectual property in the research results, the derived models, the training data and the software, and the police forces always own models trained on sensitive operational data (art. 4, comma 3).

If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney General

If you license your generative AI system to a third party, require by contract that the licensee preserve this disclosure capability.

If you find that the high-risk AI system you plan to use has not been registered in the EU database, do not use it, and inform the provider or the distributor.

Agree with the operator the conditions for using the data and for making the results available (Section 35/A(8)).