OUTPUT 01 / SYSTEM
A buyer-readable AI system card.
The system card anchors every answer to one service. It describes intended use, users, customer-facing AI functions, provider role, models and external services, deployment boundary, data flows, retention, human oversight, and known limitations.
The card should identify what the vendor controls, what it inherits from suppliers, and what the customer must configure or govern.
OUTPUT 02 / CLAIMS
An approved answer and claim register.
The register connects each buyer question or recurring claim to an approved answer, source owner, evidence URI, review date, system version, and evidence state. It makes unsupported language visible before it reaches a buyer.
Keep the original buyer wording and the final submitted answer so follow-up questions can improve the reusable library.
OUTPUT 03 / SOURCES
An evidence index that reviewers can navigate.
The index organizes governance decisions, architecture, providers, data records, access controls, AI evaluations, security tests, monitoring, incident response, resilience, change management, and residual risk.
Every artifact needs scope, owner, effective date, review date, access boundary, and a short statement of what it does and does not prove.
OUTPUT 04 / ACTIONS
A gap backlog that engineering and governance can build.
A missing proof item is not automatically a missing control. Classify the gap: absent implementation, absent documentation, stale evidence, ambiguous ownership, scope mismatch, or unapproved language.
Rank gaps by buyer impact and risk. Assign an owner, target date, acceptance criterion, and interim answer. Never silently convert a roadmap item into a current-state yes.
DEFINITION OF DONE
Set acceptance criteria before the sprint starts.
The fixed scope covers one named AI system, one accountable client team, existing source access supplied after kickoff, and one live buyer-review support session. The client validates facts and approves all external representations.
The sprint is complete when the agreed response set, evidence index, prioritized backlog, and handoff package are delivered with visible approval states. It does not include certification, legal opinions, an external audit, penetration testing, or guaranteed buyer approval.
- Required kickoff inputs complete before the clock starts
- Weekly owner review and rapid access to named reviewers
- No invented controls, metrics, test results, or approvals
- Explicit exclusions and change control for expanded scope
FREE / NO EMAIL GATE
AI Procurement Evidence Inventory
Start with the original no-gate CSV, then replace every example row with your own bounded and approved facts.
PRIMARY SOURCES