# OUT-09 Vendor contractual requirements

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-09

Vendor agreements with model providers and tool providers explicitly address training-data use, data residency, breach notification, model-update notification, and right to audit or attestation evidence.

Vendor agreements with model and tool providers explicitly address training-data use, data residency, breach notification, model-update notification, and right to audit or attestation evidence. These contractual requirements ensure that the organization's data protection, provenance, and change-management obligations can be met even when the underlying capability is provided by a third party.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-09: Vendor agreements covering the required terms exist for all material providers; agreements are reviewed at contract renewal; compliance with key terms is verified at a documented cadence.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Vendor agreements covering the required terms exist for all material providers.
- Agreements are reviewed at contract renewal.
- Compliance with key terms is verified at a documented cadence.

## Framework mappings

- NIST AI RMF: MAP 4.1, MEASURE 1.3
- ISO/IEC 42001: A.7.6
- OWASP LLM Top 10: LLM03
- SOC 2 (TSC): CC2.2
- EU AI Act: Art. 10(2)
- Singapore: MAIGF Trusted Development and Deployment, AI Verify Transparency

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by OUT-05 Model provider inventory: https://humanintel.net/standard/out/out-05
- Cited by MAS-09 External agent trust boundaries: https://humanintel.net/standard/mas/mas-09

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-09 Vendor contractual requirements. Public review edition, July 2026. https://humanintel.net/standard/out/out-09