4. Third-party Ecosystem

A. Fundamental RAI-specific criteria (e.g., compliance to policies / regulations) in place for selecting third-party partners

A. Documentation of detailed criteria aligned to key RAI principles (e.g., fairness, explainability)

A. Criteria to select third-party partners are regularly updated to reflect evolving standards and best practices (e.g., ensuring compliance of third-party's supply chain), and are incorporated as part of the overall selection process

AND
B. Third-party partners are required to submit self-assessments on their RAI practices (e.g., internal training programs in place for their employees) during the selection process (as required)

AND
C. Comprehensive view of the third-party ecosystem

A. Existing and future contracts (that are applicable) are required to have clauses designed with RAI principles in mind

AND
B. Verification of third-party claims about RAI practices is conducted through suitable assessments or certifications

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. Starting to think about formal protocols or guidelines for third-party data handling and management, with reactive approach to data issues

A. Documented protocols and guidelines for third-party data handling and management with basic data protection requirements (e.g., GDPR, CCPA)

A. Consistent evaluation of third-party data handling and management practices through questionnaires, audits, or certifications (as required)

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. Siloed use of monitoring and auditing processes with some periodic reviews or audits for applicable third-party partners, addressing most issues reactively

AND
B. Initial development of reporting mechanisms with focus on improving detail and consistency

A. Audits of applicable third-party partners scheduled at consistent intervals, particularly following version updates to third-party products

AND
B. Reporting mechanisms in place, but rely on periodic rather than continuous monitoring

A. Monitoring and auditing processes are established (in real-time, using tools as required), with immediate mitigation of any significant identified third-party risks (e.g., risks from updates to third-party products)

AND
B. Reporting provides clear insights into third-party performance at regular intervals that match the pace at which associated risks emerge