Third-Party AI Risk Assessment

AI That Works · AI6 Guidance

AI6-T03.4

Assessment Form — Pillar 03

Document No.	AI6-T03.4	Version	[1.0]
Document Owner	[Name / Role]	Date	[DD/MM/YYYY]
Review Date	[DD/MM/YYYY]	Status	[ Draft / In Review / Approved ]
Organisation	[Organisation Name]

Complete one assessment for each AI vendor or integrator before contract execution. Repeat annually, or when the vendor makes a material change to their system. Assessment findings must inform contract terms and the Enterprise AI Risk Register.

1. Vendor Details

Vendor / integrator name and ABN

[Name] · ABN [XX XXX XXX XXX]

AI system(s) being assessed

[System name, version, intended use]

2. Assessment Criteria

Assessment Area	Evidence Provided?	Adequacy Rating
Pre-deployment testing documentation	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Known limitations and failure mode disclosure	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Data residency and processing location	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Security certifications (ISO 27001, SOC 2, etc.)	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Incident notification procedures	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Model update and change notification policy	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]
Privacy Act compliance and OAIC alignment	[ Yes / No / Partial ]	[ Adequate / Requires improvement / Inadequate ]

3. Assessment Outcome

Overall risk rating

[ Acceptable — proceed to contract | Conditional — proceed subject to contract requirements | Unacceptable — do not engage ]

Conditions or contract requirements arising from this assessment

[List specific obligations to be included in the vendor contract based on gaps identified above]

Assessment completed by

[Name] · [Date]

Approved by

[Name] · [Date]