E006—Conduct vendor due diligence

Core - This should include:

- Defining assessment criteria for foundational or upstream AI models. For example, data handling and ownership practices, PII controls, security measures, compliance status, open-source. - Conducting documented assessments. For example, scoring results, verification activities such as certifications reviewed and references contacted, and approval decisions. - Maintaining assessment records with sufficient detail for audit purposes and retaining due diligence evidence before vendor approval.