As of 13 August 2026, AI can only partly assess the risk of using a supplier.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your procurement brief and write down the supplier's service, contract value, criticality, access to data or systems, required start date and the risk criteria your organisation uses.
   2. Gather the supplier questionnaire, proposed contract, latest available accounts, insurance details, relevant certifications, policies, business continuity information, references and any public company information.
   3. Remove unrelated personal data and mark each document with its source, publication date and version before attaching or pasting it into the chatbot.
   4. Paste the prompt with the procurement brief and supplier material, then ask the chatbot to produce the cited risk register, missing-evidence list and provisional recommendation.
   5. Open each cited source and compare the risk register's factual claims, dates and page references with the original documents, correcting any unsupported or misquoted entry.
   6. Send the missing-evidence and clarification questions to the supplier, then add the replies and replacement documents to the chatbot for a revised assessment.
   7. Ask the procurement owner and the relevant finance, information security or legal specialist to check the high-impact risks, then record the human decision, controls, owner and review date in your procurement file.

   Prompt

   Assess the risk of using the supplier described in the material below. This is a UK business procurement decision. Do not invent facts, infer compliance from silence, or treat a supplier claim as verified unless the supplied evidence supports it.
   
   Produce:
   1. An executive summary with a provisional risk rating of low, medium or high, clearly labelled as provisional.
   2. A table of risks with these columns: risk area, evidence, source and page or section, what is missing, likelihood, impact, proposed mitigation, owner, and confidence.
   3. Separate factual findings from judgement and assumptions.
   4. Identify contradictions, expired documents, vague claims and evidence that needs independent confirmation.
   5. List the most important questions to send to the supplier.
   6. State what evidence would change the provisional rating.
   7. Recommend one of: proceed, proceed only with controls, request more information, or do not proceed. Give reasons and do not present the recommendation as professional advice.
   
   Use only the supplied material and clearly labelled public information. Quote or cite the relevant source for every material factual claim. If the evidence is insufficient, say so. Do not assign a risk rating solely because a document is missing. Do not make legal, financial, cyber-security or technical compliance conclusions beyond what the evidence supports.
   
   Supplier and contract context:
   [PASTE THE PROCUREMENT REQUIREMENTS, CONTRACT VALUE, SERVICE CRITICALITY, DATA ACCESS, DEADLINES AND INTERNAL RISK CRITERIA]
   
   Supplier material:
   [PASTE OR ATTACH THE SUPPLIER QUESTIONNAIRE, CONTRACT, ACCOUNTS, CERTIFICATES, POLICIES, REFERENCES AND OTHER EVIDENCE]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.