Governance and Defensible Sourcing Decisions

Everything in this course produces inputs to a decision: award, reject, escalate, monitor, exit. This lesson is about making those decisions defensible — to an internal auditor, to a rejected supplier who asks why, and to a regulator examining a due diligence claim.

What Actually Applies

It is worth being precise here, because supplier scoring attracts a lot of imprecise regulatory commentary.

The EU AI Act. General business-to-business supplier risk scoring does not typically fall within the Annex III high-risk categories. Those cover areas such as employment and worker management, creditworthiness assessment of natural persons, education, essential public services, law enforcement, and migration. A system scoring corporate suppliers on financial and delivery risk generally sits outside that list. Two qualifications matter: if your suppliers are individuals or sole traders, a creditworthiness assessment may bring it into scope, and general-purpose AI obligations and transparency provisions can still apply. Claiming your supplier scoring is high-risk when it is not is as much a governance failure as missing an obligation that does apply — it misdirects effort and misstates your position.

GDPR. This one frequently does apply and is frequently overlooked. Supplier due diligence routinely processes personal data: directors, beneficial owners, adverse media about named individuals, sanctions matches against people. You need a lawful basis, the data must be accurate, and individuals have rights including access and rectification. An adverse media hit about a named director held indefinitely, unverified, and acted upon is a data protection problem as well as a fairness one.

Public procurement rules. Where you are a contracting authority, duties of transparency, equal treatment, and proportionality apply to your evaluation process regardless of whether AI is involved. A scoring system whose logic cannot be explained is difficult to reconcile with an obligation to give reasons for an award decision.

Contract and tender terms. Your own tender documentation frequently commits you to an evaluation methodology. Introducing an AI-derived score not disclosed in that methodology is a straightforward breach of your own stated process, and it is the most likely basis for a supplier challenge.

Structural Bias in Supplier Scoring

Supplier scoring models exhibit predictable biases, and they run in a consistent direction: against smaller, newer, and foreign suppliers. These are not exotic edge cases, they are the ordinary behaviour of models built on the available data.

Data availability bias. Larger suppliers file more, are covered more, and appear in more datasets. A model that penalises missing data penalises smallness rather than risk. A twelve-year-old family business with abbreviated accounts and no press coverage is not riskier than a listed company; it is quieter.

Jurisdictional bias. Suppliers in countries with strong registry disclosure produce richer, more current data. Where disclosure is limited, the model sees less and, again, often scores it worse. The effect penalises the jurisdiction rather than the supplier.

Adverse media asymmetry. Media coverage is far denser in some languages and countries than others. A supplier operating where local media is well indexed accumulates more hits, including trivial ones, than an equivalent supplier where coverage is thin — so measured adverse media partly reflects press density.

Historical performance bias. Models trained on your own past supplier performance learn from the suppliers you selected. Suppliers similar to those you have historically favoured score well, which reproduces past selection patterns and works against new entrants and diverse suppliers regardless of merit.

The mitigation is not to abandon scoring. It is to separate absence of data from evidence of risk — these should be distinct outcomes with different responses, not blended into one lower score — and to test the model's score distribution against supplier size, country, and tenure. If small suppliers systematically score worse, establish whether that reflects risk or reflects data availability. Where it is availability, the correct response is proportionate diligence, not exclusion.

The Decision Record

A supplier decision record has three audiences, and a record that satisfies all three is not much longer than one that satisfies none.

The rejected supplier. Can you explain why they were not selected, in terms of the criteria you published? A supplier told they scored poorly on a proprietary composite has been given a number, not a reason, and is likely to challenge.

The internal reviewer. Can they see what evidence was considered, what was screened, what was found, and what judgment was applied on top of the analytics?

The regulator or auditor. Can they see that the steps the applicable regime requires were actually taken, and taken before the decision?

The record that serves all three states: the criteria applied and their source; the analytics used, with the specific tool and what it covered; the screening performed and its results, including clear dispositions; the material gaps and what was done about them; the human judgment applied and by whom; and the date. Crucially it captures the data as it stood at decision time, for the same reason as lesson seven — scores, ownership data, and lists all change, and a reviewer needs to see what you saw.

The failure mode is a record that captures the conclusion and not the basis. "Supplier approved, risk score 84" is a conclusion. It cannot answer any of the three audiences.

Change Control on Scoring Logic

A supplier scoring model is a decision rule, and decision rules need change control.

In practice thresholds and weightings get adjusted informally: a category manager finds the model too conservative, a threshold is nudged, alert volume becomes manageable, and nobody records it. Six months later nobody can say what logic produced a decision made in the interim, which makes every decision in that period unreviewable.

Four controls, none expensive:

• Named ownership of the scoring logic, distinct from the team using it day to day.
• Approval and a record for any change to weightings, thresholds, or data sources, with the reason.
• Versioning, so a decision can be tied to the logic that produced it.
• Periodic revalidation, checking that scores still relate to outcomes — that suppliers scored high-risk actually experience more issues than those scored low-risk. Without that check a model can drift into producing well-formatted noise indefinitely, since the score never announces that it has stopped working.

That last control is the one almost nobody runs, and it is the only one that would detect a scoring model that has quietly become uninformative.