Supplier risk monitoring

• Critical and high-risk suppliers are watched continuously against official registers and the licensed sources you choose, matched by company number rather than by name.
• When something changes, the AI reads the source and writes a short summary of what it says, with a link and a quote for every point. It reports what a source says; it never states an allegation as fact or adds its own.
• Alerts are sorted by type and severity against your risk policy, and routed to the supplier's named owner, with sanctions matches going straight to compliance.
• Periodic reviews start from a drafted pack: what changed since the last review, what's missing or expired, and the questions to ask the supplier.
• Modern slavery evidence for high-risk categories is gathered in one place, ready for the annual statement, which people write and the board approves.
• The AI flags; it never suspends, debars, blocks or terminates a supplier. A named person decides, and the decision and its reasons are recorded.

• Home OfficeModern Slavery Act 2015, section 54 (transparency in supply chains)
  →

  Commercial organisations with a turnover of £36 million or more publish a slavery and human trafficking statement every financial year, approved by the board and signed by a director, and can submit it to the government's modern slavery statement registry. The AI gathers and summarises evidence for high-risk suppliers and categories; people write the statement and the board approves it. The government plans to make the content mandatory and add penalties (see On the horizon).

• Cabinet OfficeProcurement Act 2023 (in force 24 February 2025)
  →

  If you sell to the public sector, authorities assess you, and the associated persons you rely on, against the mandatory and discretionary exclusion grounds in Schedules 6 and 7, check the debarment list, and can ask about your subcontractors. Your core supplier information sits on the Central Digital Platform. If you're a contracting authority, monitoring feeds your own checks. Either way, an AI alert is evidence for a person to weigh, never an exclusion decision.

• Home Office and SFOFailure to prevent fraud (Economic Crime and Corporate Transparency Act 2023, in force 1 September 2025)
  →

  Large organisations can be liable for fraud committed by associated persons, including suppliers performing services for them, intended to benefit the organisation. The defence is reasonable procedures, and due diligence is one of the six principles in the Home Office guidance. Continuous monitoring, with recorded decisions, is part of that evidence.

• OFSI and OTSIUK financial and trade sanctions
  →

  Paying a designated person can breach financial sanctions, and OFSI can impose civil penalties on a strict liability basis. Since 28 January 2026 the UK Sanctions List is the only source for UK designations, so screening uses it, not the old OFSI consolidated list. OTSI enforces trade sanctions, which matter for what you import. Possible matches go to compliance the same day; only compliance clears or confirms a match.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Directors, owners and supplier contacts are people. Adverse media about them can be criminal offence data, which needs a condition under Schedule 1 of the DPA 2018. That means a DPIA, screening individuals only where your policy needs it, processing in UK regions, a retention period, a privacy notice that covers screening, and summaries you'd be comfortable disclosing in a subject access request.

• CourtsDefamation and accuracy of what the AI writes
  →

  A summary that misattributes an allegation, or states one as fact, can harm a business or a person who did nothing wrong. Summaries only restate what a cited source says, use 'reported' and 'alleged' where the source does, never generate allegations, and are checked against the source by a grounding check before anyone sees them.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A supplier risk policy that says which suppliers are monitored, against which sources, and which alert types go to whom.
• A named owner for every critical supplier, with a target time to review each alert type.
• A clear escalation route: owner, then compliance and legal, then a supplier risk committee for suspension, exit or reporting decisions.
• A weekly sample check of summaries against their sources, and a fast way for owners to mark a summary wrong.
• A named owner for each source, prompt and risk rule, with change control, and a yearly review of which sources you license.
• Owners trained before go-live on what an alert is and isn't: a lead to check, not a finding.

1. 3 weeks

   Discovery

   Agree the risk policy and alert types, list critical suppliers, confirm their company numbers, and choose and license sources.

2. Gate · must be true to passRisk policy approved, sources licensed, DPIA started, legal and compliance involved.

3. 6–8 weeks

   Pilot

   Monitor 100 critical suppliers in shadow mode: alerts go to a review team, not to owners, and every summary is checked against its source.

4. Gate · must be true to passCitation accuracy at target, alert precision acceptable, no individual's data used beyond the policy, and legal sign-off on summary wording.

5. 4–6 weeks

   Production

   Alerts go live to owners for the pilot suppliers, with workflow, escalation and monitoring.

6. Gate · must be true to passOwners trained, escalation route tested, monitoring and rollback plan in place.

7. Ongoing

   Scale

   Add high-risk suppliers, then subcontractors on public sector contracts, then modern slavery evidence packs by category.

8. Gate · must be true to passEach new supplier group or source passes the same shadow-mode gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The AI matches news to suppliers by name, and a business with a similar name is flagged for something it didn't do.

   How the design avoids it

   Match on company number and known subsidiaries. Name-only hits are marked unconfirmed and never reach an owner as a finding.

2. 2

   Goes wrong

   A summary turns 'was reported to be investigated' into 'committed fraud'.

   How the design avoids it

   Summaries only restate cited sources, keep the source's own hedging, and pass a grounding check. A weekly sample is checked by a person.

3. 3

   Goes wrong

   Owners get hundreds of low-value alerts, and the important one is missed.

   How the design avoids it

   Alert types and thresholds set by the risk policy, severity ranking, and precision tracked and tuned each month.

4. 4

   Goes wrong

   An alert is treated as a decision, and a supplier is dropped without a fair look.

   How the design avoids it

   The AI only flags. A named person decides, with the supplier given a chance to respond where appropriate, and the reasons recorded.

5. 5

   Goes wrong

   The open web is used as a source, so rumours and stale pages feed the summaries.

   How the design avoids it

   Official registers and licensed sources only, each with an owner, and every alert showing its source and date.

1. Going through Parliament
   The Immigration and Asylum Bill (introduced 30 June 2026, at Commons report stage in November 2026) would amend section 54 of the Modern Slavery Act: prescribed statement content, an accuracy statement from the signatory, submission to the government electronically, financial penalties for the first time, and reporting extended to public bodies over a threshold.

   Organise modern slavery evidence by topic now: risk assessment, policies, due diligence, training and effectiveness. Then the statement can follow whatever content the final Act prescribes.

2. November 2026 onwards
   Companies House identity verification: mandatory for new directors and people with significant control since 18 November 2025, with existing ones verifying at their company's next confirmation statement during a 12-month transition that ends in November 2026.

   Companies House data should become more reliable over time, but it's still a register, not proof. Keep it as one source among several, and record when each check was made.

3. Late 2026–2028
   The Cyber Security and Resilience Bill: back in the Commons for Lords amendments. Medium and large managed service providers come into regulation, with duties set by secondary legislation by about 2028.

   Add supplier cyber posture as an alert type for IT and managed service suppliers, and plan for new contract terms. See the supplier cyber assurance playbook.