Every bot depends on things you didn't build. The model it runs on. The connectors to your email and files. Maybe a template you started from. Those are your suppliers.
ISO has a lot to say about suppliers. Some of it carries over. Some doesn't, and it's worth being honest about that.
External providers in ISO
ISO covers externally provided processes, products and services. An organization should:
- decide what controls to apply to suppliers
- evaluate and select them based on their ability to deliver
- monitor their performance
- make sure what they deliver meets requirements
In a plant, that can mean supplier audits, incoming inspection and scorecards.
Your bot's suppliers
| Supplier | What it provides | What can change |
|---|---|---|
| The model provider | The intelligence | New versions, prices, behavior |
| Connectors | Access to email, calendar, files | Permissions, features, outages |
| Built-in tools | Search, code execution | Results, limits |
| Templates | A starting set of instructions | Whatever the author wrote |
| Other people's bots | Answers, handoffs | Anything |
What carries over
Selection. You choose a model for the job, the way you'd choose a supplier. See Competence: right model, right tools.
Incoming inspection. You check what comes in. Search results get a source check. A template gets read before you use it. Output from another person's bot gets treated as information, not instructions.
Monitoring. You notice when a supplier changes. Model providers publish release notes. xAI keeps a release notes page, for example (docs.x.ai). When a model you rely on changes, retest your bots.
Fencing. You limit what each supplier can touch. A connector gets only the access the job needs. See Tools and connectors.
What doesn't carry over
Here's where bots differ, and it's a real difference.
- You can't audit a model provider's plant. There's no visit, no process review, no corrective action request with a deadline. You get published docs and the behavior you can test.
- You can't see inside the model. A supplier's process can be inspected. A model's reasoning can be tested from outside, but not opened up.
- Output varies. A supplier's part is made to a drawing. A model's answer varies from run to run. Incoming inspection becomes ongoing testing, not a one-time approval.
So control over these suppliers is limited to three things: choosing, testing and fencing. That's still a lot. It's just not the same as supplier quality management.
Templates and other people's bots
Starting from someone else's template can save time. Read it like you'd read a contract. It might include rules you don't want, tools you don't need, or habits that don't fit. Once you adopt it, it's your work instruction. You own it.
Treat answers from other people's bots the way you'd treat an email from an outside company: useful information, not orders.
What this means for you
- List your bots' suppliers: model, connectors, tools, templates.
- Choose each one for the job.
- Check what comes in.
- Watch release notes and retest after changes.
- Fence each supplier's access.
You can't audit your model. You can manage how you depend on it.