This chapter serves one activity: buying AI, binding the supplier to terms the buyer can check, deciding where a service may come from and run, and being able to leave. The tools are mostly artefacts, that is, records, schedules and annexes that the earlier volumes define (a vendor assessment record, a sovereignty requirements profile, an operations annex), with a small number of methods (the exit test, the injected-test clause, the choice of an operating model) and four third-party standards and frameworks (Gaia-X, the Cloud Sovereignty Framework, OpenAPI and AsyncAPI). They come from AI Governance (2, Nordqvist, 2026), AI Platform and Security (3, Nordqvist, 2026), AI Red Team (4, Nordqvist, 2026), AI Threat (5, Nordqvist, 2026), The Transformed Security Architect (6, Nordqvist, 2026), AI Boss (7, Nordqvist, 2026), AI Blue (8, Nordqvist, 2026), AI Purple (9, Nordqvist, 2026) and AI Operations (10, Nordqvist, 2026), and with Architecture as Code (1, Nordqvist, 2025) for interface contracts.
The tools sit on a line from the tender to the exit, drawn in Figure 9.1. Before award the buyer states what it needs and records what it received; in the contract it makes the terms testable; in operation it re-assesses when the supplier changes something and samples what the supplier's AI does; at exit it relies on a plan whose last test has a date and a result. The series' recurring claim is that a clause without a control that checks it is a promise the organisation cannot verify (2, Nordqvist, 2026). The entries below are therefore read as pairs: the clause or requirement, and the evidence that shows it holds.
Laws are not tools and are not entered here. Where an entry rests on an instrument (the AI Act, DORA, NIS 2, the Data Act, Directive 2014/24/EU) the originating book attributes the statement to the article, and this chapter repeats the attribution as that book gives it, as an architectural implication and not as legal advice. The EU model contractual AI clauses, published by the Commission's Public Buyers Community for pilot use in two versions, one for high-risk AI systems and one for other systems (63, European Commission, 2023), are the nearest thing to a shared contract vocabulary; AI Governance describes them as a schedule of AI-specific terms and not a complete contract, and that is how they are treated here.
Primary topics explored
- How the tools relate
- Procurement and vendor assessment
- Operational contract annexes
- Sovereignty assessment
- Exit and concentration
- Interface and data contracts
About Tools
Tools is a companion to The Transformed Architecture. It collects the tools that Books 1 to 10 describe in one reference, organised by what the practitioner is doing: artefacts (templates, manifests, records), own tools, third-party tools and standards, and methods. Each entry says what a tool is for, when to use it, what it needs and produces, and where the book that defines it explains the reasoning. The book covers choosing, adopting and retiring tools, architecture and delivery, governing AI, securing and testing, operating, agents and autonomy, and people, organisation and society, for European enterprises and public authorities. It comes with a template library, an inventory, three web tools and the Toolbox Maturity Method.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss, AI Blue, AI Purple and AI Operations.
Architects and security architects, CIOs and CISOs, platform and operations leads, heads of governance, risk, compliance and third-party risk, AI governance and AI platform teams, red, blue and purple team leads, boards and management bodies, procurement and vendor managers, supervisors and auditors, works councils and unions, data protection officers, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 9: Supplier, Contract and Sovereignty Tools in Tools gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Governing AI” and is one of 29 drawn from the manuscript.