Risk-Tiering Data Suppliers: Which Vendors Need a Full Review

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why proportionate review beats one questionnaire for every vendor

Proportionate review puts scarce reviewer time on the suppliers whose data can actually hurt you, and treats the rest as routine. Bank regulators have used this model for years: the 2023 interagency guidance from the Federal Reserve, FDIC and OCC expects due diligence and oversight to be commensurate with the risk and complexity of each third-party relationship [1][2]. The same reasoning fits data procurement, where a vendor of synthetic product images and a vendor of call-center transcripts should not get the same full questionnaire packet.

A single-depth process fails in two ways. Either every supplier gets the full packet, and low-risk purchases stall, or everyone gets the short form, and a dataset with unremoved account numbers clears review. NIST AI RMF 1.0, the current framework as of October 2026 (NIST reports a revision is underway), asks organizations to manage risks from third-party data and components as part of governing AI systems, which gives a documented tiering method a ready home in your AI governance records [3].

The five factors that set a supplier's tier

A supplier's tier comes from the data and the deal, not from the vendor's brand or size. Score each factor 0 (low), 1 (moderate) or 2 (high).

Personal data. Does the dataset relate to identifiable people, directly or through linkable fields such as customer IDs, device IDs, free-text notes or voice? Under GDPR Recital 26, data falls outside data protection rules only if a person can no longer be identified using the means reasonably likely to be used [5]. The ICO frames this as a risk assessment and suggests the motivated intruder test as a starting point [6]. "Pseudonymized" CRM exports with stable hashed emails should score 2, not 0.

Sensitivity. Health, biometric, financial account, precise location, children's data and privileged legal material raise the score. Children's data is a clear example: the amended COPPA Rule had a compliance date of April 22, 2026 [7], so any dataset that may contain under-13 users' data warrants deeper provenance questions. The DPIA criteria in WP248 rev.01 (sensitive data, vulnerable data subjects, large scale, matching or combining datasets) are a useful cross-check even outside the EU [4].

Intended use. An internal benchmark scores lower than fine-tuning a model that customers query, and a model whose outputs can regurgitate training text scores highest. Use also determines which license scope you need, so tie this factor to the permitted-use language you expect to negotiate.

Volume and recurrence. A 5,000-record one-time sample is easier to inspect than a 40-million-row monthly feed whose schema can drift. Recurring supply multiplies exposure, because each new drop can introduce fields that the first review never saw.

Delivery model. How the data moves changes the security review. A one-off transfer over an access-controlled bucket with audited downloads scores lower than a persistent API connection into your environment, or a feed that requires the supplier to hold credentials to your systems.

Tier-to-review mapping: what each tier actually requires

Each tier should trigger a named, finite set of reviews, so the requester knows the cost of their request on day one. The mapping below sums the five factor scores (0 to 10) and applies two override rules.

Illustrative example: invented to show structure; it does not describe an available dataset.

Override rules: any regulated category (health records, children's data, biometrics, financial account data) goes straight to Tier 1, whatever the total. A supplier that cannot document how the data was collected, or by whom it was consented, also goes to Tier 1, because a missing answer is itself a high score.

For the questionnaire content at each tier, the FISD Alternative Data Council's data provider DDQ, updated in 2024 with generative AI questions, is a widely used starting template [8]. Market commentary on 2025 DDQ responses summarizes recurring data vendor risk signals that are worth weighting in your scoring [9]. Our data provider due diligence questionnaire shows how to cut the template down for Tier 3 suppliers.

A worked tiering decision

Scoring a real request shows where the overrides earn their place. Suppose an applied AI team wants five years of B2B support tickets (subject, body, agent notes, product SKU, resolution code) to fine-tune a customer-facing support assistant, delivered as monthly Parquet drops.

Illustrative example: invented to show structure; it does not describe an available dataset.

The rationale line in the record would read: "Tier 1 on score; free-text personal data and customer-facing use; re-test de-identification on each monthly drop." If the same team later restricted use to an internal evaluation set with a one-time 10,000-ticket sample, the score would fall to 4 and the purchase would sit in Tier 2.

Re-tier on change, not on the calendar alone

A tier is valid only for the facts it was scored on, so re-score when any factor moves. Common triggers include a new field in a recurring feed, a move from evaluation to training, a new model that faces customers, a change in the supplier's own upstream sources, and a switch to a different delivery path.

Schema drift is the trigger reviewers miss most often. A supplier adds a customer_notes column to a feed scored as non-personal, the pipeline ingests it automatically, and nobody re-runs the privacy review. Build a check into ingestion that compares each drop's schema against the reviewed schema and blocks on new columns. ISO/IEC 5259-4 gives a process framework for data quality across the data life cycle that you can align these checks to [10].

Calendar reviews still help as a backstop. Many teams re-confirm Tier 1 suppliers annually and Tier 3 suppliers only at renewal; whatever cadence you pick, record it next to the tier. If a supplier relationship ends, the switching guide covers how to move without breaking lineage.

Document the rationale so the tier survives an audit

A tier with no written reason will be challenged later, usually after an incident. Keep one record per supplier and dataset, not per vendor, because one vendor can sell a Tier 3 dataset and a Tier 1 dataset.

Minimum fields for the tiering record:

• Supplier, dataset name and version, and requesting team
• Score per factor, with the evidence used (sample file name, DDQ answer reference)
• Overrides applied and why
• Assigned tier, required reviews, and who signed off on each
• Re-tier triggers and the next scheduled review date
• Exceptions granted, the approver, and an expiry date

Store the record with your AI system documentation so model owners, auditors and counsel see the same facts. The training data due diligence checklist lists the evidence a Tier 1 review should collect, and the pre-acquisition risk assessment guide covers scoring the dataset itself rather than the supplier.

How tiering fits a sourced-data purchase

Tiering works best when the supplier side already produces the evidence each tier asks for. When SourceX sources operational datasets from US companies on request, every dataset is rights-reviewed for ownership and consents and delivered under a license that defines the records, uses, term and delivery. Diligence materials covering source, rights, preparation and allowed use are prepared for each dataset, which maps directly onto the evidence fields in a Tier 1 or Tier 2 record.

Personal details such as names, emails, phones and account numbers are removed or replaced before delivery, the method is recorded, and a sample is checked; no method is perfect, so your own re-identification test still belongs in Tier 1. Delivery runs through private, access-controlled workflows only after an executed agreement and supplier approval. You can describe the data you need to the SourceX buyer team and run your own tiering on what comes back. For the end-to-end purchase process, start at the AI training data procurement hub.

Get data sourced for your tiered review

SourceX sources operational datasets from US companies on request and manages licensing and ongoing purchases, with every release approved by the supplying company. Each dataset arrives with rights review and diligence materials you can use as evidence for any tier. Tell the SourceX buyer team what data you need.