A Responsible Procurement Charter, but for AI

The format already exists in the supply chain

Our customers sell ingredients into the biggest brands in cosmetics, personal care, and wellness. When L'Oréal, Unilever, or Henkel onboard a new ingredient supplier, the supplier signs a Responsible Procurement Charter. The document is short, specific, and uncomfortable in places. It commits the supplier to rules about labour, sourcing geography, sustainability, sub-supplier disclosure, and annual review. The supplier signs it, the brand signs it, and the document is treated as binding.

Procurement teams read these documents for a living. They know the format. They know what a good one looks like. They know which sections vendors typically water down and which they lean on.

When the same procurement team is asked to assess a software vendor's AI policy, the document they receive looks nothing like what they are used to reading. It is twelve pages of principles. It mentions an AI ethics committee. It uses the word 'ongoing' six times. There is no signature line. There is no consequence section. There is no name on it.

We borrowed the supplier charter format. The post is the argument for why that format is the right one for AI, and what changes when you actually use it.

What a Responsible Procurement Charter actually contains

Anyone who has signed an ingredient supplier agreement with a tier-one consumer brand already knows the shape. For everyone else, the short version:

• A statement of rules the supplier commits to. Not preferences. Rules.
• A list of exclusions: practices, materials, geographies, or end-uses the supplier will not engage in
• Sub-supplier disclosure: every party in the chain that touches the goods, named in writing, updated when it changes
• Audit rights: how the brand can verify the supplier is doing what it says, and how independent parties (often third-party auditors) confirm specific claims
• Geographic restrictions on sourcing, where relevant: which countries the goods may come from and under what conditions
• A named signatory, usually the supplier's CEO or country head. A real person. Not a department
• An annual review and re-signing, with material changes notified in advance

Every line in that list has a direct counterpart in the AI vendor question. The reason most vendor AI policies do not look like this is that the vendor wrote the document for an internal ethics review or an investor question rather than for the procurement reader who actually evaluates it.

The translation, section by section

Here is the line-by-line mapping, in the same order. None of these translations are forced. The procurement question and the AI question are the same question pointed at different supply chains.

Start with labour practices. A sourcing charter commits the supplier to specific conditions about how the goods are produced: no forced labour, no child labour, working hours, wage floors. Translate that to AI and you get the training-data policy: a hard, written commitment about how the data your customers send the vendor will and will not be used. The standard rule is that customer data is never used to train any provider's models. Procurement wants this stated as a rule with a name behind it, not as a value.

Next, geography. Supplier charters often restrict sourcing to countries that meet specific regulatory or ethical standards. The AI version of geography is the region of inference: a commitment about which jurisdictions the customer's data is processed in. At Corial we publish that as a tier choice between US-routed under Standard Contractual Clauses and an EU residency tier that routes every AI call through Vertex AI EU. The argument for that choice is in our earlier post on EU residency.

Then audit rights. In a sourcing charter, the brand reserves the right to verify the supplier's claims: third-party auditors, certifications, periodic inspections. The AI equivalent is independent third-party transparency assessments. Stanford runs the Foundation Model Transparency Index. MLCommons runs the AILuminate safety benchmark. A vendor that cites these by score, including the unfavourable ones, is doing the audit-rights equivalent. A vendor that publishes its own ethics rating is doing the marketing-rating equivalent. Procurement knows the difference.

Then sub-supplier disclosure. A supplier charter requires a list of every party in the chain. For AI vendors that becomes the sub-processor list: every third party that processes customer data, named, with category, with country, and with a notice period before any change. Thirty days is the common standard. Anything that hides the chain breaks the format.

Finally, the annual social audit. In sourcing, it's the once-a-year confirmation that the commitments are still being met. The AI version has two layers: an annual re-signing of the charter itself, plus a more frequent review of the model card where the providers and regions are listed. Quarterly is a reasonable cadence for the model card because the underlying model landscape moves faster than the policy framework around it.

Rules, not preferences

The single most important difference between a procurement charter and a typical AI ethics page is the verb. The procurement charter says 'will not'. The ethics page says 'aims to', 'seeks to', 'considers', 'is committed to ongoing dialogue with'. The verbs in the ethics page are doing the work of softening the commitment so the document does not have to be enforced.

Procurement reads verbs. It treats 'will not' as a hard commitment with consequences if breached. It treats 'aims to' as a preference. A document full of preferences does not survive a procurement review because the procurement team cannot use it as a basis for anything.

When we wrote section 2 of the Corial Responsible AI Charter, the section is titled 'What we will not do' and every line is a hard rule. No customer data goes into provider training. No deployment for military, surveillance, or political-influence use cases. No production traffic to a provider that refuses to disclose training data sources or safety practices. No messages sent on a customer's behalf without the customer reading and approving the draft first. No quiet routing changes: if a provider changes, the public sub-processor list updates with at least thirty days of notice.

Founder-signed beats committee-issued

Procurement charters in the supply chain world are signed by a named human, almost always at the CEO or country-head level. They are not signed by an ethics committee. The reason is structural: a committee can change membership and dilute responsibility. A name on a page is more accountable than a department on a page.

Early-stage vendors have an advantage here that they should use. The Corial Responsible AI Charter is signed by me, personally, as Founder and AI Lead. I review it once a year. If a commitment in it turns out to be unfounded, the person to come to is me. The Charter says so.

Later-stage companies often inherit a committee structure and find it harder to reduce the accountability down to a single name. The trade-off is the trade-off. A founder-signed document is more credible to procurement but less robust to the founder leaving. A committee-issued document is the reverse. At our stage, the founder-signed version is the honest one and the more useful one.

What to copy if you are writing one

If you are writing your own AI charter and want it to survive a procurement review, the sections to lift directly from the supplier-charter format are:

1. A short framing paragraph that names who the document is for and why it exists. Procurement, not an internal ethics review
2. A section on how providers are picked, with concrete weighted criteria, not value statements
3. A 'will not' section. Hard rules. No softening verbs. Five to seven lines is the right length
4. A 'where we lean' section for soft preferences, clearly separated from the hard rules. Procurement reads the separation as honesty
5. A disclosure section listing every public artefact (sub-processor list, model card, trust page, DPA) the customer can verify against
6. A short 'why a charter rather than a certification' section if you are not formally audited. Naming the gap is more credible than hiding it
7. A 'what this does not claim' section. The strongest AI policies are the ones that mark out their own limits
8. A signature block: name, role, date, place. Annual review date in writing

The Corial Charter is at corial.app/responsible-ai-charter and follows this structure. You are welcome to use it as a template. The format is not proprietary; the procurement teams who will eventually read your version certainly do not think it is.

Write for procurement, not for ethics research

Underneath all of this sits a deeper claim. Most AI ethics writing assumes an academic or policy-research reader. The document is written to engage with the literature, position the company within a debate, and demonstrate seriousness through length and citation.

The actual audience for a B2B AI vendor's policy, in the moment that matters, is a procurement officer evaluating whether to add the vendor to an approved list. That officer reads supplier codes for a living. The format the officer trusts is the supplier charter format. The verbs the officer trusts are the hard ones. The document the officer trusts has a name on the bottom of it.

AI vendors have spent a few years writing policies for the wrong reader. The reader who matters is already reading documents that look a specific way. Write for that reader. The ethics-research audience can read it too. The procurement audience would not have read the alternative.

If you want to see the worked example, the Corial Responsible AI Charter is at corial.app/responsible-ai-charter and the wider Trust page that sits beneath it is at corial.app/trust. Both are written for the procurement reader first.