Governance

supplier

Vendors and external service providers to public bodies.

How the laws define this

At their core, these frameworks agree that a supplier is an entity or person responsible for developing, providing, offering, or making available AI systems, data-driven technologies, or associated services, thereby incurring legal, contractual, or governance obligations. The key divergence centers on the scope of the commercial or operational context governed by each instrument. Under the Énoncé de principes pour une utilisation responsable de l'intelligence artificielle par les organismes publics, suppliers are specifically external vendors or service providers delivering AI systems, models, or data to public organizations, while A guide to good practice for digital and data-driven health technologies (NHSX / DHSC) focuses on organisations offering health technologies to NHS customers. Conversely, Projeto de Lei nº 2.338/2023 defines suppliers broadly as any natural or legal person developing or providing an AI system generally, whereas H.B. 452 Artificial Intelligence Amendments anchors the concept strictly to consumer transactions by referencing Section 13-11-3 of the Utah Code.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first. Showing 3 of the 4 instruments that define this term; all are listed under Definitions below.

Jurisdiction	Instrument	Status	What is distinctive
Utah, United States	H.B. 452 Artificial Intelligence Amendments	In Force	Limits suppliers to persons or entities under Utah Consumer Sales Practices Act involved in consumer transactions, with responsibility for AI chatbot compliance.
United Kingdom	A guide to good practice for digital and data-driven health technologies (NHSX / DHSC)	In Force	Specifies suppliers of digital or data-driven health technologies to NHS, expecting governance, technical assurance, data protection, clinical safety and monitoring.
Brazil	Bill No. 2,338/2023 (Legal Framework for Artificial Intelligence — Draft national AI regulatory framework)	Under Review	Broadens to any person developing, providing or making AI systems available, imposing governance, assessments, conformity and liability duties for high-risk systems.

What it triggers

In Utah, under H.B. 452, suppliers of AI mental health chatbots must prohibit sale of personal health data and require disclosures of non-human interaction.source
In the United Kingdom, A guide to good practice describes that suppliers to NHS should maintain governance, technical assurance, data protection, clinical safety and post-deployment monitoring arrangements.source
In Brazil, Bill No. 2,338/2023 would impose on suppliers obligations related to governance programs, documentation, impact assessments, conformity assessment and liability for high-risk AI systems.source

Definitions (4)

Includes vendors, contractors and external service providers that supply AI systems, models, data, or related services to public organizations; the statement requires supplier contracts to embed traceability, data protection, liability allocation and maintenance obligations.

Énoncé de principes pour une utilisation responsable de l'intelligence artificielle par les organismes publics (Québec Ministry of Cybersecurity and Digital Affairs)Definition 1 of 4

A person or entity defined by reference to Section 13-11-3 of the Utah Code (Utah Consumer Sales Practices Act), broadly including sellers, lessors, assignors, offerors, brokers, or others who regularly solicit, engage in, or enforce consumer transactions, whether or not dealing directly with the consumer, and responsible for compliance under the Act.

H.B. 452 Artificial Intelligence AmendmentsDefinition 2 of 4

A natural or legal person that develops, provides, supplies or makes an AI system available; suppliers bear obligations under the bill related to governance programs, documentation, impact assessments, conformity assessment and, for high/excessive‑risk systems, liability and reporting duties.

Projeto de Lei nº 2.338/2023 (Marco Legal da Inteligência Artificial — Draft national AI regulatory framework)Definition 3 of 4

An organisation that develops, supplies or offers a digital or data‑driven health technology to NHS customers; suppliers are expected to maintain governance, technical assurance, data protection, clinical safety and post‑deployment monitoring arrangements as part of procurement and contract obligations.

A guide to good practice for digital and data-driven health technologies (NHSX / DHSC)Definition 4 of 4

Not to be confused with

Developer/Provider

Developer/Provider focuses on entities that design and build AI tools, while supplier emphasizes providing or making systems available, often overlapping but with broader supply emphasis in these definitions.

AI service providers

AI service providers offer AI-enabled functionality directly to end users, whereas supplier here targets those supplying AI to public bodies, NHS or in consumer contexts.

Questions and answers

What obligations do suppliers have for AI mental health chatbots in Utah?

Suppliers defined under the Utah Consumer Sales Practices Act must prohibit the sale of personal health data and require disclosures of non-human interaction. This applies to those engaging in consumer transactions with AI chatbots.

What would suppliers of high-risk AI face under Brazil's bill?

Bill No. 2,338/2023 would require suppliers to implement governance programs, documentation, impact assessments, conformity assessment, plus liability and reporting for high or excessive-risk systems.