A downloadable kit to map your issued AI requirements, link evidence and assign open actions. Prepare a handover for your supplier-review team.
Self-guided kit.
See an evidence gap and its next check
For suppliers with Section K flagged in their SSPA profile, or AI requirements in the contract. Confirm the current requirements issued for your engagement before use.
For AI-related Section K preparation. A full SSPA submission, any independent assessment and independent assurance remain separate. This kit does not provide certification or guarantee acceptance. Independent, not affiliated with Microsoft.
Each supplier needs its own copy. The Practitioner License does not include this kit.
Fernhill Wholesale · Fictional Section K preparation record.
The example has indexed evidence references, but scope confirmation and source checks remain open. Indexing a reference does not establish that evidence is ready to share.
Open the fictional preparation reportThe handover is planned only. No evidence has been shared or supplier submission made in this fictional example.
Bring the supplier profile, contract and requirements issued for your engagement. Check applicability and intended uses with the engagement owner.
Reference the policies, source files and operating records you already hold. Check relevance and sharing permission; give missing items an owner.
Review scope, evidence and open actions with the person managing your supplier submission. Confirm the recipient, authority and sharing channel before sending.
Planning estimates: 2–3 hours for a first scoped pass, then evidence gathering over several weeks. Your issued requirements, available records and review needs determine timing. These are not completion or approval guarantees.
Your email contains a download link to a ZIP: a guided workspace, six editable Word templates and worksheets, a blank workspace and a separate fictional worked example.
Extract the ZIP and open START-HERE.html in a desktop browser on a PC or Mac. Save your work file, keep it, and use Open to continue next time.
This is a self-guided local workspace for one purchasing company. Your team confirms requirements, checks evidence and authorizes sharing. The kit does not submit to the SSPA portal.
Each supplier needs its own copy; the Practitioner License excludes SSPA. Supporting several suppliers? Request a custom licensing quote.
Use the Section K applicability guide as a starting point. Confirm the answer against your current issued profile, contract and engagement requirements.
SSPA version 12 brought Microsoft’s AI requirements together in one place: the AI Systems requirements of the Data Protection Requirements (requirements 51–63). Public source version verified October 26, 2026. Confirm your current issued requirements before use. Prepares you; not an assessment or certification. Independent, not affiliated with Microsoft.
Each supplier needs its own copy of this kit. The Practitioner License does not include it. If your firm supports several suppliers, contact us for a custom licensing quote.
Plan 2 to 3 hours for the first scoped Section K review, then evidence gathering over the following weeks. Planning estimates assume the relevant information is available. They are not completion or approval guarantees.
| Covers | Doesn’t cover |
|---|---|
| The AI-related Section K requirements issued for your engagement | The rest of your SSPA profile, such as privacy and security requirements |
| An applicability decision and reason for each requirement, made by your team | Deciding applicability for you, or what the reviewer will accept |
| Where each piece of evidence is, who owns it, and what is missing | Writing the evidence itself, such as policies, contracts or assessments |
| Actions with owners and dates, and a handover report for your reviewer | Submitting in the SSPA portal, an independent assessment, or legal advice |
Two ways to look inside. Both use a fictional company and have captions.
See each AI requirement worked through, with steps and owners.
Every step, start to finish. Jump to any chapter.
Fictional example company, General business edition. Captions on screen.
The kit’s dashboard with its core sections, preloaded with a fictional company. Click through and edit; nothing is saved, and it makes no network requests. Saving, importing and exports are in the full kit. For a desktop browser; no email or account.
For AI-related Section K preparation. A full SSPA submission and any independent assessment remain separate.
Asked by your team
“Which of our AI systems are in scope, and is each one’s contract and intended use confirmed?”
The kit tracks it as an action owned by the operations director, due Oct 22, 2026.
An approved AI tool or a template can help you write a starting answer or document. You still need a way to organize evidence, decisions and follow-up.
Keep issued supplier requirements, applicability decisions, evidence references and open actions together.
The kit supplies the working structure and examples. Your team checks the facts and approves the result; AI is optional.
Start with the requirements issued for your engagement and the evidence your supplier-review team already holds.
Excel and CSV import included.
Export columns. See every column, in order, or download a fictional sample: Evidence index and handover (Excel) · Handover (CSV).
Check the contract and Section K applicability with the engagement owner.
Reference relevant records and assign missing items to the people responsible.
Review the report with the person managing your supplier submission.
Download the ZIP, extract it, and open START-HERE.html in a current desktop version of Chrome, Edge, Safari or Firefox. Save your work file to keep a copy you can load next time.
On a phone, each record shows its fields together.
| Published heading | Applicability question | Evidence a reviewer expects | Worksheet | Output |
|---|---|---|---|---|
| Published heading51 AI Systems contractual terms | Applicability questionAre AI system terms in the Microsoft contract? | Evidence a reviewer expectsThe contract clause or a written gap | WorksheetSection K requirements → 51 | OutputScope record |
| Published heading52 Prohibited practices | Applicability questionIs any in-scope use a prohibited practice? | Evidence a reviewer expectsScreening record | WorksheetSection K requirements → 52 | OutputScreening result |
| Published heading53 AI System incident response | Applicability questionIs there a response plan that follows the contract? | Evidence a reviewer expectsThe plan and the contract reference | WorksheetSection K requirements → 53 | OutputEvidence item |
| Published heading54 Transparency disclosures | Applicability questionCan you show the disclosures Microsoft would ask for? | Evidence a reviewer expectsDisclosure set | WorksheetSection K requirements → 54 | OutputEvidence item |
| Published heading55 Signed agreement | Applicability questionAre AI supplier terms in a signed agreement? | Evidence a reviewer expectsThe agreement or a gap note | WorksheetSection K requirements → 55 | OutputEvidence item |
| Published heading56 Accountability | Applicability questionWho is accountable for the AI systems? | Evidence a reviewer expectsNamed role and authority | WorksheetSection K requirements → 56 | OutputEvidence item |
| Published heading57 Risk assessment | Applicability questionIs there a current risk assessment for the in-scope systems? | Evidence a reviewer expectsAssessment record | WorksheetSection K requirements → 57 | OutputEvidence item |
| Published heading58 Transparency and explainability | Applicability questionCan you explain the in-scope systems to a reviewer? | Evidence a reviewer expectsExplanation and a failure note | WorksheetSection K requirements → 58 | OutputEvidence item |
| Published heading59 Monitoring and adaptation | Applicability questionHow are failures watched and acted on? | Evidence a reviewer expectsMonitoring record | WorksheetSection K requirements → 59 | OutputEvidence item |
| Published heading60 Performance and safety disclosures | Applicability questionWhich performance notes can you hand over? | Evidence a reviewer expectsDisclosure notes | WorksheetSection K requirements → 60 | OutputEvidence item |
| Published heading61 Transparency disclosure updates | Applicability questionHow do you tell Microsoft when intended use changes? | Evidence a reviewer expectsUpdate note | WorksheetSection K requirements → 61 | OutputEvidence item |
| Published heading62 System health monitoring | Applicability questionIs there a written monitoring procedure? | Evidence a reviewer expectsProcedure | WorksheetSection K requirements → 62 | OutputEvidence item |
| Published heading63 Intended use fitness | Applicability questionWhat happens if a system is not fit for the intended use? | Evidence a reviewer expectsOwner and next action | WorksheetSection K requirements → 63 | OutputAction record |
13 requirement headings, worksheets for applicability and evidence, and an evidence index. This is preparation, not SSPA approval or an independent assessment.
Start with Does Section K apply to us? The evidence index is what you hand to an assessor or upload to the portal. Records move through Move records to another kit.
Standard kits cover internal use by one purchasing company. A consultancy can use a standard kit for its own business. Each supplier needs its own copy of this kit, and the Practitioner License does not include it. If your firm supports several suppliers, contact us for a custom licensing quote.
Updates are included for 12 months from purchase.
Not the right fit? Ask within 14 days and we refund you in full. See our refund policy.
Bring action records. Headings such as Gap #, Section K item and What needs doing auto-match in the relevant register. Unmapped columns are listed and kept with the source details or notes. Day/month/year dates are supported; ambiguous dates ask for your choice. Review duplicates and possible duplicates before records change. Your confirmed column mappings are remembered in your work file.
Not supported: phones, tablets (iPads included) and Chromebooks. Virtual desktops (Citrix and similar) work only if the browser keeps its saved data between sessions, so save a work file before you sign out.
Downloaded on Windows? Before you extract it, right-click the ZIP, choose Properties, tick Unblock and press OK, so Windows stops treating the files inside as blocked internet downloads. On a Mac, double-click the ZIP to extract it; if macOS warns that a file came from the internet, choose Open, or ask IT to clear the quarantine flag on the kit folder.
What the kit needs from a work computer · IT checklist (plain text)