AI Vendor Onboarding Packet

Note (dated 2026-08-04): a chain composes independent computations performed in an analytical order. No step's output is carried into the next step by the execution model; each step computes from its own declared inputs. This is true of every chain on this site, including chains whose per-step copy below reads as a data handoff.

Reading mode (RUNBOOK): Run these steps in order. The vendor’s risk class decides which contract clauses get pulled, so classification runs before the addendum is assembled and the DPA is checked, ending in the acceptance receipt.

Risk-classify an AI vendor against the EU AI Act, pull the matching Model Contractual AI Clauses, assemble the Common Paper AI Addendum from Cover Page Key Terms, confirm the DPA is GDPR Art 28 complete, and emit a countersigned agent-acceptance receipt. End-to-end verifiable AI-vendor onboarding.

OpenChainGraph · 5 Steps compliance mandate Hash-Anchored §4 chain_depth:5 Client-Side · Zero PII

Chain Stages · 5 Steps

1 ROOT · D0 node

EU AI Act High-Risk Fit & Classification Diagnostic art-64-ai-act-highrisk-fit-diagnostic

high-risk verdict normalizes to a risk_tier (high-risk unless out-of-scope) feeding the clause mapper

MCP Call · run_ai_act_highrisk_fit

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "run_ai_act_highrisk_fit",
    "arguments": {}
  },
  "id": 1
}

↓

2 D2 node

AI Act Procurement Clause Mapper art-412-ai-act-procurement-clause-mapper

MCC-AI template + applicable Chapter III clauses inform the addendum's Cover Page Key Terms

MCP Call · map_ai_act_procurement_clauses

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "map_ai_act_procurement_clauses",
    "arguments": {}
  },
  "id": 1
}

↓

3 D3 node

AI Addendum Assembler art-411-ai-addendum-assembler

assembled AI Addendum + contract-api.json feed the DPA completeness check

MCP Call · assemble_ai_addendum

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "assemble_ai_addendum",
    "arguments": {}
  },
  "id": 1
}

↓

4 D4 node

DPA Article 28 Completeness Checker art-409-dpa-art28-completeness-checker

Art 28(3) completeness verdict feeds the agent-countersign step

MCP Call · check_dpa_gdpr_art28

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "check_dpa_gdpr_art28",
    "arguments": {}
  },
  "id": 1
}

↓

5 TERMINAL · D5 node

Agreement Acceptance Binder art-277-agreement-acceptance-binder

Exports a countersigned agent-acceptance receipt, hash-chained to the assembled addendum, final stage

MCP Call · bind_agreement_acceptance

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "bind_agreement_acceptance",
    "arguments": {}
  },
  "id": 1
}

Question: Procurement flagged a new model vendor as high-risk. Which contractual clause pack should the contract team pull for that tier? Run the AINumbers MCP tool `run_chain` with {"chain":"ai-vendor-onboarding-packet"} and read `art-412-ai-act-procurement-clause-mapper.template`. Re-run with `inputs` for `art-412-ai-act-procurement-clause-mapper`, reusing the values that result echoed, with `risk_tier` set to "high-risk". Compare the same field. Verify: call `verify_execution_hash` (https://mcp.ainumbers.co/mcp) with `claimed_hash` set to `composite_execution_hash` and the full `composite_artifact`. Ledger, for a human re-check: https://ledger.ainumbers.co/ PII rule: send synthetic or anonymised inputs only. The MCP server runs these kernels and logs no payloads. Chain page: https://ainumbers.co/chaingraph/chains/ai-vendor-onboarding-packet.html

AI Vendor Onboarding Packet

Ask your agent