This is the fourth post in a five-part series on explainability, accountability, and the architecture of trustworthy supply chain intelligence. It stands alone — but the full argument runs across all five. Post 02 covers the practitioner and board-level evidence base. Post 03 covers the architectural reasons why current explainability tools are insufficient. Series navigation is at the bottom of this page.
In 2025, something changed in how enterprise procurement teams evaluate supply chain AI platforms.
The technical criteria are familiar — integration capability, data coverage, analytical depth, time-to-value. What changed was the addition of a criterion that had previously been an afterthought at the bottom of vendor scorecards, if it appeared at all: can you explain how your AI reaches its decisions, and can you document that reasoning chain for an auditor?
This is no longer a differentiating question. It is a qualifying one. Vendors who cannot answer it clearly are increasingly being eliminated before technical evaluation begins.
Understanding why this shift happened — and what it means for how supply chain risk platforms are built and selected — requires looking at three forces that arrived in the same window: a commercial standard that is now landing in bid rooms, a set of sustainability and due diligence regulations that are creating traceability obligations across value chains, and a broader shift in enterprise AI governance expectations that has moved from boardroom discussion to procurement checklist.
The commercial standard that changed the bid room
ISO 42001 is the international standard for AI Management Systems, published in 2023. For its first year it was treated as a voluntary framework — aspirational guidance that progressive technology organisations might pursue. By 2025 that characterisation was already outdated.
of Fortune 500 procurement teams now plan to require ISO 42001 alignment from technology vendors by 2027, according to a 2026 Gartner survey. Microsoft and Google have already earned certification — signalling that major technology providers may begin flowing the same requirement down to their own supplier base. What began as a voluntary framework has become a hard commercial prerequisite in enterprise procurement evaluations.
Source · Gartner Survey · 2026
The practical requirements ISO 42001 places on AI systems that support significant business decisions are specific. Board-approved AI policies with named ownership of AI outputs. Auditable risk registers documenting how AI-driven decisions are made and reviewed. Supplier controls that flow through vendor tiers. Versioned documentation of AI system behaviour. And critically — event logging and explainability: the ability to trace any AI output back to the computation that produced it.
"We'll produce the documentation later" means instant rejection in procurement evaluations that apply ISO 42001 criteria. The minimum requirements must be demonstrable at the point of evaluation — not promised as a roadmap item.
Enterprise AI Procurement · 2026 Practices
The insurance industry has also begun pricing AI liability risk differently for ISO 42001-aligned organisations. Certified companies are receiving premium adjustments that uncertified competitors are not. The standard has crossed the line from governance best practice to commercial differentiator — and for technology vendors selling into regulated industrial environments, it is becoming a precondition of sale.
The Deloitte 2025 Global CPO Survey defined an AI governance framework for procurement across five explicit dimensions: accountability, meaning clear ownership of AI outputs; transparency, meaning explainable decision logic; fairness, covering bias monitoring; risk management, covering security and compliance; and data governance, covering quality standards and access controls. Explainability is not a sixth dimension added for completeness. It is the second item on a five-point framework that CPOs are now using to evaluate the AI systems their organisations buy.
Four regulatory instruments pointing in the same direction
The ISO 42001 commercial shift did not happen in isolation. It is the leading edge of a broader regulatory convergence that has been building since 2022 and accelerated significantly in 2024 and 2025.
Requires event logging, full decision traceability, and explainability for AI systems used in significant business decisions. Certification-eligible — now appearing as a procurement prerequisite.
→ Requires: audit trail at decision time
Mandates annual Scope 3 and value chain disclosures using a digital tagging system. Reporting must be transparent, verifiable, and traceable to source data. AI systems producing sourcing intelligence feed directly into these disclosures.
→ Requires: traceable sourcing data provenance
All products entering the EU market must be traceable back to production origin with five-year record retention. Buyers must prove the sourcing decisions they made were documented and defensible at the time they were made.
→ Requires: documented decision provenance
Requires companies to demonstrate documented due diligence processes across their value chains for human rights and environmental impacts. An AI system that cannot produce a reasoning chain is not a due diligence system.
→ Requires: documented due diligence chain
These are not equivalent instruments — they cover different subject matter, carry different enforcement mechanisms, and apply to different organisational scopes. What they share is a structural requirement: decisions made about supply chains must be documented at the time they are made, traceable to the evidence that supported them, and producible on request to auditors, regulators, and trading partners.
An AI system that produces risk scores without a recoverable reasoning chain does not satisfy this requirement. It produces outputs. It does not produce evidence. The distinction is not semantic — it is the difference between an auditable decision and an assertion that a decision was made.
On the EU AI Act specifically: supply chain risk intelligence platforms in the B2B procurement context do not currently fall under the Act's Annex III high-risk categories as written. The honest framing is that the Act's scope does not yet reach this domain directly. What the Act does signal — unambiguously — is the direction of regulatory expectation: AI systems used in consequential business decisions should be explainable, auditable, and subject to human oversight. That direction will not reverse. The specific instruments that operationalise it will continue to arrive.
What the evaluation question actually tests
When a procurement committee asks "can you explain how your AI reaches its decisions?" they are not asking for a demonstration of a UI panel that summarises a risk score. They have seen many of those. What the question actually tests is architectural:
Most current supply chain AI platforms can answer yes to item two — they produce readable summaries. Very few can answer yes to items three, four, and five, because those questions probe whether explainability is architectural or cosmetic. A readable summary produced by an LLM reasoning over a final score does not constitute an audit trail. It constitutes a narrative. The prior post in this series covers the technical reasons for this distinction in detail — it is worth reading for any team that needs to evaluate vendor claims carefully.
The architectural property that determines the answer
The five evaluation questions above all ultimately probe the same underlying architectural question: was explainability designed into this platform before the first scoring component was built, or was it added on top of an existing pipeline?
This is not a question about vendor intention or product roadmap. It is a question about when decisions were made. A platform that captures structured evidence at the moment of computation — threading it through every engine, accumulating it in a schema that is independent of the engine that produced it — answers all five questions by design. The audit trail is not a feature. It is a structural byproduct of how the system works.
A platform that applies explanation techniques to its outputs after the fact — reconstructing what the model might have considered from the score and its inputs — cannot answer questions three, four, and five reliably, regardless of how good the reconstruction is. The reasoning context that existed during computation is gone. What remains is an approximation. As the previous post in this series documents, those approximations become less reliable, not more, as the underlying models become more capable.
The governance principle
An AI system that cannot produce its own audit trail
is not a risk management system.
It is a source of assertions.
The governance and regulatory context described in this post is not a future horizon. ISO 42001 is in procurement evaluations today. CSRD reporting obligations are active. EUDR enforcement is underway. CSDDD timelines are known. The platforms that will earn and retain the trust of compliance teams, procurement committees, and boards over the next two years are not the ones that are planning to add explainability. They are the ones that built it in before they needed to.
What this means at the point of platform evaluation
For procurement and digital transformation teams evaluating supply chain risk AI platforms in 2026, the governance layer of the evaluation is no longer optional or deferrable. It belongs in the first round of evaluation — not because compliance is the primary use case, but because the architectural decisions that determine compliance readiness are the same decisions that determine analytical quality, audit defensibility, and long-term platform trust.
A platform that captures a complete, deterministic reasoning chain at computation time is more trustworthy analytically than one that reconstructs it. It is more defensible in a board review. It is more compatible with the documentation obligations CSRD, EUDR, and CSDDD create. And it is more likely to satisfy ISO 42001 evaluation criteria without requiring a separate explainability programme to be built around it.
The question is not whether your organisation will eventually need to answer for how its supply chain AI makes decisions. The question is whether the platform you select today will be able to answer that question when it is asked.
The fourth and final post in this series addresses the architectural philosophy behind these design choices — why a neurosymbolic approach to supply chain intelligence resolves the tension between AI capability and explainability at a structural level, and what that means for how the platform evolves as more powerful AI components are added.