{"manifest":{"framework":"ISO/IEC 42001","generated_at":"2026-09-06T08:02:53.307264+00:00","workspace_id":0,"vendor_count":10,"control_count":10,"undated_vendor_count":7,"undated_vendors":["Anthropic Claude","GitHub Copilot","Grammarly","Microsoft Copilot","OpenAI ChatGPT","Otter.ai","Perplexity AI"],"freshness_caveat":"7 of 10 records carry no last-verified date. Completeness scores field coverage, not recency — an undated record may be fully populated and still out of date. Treat those rows as unconfirmed.","hash_algorithm":"sha256","content_sha256":"7e07d37c1083d8daa4ae937606be3cc91cfc1afa6e8ddddc151a95086bd5f2c5","hash_scope":"The body object only, excluding generated_at, so unchanged evidence hashes identically across dates."},"body":{"framework":"ISO/IEC 42001","vendors":[{"vendor":"Anthropic Claude","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II, ISO 27001","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://www.anthropic.com/legal/commercial-terms","https://privacy.anthropic.com/en/articles/10023580-is-my-data-used-for-model-training"],"last_verified":"","completeness":1.0,"dated":false,"effective_trains_on_input":"no"},{"vendor":"Fireflies.ai","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II, GDPR, HIPAA","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://fireflies.ai/security","https://fireflies.ai/privacy-policy","https://guide.fireflies.ai/articles/2154538358-policy-on-keeping-information-safe","https://guide.fireflies.ai/articles/9596505232-learn-about-data-storage-and-transfer"],"last_verified":"2026-06-27","completeness":1.0,"dated":true,"effective_trains_on_input":"no"},{"vendor":"GitHub Copilot","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement"],"last_verified":"","completeness":0.85,"dated":false,"effective_trains_on_input":"consumer_tier"},{"vendor":"Google Gemini","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: ISO 27001, SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://support.google.com/gemini/answer/13594961","https://cloud.google.com/gemini/docs/discover/data-governance"],"last_verified":"2026-07-18","completeness":0.85,"dated":true,"effective_trains_on_input":"consumer_tier"},{"vendor":"Grammarly","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II, ISO 27001","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://www.grammarly.com/security"],"last_verified":"","completeness":0.85,"dated":false,"effective_trains_on_input":"consumer_tier"},{"vendor":"Microsoft Copilot","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: ISO 27001, SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","https://learn.microsoft.com/en-us/copilot/privacy-and-protections"],"last_verified":"","completeness":1.0,"dated":false,"effective_trains_on_input":"consumer_tier"},{"vendor":"OpenAI ChatGPT","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://openai.com/enterprise-privacy"],"last_verified":"","completeness":1.0,"dated":false,"effective_trains_on_input":"all_tiers"},{"vendor":"Otter.ai","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://otter.ai/privacy-policy"],"last_verified":"","completeness":0.85,"dated":false,"effective_trains_on_input":"consumer_tier"},{"vendor":"Perplexity AI","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://www.perplexity.ai/hub/legal/privacy-policy"],"last_verified":"","completeness":0.8,"dated":false,"effective_trains_on_input":"consumer_tier"},{"vendor":"Slack AI","controls":[{"framework":"ISO/IEC 42001","reference":"A.10.3","title":"Suppliers of AI systems and services","status":"applies","basis":"certifications: SOC 2 Type II, ISO 27001","note":"No AI-management certification identified; assurance must come from your own supplier assessment."}],"sources":["https://slack.com/trust/data-management/privacy-principles","https://slack.com/help/articles/28310650165907-Security-for-AI-features-in-Slack","https://slack.engineering/how-we-built-slack-ai-to-be-secure-and-private/"],"last_verified":"2026-06-27","completeness":0.925,"dated":true,"effective_trains_on_input":"no"}],"control_count":10},"disclaimer":"Supplier-facing evidence assembled from published vendor documentation on the dates shown. It is not a certification, not an audit opinion, and not a compliance determination. It covers third-party AI services this workspace was observed using; it does not assess your organisation's own AI systems, which carry separate obligations."}