Introduction

My Vendors is where you manage the vendors your organization works with and review the AI Cards they share with you. Add vendors directly, record your own information about each one with custom fields, and see the AI Cards you have received from external organizations in a single, searchable workspace. To access it, navigate to AI System Manager in the left navigation and select My Vendors.

Please note that only AI Cards received through the standard publish-and-received workflow appear in My Vendors. AI Cards uploaded directly to the platform are not included.

Summary Metrics

A KPI bar at the top of the page displays five metrics that reflect your current vendor compliance structure:

• Total Vendors
• Total AI Cards
• Pending AI Cards
• Declined AI Cards
• Overdue AI Cards

Viewing Your Vendors & Received AI Cards

My Vendors offers two ways to browse your received data, controlled by a toggle at the top of the page: View By Vendor and View By Received AI Card.

View by Vendor

The View By Vendor view displays a searchable grid of vendor cards. It lists every vendor you track, including vendors you've added that haven't shared an AI Card yet. AI Card publishers that belong to the same vendor appear as one vendor card with combined counts. You can sort the grid alphabetically or by most recently updated. Each vendor card shows the vendor name, and counts for AI Cards, BOMs, Compliance Frameworks, and Documents associated with that vendor, along with a last-updated timestamp. Click View Details on any vendor card to open the vendor detail page.

Switch to the list view to see vendors in a table. Use Customize Table to show custom vendor fields as columns. Each user's column choices are saved separately, and custom columns can't be sorted.

View by Received AI Card

The View By Received AI Card view displays a grid of individual AI Cards received from your vendors. Each card shows the AI Card name, the associated AI System name, the date the card was sent, and an artifact breakdown with progress bars and counts for BOMs, Compliance Frameworks, Vulnerability Reports, and Documents. Click View Details on any card to open the AI Card detail view.

Add, Edit, and Retire Vendors

Add a vendor directly when your organization starts working with it, whether or not it has shared an AI Card. Select Add Vendor to open the Add Vendor form:

• Name: The vendor's display name. Required.
• Legal Name: The vendor's legal entity name.
• Primary Domain: The vendor's main domain, such as example.com.
• Website: The vendor's website URL.
• Description: Free text about the vendor.
• Custom Fields: A field for each of your organization's active custom vendor fields. Required custom fields must be filled in.

If the new vendor resembles an existing vendor by name or primary domain, a warning links to the existing vendor so you can check for a duplicate. The new vendor is still created.

To change a vendor's details, open its detail page and select Edit Vendor. The Edit Vendor form has the same fields as Add Vendor, filled in with the vendor's current values. Renaming a vendor can unlink it from AI Cards already received under the old name, and the form warns you before you save.

To retire a vendor your organization no longer works with, open its detail page and select Retire Vendor. A retired vendor and its AI Cards no longer appear in Cranium or count toward the summary metrics, but they aren't deleted. You can't reactivate a retired vendor.

Organizations that have sent you AI Cards but aren't set up as vendors still appear in My Vendors. You can't edit or retire them until you add them as vendors.

Adding, editing, and retiring vendors requires the vendor Create, Update, or Delete permission, respectively.

Custom Vendor Fields

Custom vendor fields record the information your organization tracks for every vendor, such as a supplier number, risk tier, or contract owner. Anyone who can edit vendors can manage custom fields.

Select Manage Custom Fields to open the Custom Fields dialog. Select Add Field to add a field, then set its properties:

• Label: The name shown on the vendor form and detail page.
• Key: The field's identifier, suggested from the label. The key can't be changed once saved. The Public API uses the key to read and write the field's values.
• Required: The field must be filled in whenever a vendor is created or edited. Making an existing field required doesn't affect saved vendors until they're next edited.
• Unique: No two vendors can share a value. Matching ignores case and surrounding spaces. A field can't be made unique while vendors already share a value.
• Status: The field's current state. A field added in the dialog shows New until you save.

Drag fields to set the order they appear on each vendor. Changes are saved together when you select Save.

Field values are text, up to 400 characters. A tenant can have up to 50 active fields.

Retiring a field hides it and its values everywhere. The values are kept, but the field can't be restored, and its key can't be reused.

Custom fields appear on the Add Vendor and Edit Vendor forms, in the Custom Fields section of each vendor's detail page, and as optional columns in the list view. My Vendors can't be sorted or filtered by a custom field.

Vendor Detail Page

The vendor detail page opens when you click View Details on a vendor card. The Edit Vendor and Retire Vendor actions appear at the top of the page. Below them, a Custom Fields section shows the vendor's custom field values, followed by a KPI bar showing counts for AI Cards, Bills of Materials, Compliance Frameworks, and Documents from that vendor, and four sections.

AI Cards

The AI Cards section lists all AI Cards received from the vendor. Each entry shows the AI Card name, AI System name, date sent, artifact breakdown, and current status. Click View Details on any AI Card to open the AI Card detail view.

Bills of Materials

The Bills of Materials section displays BOM cards associated with that vendor.

AI Models Used

The AI Models Used section shows a searchable, sortable grid of AI models present across that vendor's AI Cards. Each model card displays the model name, provider, severity tag, Vulnerability Likelihood score, the number of received AI Cards containing the model, and the test status. You can sort this grid by severity from highest to lowest.

Compliance Frameworks

The Compliance Frameworks section lists the compliance frameworks included in that vendor's AI Cards along with their current status.

Reviewing an AI Card

When an AI Card has a status of Pending or Changes Requested, a Review AI Card button appears in place of the standard View Details button. Click Review AI Card to open the Review AI Card drawer. The drawer is organized into two sections:

Requested Section:

• Request Details
• Compliance Frameworks requested
• Bill of Materials requirements
• Additional Documentation requirements
• Vulnerability Reports requirements

AI Card Response Section (headed as "AI Card Details"):

• AI Card Name
• Bill of Materials included
• Vulnerability Reports included
• Additional Documentation included
• A Card Comparison view (shown when the card is a response to one of your outgoing requests)

At the bottom of the drawer, you have three action options:

• Decline: Reject the AI Card
• Request Changes: Send feedback requesting modifications to the AI Card. This opens a modal where you can compose a message to the publisher (up to 1000 characters). This option is only available when the AI Card is a response to a prior outgoing request.
• Accept AI Card: Accept the AI Card as provided

AI Card Detail View

Clicking View Details on an AI Card from the vendor detail page or the View By Received AI Card grid opens the AI Card detail view. This view displays the AI Card's description, purpose, last-updated date, initial deployment date, and next scheduled update. An Artifacts section at the bottom shows individual artifact cards for items such as the Compliance Frameworks, Bills of Materials, and Vulnerability Reports, each displaying the artifact name, date, and status.