The AI ranks your suppliers. The master data is folklore.

The last supplier-risk dashboard demo I sat through flagged one vendor as a critical exposure – a company that had legally ceased to exist three years earlier. Dissolved, struck off, still projected to ship twelve batches a quarter. Two screens over sat an A-rated supplier whose entire scorecard was a spreadsheet with no owner: version 14, filename ending FINAL_v3_use_this, last touched by a buyer who left in 2021. The most expensive quality system I ever inherited was a spreadsheet.

This week's supply-chain commentary names the contradiction of the season: powerful models sitting on weak data foundations. True, and far too polite about it. From the quality side the cut is sharper, because this is no longer a forecast. AI is already scoring, ranking and auto-qualifying suppliers on master data nobody has audited – decades of quiet data rot converted into machine-speed purchase decisions. The dashboard does not ask who updated the fields. It asks the fields.

What the model actually sees

Excavate a supplier master and you find archaeology. The same part under three internal numbers, each carrying a different approval state, two of them wrong. PPAP status reading "submitted, 2017, pending" on a part that has shipped forty thousand units since. Scorecards updated quarterly by whoever answers the email – a selection process, not a governance process. None of this was catastrophic at human speed, because humans are slow, opinionated filters. A buyer who has walked the plant notices when the quality manager's name changes for the third time in a year. The model does not walk.

Across two decades of VDA 6.3 supplier audits in automotive and aerospace, the most repeatable finding was the gap between the scorecard and the shop floor. I have audited A-rated stamping houses whose PPM figures looked beautiful partly because their customer – us – absorbed containment before defects could be counted. I have seen a certified laboratory with lapsed calibration filed next to a green rating.

The scorecard was not lying, exactly. It was folklore with formatting.

The mechanism matters more than the anecdotes. A wrong "approved" flag stops being a typo the moment a model reads it. It becomes an automatic PO, an auto-qualified source, a launch decision taken in milliseconds by a system structurally incapable of doubt.

A typo waits for a human to act on it. A model acts on it every time – at machine speed, with a purchase order attached.

Audit the data like you audit the supplier

You already own the discipline; it is called VDA 6.3 and you run it on suppliers. Run it on the data layer. Every critical field – approval status, PPAP state, risk rating, capacity – carries a source document, a timestamp and a named owner, exactly the way a control plan carries torque values. Sample records the way you sample parts on the line: thirty supplier records pulled at random, traced to evidence, unannounced. And put a name against every field, so that "nobody knew who owned it" stops being an acceptable root cause in your 8D.

At FOREAST I spent a season on the supplier side of the scorecard with an ArcelorMittal plant, and it rearranged what I thought those numbers were. Part measurement, part negotiation, part a quarterly email answered by whoever was not on holiday. If you would reject that as measurement data in your SPC, reject it as the basis of an automated decision.

Cost it in euros, because that is the language this argument wins in. A fortnight of two quality engineers auditing master data is roughly €10,000 loaded. One wrong auto-qualification – an unapproved source released onto a new programme – means restarted PPAP, containment, requalification, a launch slip and a quarter of engineering capacity. I have priced worse for less. Data quality is a controlled characteristic with a cost of poor quality attached, not a background IT task that appears in nobody's annual objectives. The ISO 9001 revision now taking shape asks organisations to prepare for what is coming. What is coming is automated decisions, and automated decisions inherit the data.

Consensus beats confidence

I designed and built a multi-model orchestration platform – MultiPS, 63+ models run in parallel with synthesis of their outputs – and the education was not in where the models agreed. It was in where they split. Feed twenty of them two conflicting supplier records and half will merge the entities while half refuse: the defect sits in the data, not the models. Model disagreement is a free data-quality alarm. Single-model certainty on unverified data is a defect generator wearing a decision-engine badge.

This is also the ethical-hacker lens. Unvalidated input is an injection vector, in procurement exactly as on a network, and supplier master data is externally touchable by design – suppliers submit their own certificates, portal updates and self-assessments. A stale approval flag is an unpatched service listening on a port you forgot existed. The reflex that put my name on T-Mobile's public bug-bounty hall of fame is the one I apply to a supplier database: assume input is hostile until proven otherwise, then go and prove it.

Audit first, automate second

Sequence is the whole game. Automate a broken foundation and you get faster breakage, better formatted, distributed to more people who now trust it. The arithmetic is not close: ten thousand euros and two weeks of auditing against a quarter of fire-fighting and a customer who reads your A-ratings as fiction from that day forward.

Before AI touches supplier selection, the data layer owes you the same rigour you demand from a supplier's shop floor – sampling, ownership, consequences, the full discipline. Provenance is not an IT cleanup project for a quiet quarter. It is a controlled characteristic, and it is the one your newest decision-maker reads first. The model will not wait for the cleanup. Neither will the purchase order.