> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/company-operating-manual/commercial-and-contracting-model/subcontractor-engagement.md).

# Subcontractor Engagement

### Purpose

Subcontractors are used where specialist capability, capacity, or delivery support is required.

Subcontractor engagement must be controlled to protect customer delivery, company IP, security obligations, and commercial position.

### Subcontractor Principles

* Use subcontractors only where there is a clear business need.
* Flow down relevant customer obligations.
* Do not expose customer or company information unnecessarily.
* Ensure subcontractor deliverables are clearly defined.
* Ensure IP ownership and licensing are clear.
* Ensure security and confidentiality obligations are enforceable.
* Maintain audit and oversight rights.
* Track supplier performance throughout delivery.

### Required Controls

Before a subcontractor starts work, the following should be in place:

* signed subcontractor agreement
* agreed scope or work order
* NDA or confidentiality terms
* security onboarding
* access approval
* conflict of interest check
* insurance evidence where required
* right-to-work or compliance checks where applicable
* IP assignment or licence terms
* delivery and reporting expectations

### Supplier Delivery Risk

Supplier risks must be recorded in the project RAID log.

Examples include:

* dependency on specialist resource
* late delivery
* unclear acceptance criteria
* security clearance delays
* customer access constraints
* IP contamination
* quality issues
* insolvency or capacity concerns