Description
Manage the risk of the AI you buy, license, switch on or download
Most AI in large organizations is bought rather than built. It arrives as a feature in software already under license, as a specialist application, as a model reached through an API, as downloaded model weights or as an agent platform that acts in company systems. The buyer usually stays accountable for what that AI says or does, while the supplier keeps most of the knowledge about how it works.
Classic vendor risk reviews check data custody, security controls and service continuity. They miss what is different about AI suppliers: a supplier may train on your data, the model behind an unchanged contract can change behavior between versions, and many suppliers depend on model and cloud providers you never contracted with. Third-Party AI Risk gives CIOs, CISOs, procurement and risk leaders a lifecycle method that extends an existing third-party risk program for AI. Claims that matter are tested on your own use case and then made enforceable in the contract.
What the report covers
Original frameworks
- Five AI sourcing patterns: Embedded AI, AI Application, Model Service, Open-Weight Model and Agent Platform, each with its own risk profile.
- The seven-stage AI Supplier Lifecycle: Discover, Tier, Diligence, Contract, Onboard, Monitor and Exit, aligned with the US Interagency Guidance on Third-Party Relationships, NIST AI RMF GOVERN 6 and the NIST Cybersecurity Framework 2.0.
- The AI Supplier Tiering Model: four exposure factors (Data Exposure, Decision Influence, Action Authority and Dependency) with overrides for training on your data, decisions about individuals, unapproved actions in systems of record and sole-source critical services.
- The Assurance Evidence Ladder: every supplier claim graded from V0 Claim through V1 Disclosure, V2 Attestation and V3 Verified in Use to V4 Contracted, with minimum evidence by tier.
- Material AI change triggers, such as a model replacement, a new model provider or a change in data use terms, that send a supplier back for re-review.
Assessing AI suppliers
- Discovering AI already in use: inventory, intake gates, shadow AI and AI that arrives through renewals and feature releases.
- Due diligence: diligence domains, key questions and the evidence to request, and where certifications and attestations stop being useful.
- Testing vendor AI before you rely on it: test types for bought AI and thresholds set in advance.
- Data use, privacy and confidentiality terms to secure for each sourcing pattern.
- Model providers and the fourth-party problem: questions to ask any AI supplier about the providers behind it.
Specific types of bought AI
- Embedded AI in existing software: default settings, release monitoring and notice terms for AI switched on inside tools you already license.
- Agent platforms and AI that acts: safeguards by tier, including scoped credentials, approvals and logging.
- Open-weight models and the AI software supply chain: a controlled intake path and an AI bill of materials.
Contracts, regulation and ongoing oversight
- The AI contract core: training restrictions, change and incident notice, audit and information rights, sub-processor terms and exit assistance, scaled to tier.
- Regulatory expectations across jurisdictions, including when an EU buyer can appear to take on provider duties for a high-risk AI system. Presented as general insight to confirm with counsel, not legal advice.
- Ongoing monitoring and material change, with a monitoring cadence by tier.
- Concentration, resilience and exit, including exit readiness by sourcing pattern and model retirement schedules.
- Operating model: who owns third-party AI risk across procurement, security, legal, privacy and the business.
- Five scenario playbooks: a meeting assistant switched on in the collaboration suite, an AI resume screening application, a model API behind a customer-facing chatbot, an agent platform connected to CRM and email, and an open-weight model hosted in-house for document processing.
- A 90-day plan and a 12-month roadmap, plus conclusions for leaders.
Ready-to-use tools included
The appendices are forms, questionnaires and templates that fit inside an existing procurement and third-party risk management process.
- Appendix A: AI supplier intake form
- Appendix B: AI supplier tiering worksheet with exposure scoring, overrides and approval
- Appendix C: AI due diligence questionnaire, with the lowest tier at which each question applies
- Appendix D: Evidence request list by tier
- Appendix E: Vendor AI test plan template
- Appendix F: AI contract clause checklist with minimum tier for each clause
- Appendix G: Material change notification triggers and buyer response
- Appendix H: Ongoing monitoring scorecard
- Appendix I: Exit and transition plan template
- Appendix J: Glossary
- Appendix K: One-page executive checklist
The report also contains 38 tables and 6 figures, including what classic vendor risk reviews miss about AI, seven AI-specific supplier risks and third-party AI expectations by jurisdiction.
Who this report is for
- CIOs and CTOs approving AI purchases, renewals and features switched on in existing software
- CISOs and security teams assessing AI suppliers, agent platforms and open-weight models
- Procurement, vendor management and third-party risk teams extending their process to AI
- Legal, privacy and compliance teams negotiating AI data use and contract terms
- AI governance leads who need visibility into bought and embedded AI
- Executives and boards who need a clear view of AI supplier exposure
Report details
- Format: PDF, 60 pages, US Letter
- Edition: Version 1.0, Commercial Edition, 2026
- Sources: 108 numbered references to international standards, regulatory and supervisory texts, court and enforcement decisions, research and public provider documentation, current as of October 2026
- Delivery: instant download after purchase
- License: the purchaser may use the forms, questionnaires, checklists and templates internally. Redistribution or resale requires written permission from CorpExcellence.com.
This report is independent, best-effort research. It is not legal, regulatory, contractual, privacy, security or other professional advice, and its contract checklists are not model contract language. Confirm current requirements with the official sources and qualified advisers before relying on them.
