Research · AI Governance, Risk & Compliance

Third-Party & Vendor AI Risk

Much of the AI in any organization comes from vendors: features inside SaaS products, AI services and outsourced processes. Third-party AI risk management extends vendor oversight to cover how suppliers build, use and change AI.

Why it matters

Vendors add AI capabilities to existing products, sometimes turning them on by default. A tool approved years ago may now process your data with a model from another provider. Contracts written before generative AI often say nothing about model training, output ownership or AI incidents.

What to ask vendors

• Which AI features does the product include, and can they be controlled or disabled?
• Which models and sub-processors are used, and where is data processed?
• Is customer data used to train or improve models?
• How are models tested for accuracy, bias and security?
• How will you be notified of material AI changes or incidents?
• What certifications or assessments cover the AI, such as ISO/IEC 42001?

Contract terms to update

• Restrictions on using your data for training.
• Notice of new AI features and model changes.
• Responsibilities for AI-related incidents and errors.
• Audit and information rights.
• Data return and deletion on exit.

Common pitfalls

• Assuming existing vendor reviews cover AI features.
• Security questionnaires with no AI-specific questions.
• No inventory of which vendors use AI with your data.

How to get started

• Add AI questions to vendor intake and renewal reviews.
• Identify critical vendors already using AI on your data.
• Update standard contract language for AI.
• Include vendor AI in your AI inventory and risk tiering.