Third-Party & Vendor Risk

Most organizations do not build their own models. They buy tools, call APIs and turn on AI features inside software. That moves risk to a third party, but it does not remove your duty. You still answer to customers, staff and regulators. This lesson shows how to assess AI vendors, what to put in contracts and how to keep watching after you buy.

Why vendor risk is different for AI

• The vendor may change the model without telling you, and behavior can shift.
• Your data may be used to improve the vendor's models unless you opt out.
• The vendor's sub-suppliers, such as a model provider and a cloud host, add more links.
• Vendors may claim features they cannot prove, such as no hallucinations.
• Lock-in can be strong: prompts, data and workflows may not move easily.

Due diligence questions

DATA AND PRIVACY
- Is our data used to train any model? Can we opt out in writing?
- Where is data stored and processed? Which sub-processors are involved?
- How long do you keep prompts, files and outputs? Can we delete on request?
- Who at your company can read our data, and under what controls?

SECURITY
- Which security standards or reports can you share?
- How do you protect against prompt injection and data leaks between customers?
- How and how fast do you tell us about incidents?

MODEL AND QUALITY
- Which models do you use? Do you tell us before you change them?
- What evidence do you have of quality on cases like ours? How do you test?
- What are the known limits and failure modes?

COMPLIANCE
- How do you meet the laws that apply to us (privacy, AI rules, sector rules)?
- Can you support our audits and impact assessments?
- Do you offer protection if generated content leads to an IP claim?

EXIT AND CONTINUITY
- Can we export our data, prompts and settings? In what format?
- What happens to our data when we leave? Proof of deletion?
- What if you stop service or change price sharply?

What to put in the contract

• Data terms: no training on your data without consent, limits on use, deletion duties.
• Security duties and incident notice with a clear time limit.
• Notice of material changes, such as a model change or a new sub-processor.
• Audit or evidence rights, so you can verify claims.
• Service levels for uptime and support.
• Clear responsibility for harm and for IP claims, as far as your counsel can negotiate.
• Exit terms: data export and deletion.

Tier the effort

Do not run a deep review for every tool. Match effort to the risk tier of the use. A note-taking helper for staff with no sensitive data gets a short check. A system that touches customer data or affects decisions about people gets the full review and ongoing oversight.

After you buy

• Record the vendor and system in the inventory with a named owner.
• Set review dates, at least yearly and when the vendor announces changes.
• Re-test key behavior after model changes, using your own test cases.
• Watch vendor notices, outage reports and security news.
• Track usage and cost, so surprises show early.

Shadow vendors

Staff may sign up for tools with a credit card. These tools skip your review. Reduce this by offering fast approval for low-risk tools, by blocking clearly unsafe ones and by telling people why. Procurement and finance can help by flagging AI-related spend.