We're living through a disruption unlike anything since the dot-com era of the late 1990s. AI is already reshaping employment, competitive advantage, and organizational risk, and yet most third-party risk management (TPRM) programs are still scrambling to keep up.
The central thesis of AI and Third-Party Risk by Gregory and Maria Rasner is deceptively simple: AI is just another risk. It needs to be identified, assessed, and managed. Full stop. No magic. No panic. No silver bullet.
But that simplicity masks a real challenge. AI risk is unlike most risks TPRM professionals have dealt with before. It's opaque by design. It introduces failure modes, like hallucinations and adversarial attacks, that don't exist in traditional software. And it's moving faster than regulatory frameworks can follow.
This blog series is a practical guide for risk, compliance, and security professionals who need to get a handle on AI risk within their vendor ecosystem. Over the next 19 posts, we'll unpack everything from AI fundamentals to global regulatory guidance, contract language, and physical vendor validations: all through the lens of third-party risk management.
Whether you're a seasoned TPRM practitioner or just beginning to build out your program, consider this your field guide to AI risk in the vendor ecosystem.
Coming up next: What AI actually is: algorithms, hardware, and data explained in plain English.
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →