You don't need a math degree to manage AI risk. But you do need a working vocabulary. When a vendor tells you they use a "deep learning model trained on proprietary datasets," you need to know what that means: and what risks it implies. This post builds that foundation.
The Three Pillars of AI
Every AI system rests on three foundational pillars:
Algorithms are the mathematical instructions that allow a system to learn from data, detect patterns, and make decisions. There are three major categories. Supervised learning uses labeled data : the algorithm already knows the right answers and learns to replicate them. Unsupervised learning finds hidden patterns in unlabeled data, useful for anomaly detection. Reinforcement learning trains through trial and error, rewarding good decisions and penalizing bad ones.
Hardware has historically been the limiting factor in AI advancement. The rise of Graphics Processing Units (GPUs), originally designed for video games, unlocked the processing power needed to train modern AI models. Today's AI hardware ecosystem also includes Tensor Processing Units (TPUs), Neural Processing Units (NPUs), and Field-Programmable Gate Arrays (FPGAs), each optimized for different AI workloads. Energy consumption is an emerging concern: large AI systems consume enormous amounts of electricity, and this is increasingly a regulatory and ESG issue.
Data is the raw fuel of AI. Without sufficient volumes of high-quality, representative data, an AI model cannot learn effectively. The quality and diversity of training data directly determine the accuracy, fairness, and reliability of the AI system's outputs.
Why This Matters for TPRM
When assessing a vendor's AI risk, understanding these three pillars helps you ask better questions. Where does their training data come from? Is their hardware infrastructure adequately secured? Do they have processes to validate algorithm outputs? These aren't abstract technical questions: they're the foundation of meaningful AI due diligence.
Coming up next: The AI Development Life Cycle: and why your existing SDLC isn't enough.
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →