Third-Party and Supply Chain AI Risk: The Unknown

Welcome to Third-Party AI Risk.

A third party, for our purposes, is any external entity involved in your business: vendors, suppliers, partners, contractors. Third-party risk management, or TPRM, is the systematic process of identifying, assessing, monitoring, and mitigating the risks these relationships create.

TPRM is not new. It's been a compliance requirement in financial services since the Office of the Comptroller of the Currency first issued guidance on it, and it's evolved into a mature discipline across industries. But AI adds a new dimension.

When a vendor uses AI in the products and services they deliver to you, your organization inherits the risks that AI creates. If their model is biased, those biased outputs affect your customers. If their AI system is breached, your data may be exposed. If their AI hallucinates and produces inaccurate outputs that feed into your operations, the consequences fall on you.

The TPRM lifecycle has six stages: Govern, Pre-Contract, Contract Review, Continuous Monitoring, Disengagement, and Continuous Improvement. For AI risks, each stage requires additional scrutiny.

In the Pre-Contract phase, inherent risk assessments should now include AI-specific questions: Does this vendor use AI in the services they're providing? If so, what data does that AI process? What model type is it? Has it been tested for bias?

In Contract Review, AI-related terms deserve specific attention. What are the vendor's obligations around AI transparency and explainability? What happens if an AI output causes harm? Who's responsible for model drift?

In Continuous Monitoring, AI systems at vendors require ongoing oversight. A vendor's AI risk profile can change as they update their models or add new AI features. Your monitoring program needs to detect those changes.

Supply chain risk extends this further. Where TPRM focuses on your direct vendors, supply chain risk management covers the entire chain, your vendors' vendors, and their vendors in turn. In the AI context, this means asking: where was the foundation model your vendor uses trained? Whose data was used? What open-source components are in the stack?

The key principle is straightforward: your organization is responsible for its risk posture, even when that risk originates outside your walls. A robust TPRM program, extended to address AI, is how you stay in control of risk you don't directly own.