Vendor risk for the AI in your stack

AI vendor risk management assesses the third-party providers behind your AI (model APIs, embeddings providers, agent-tooling vendors) for the risks specific to AI: how they handle and retain your data, the provenance of their models, and whether they are approved. It runs on the same vendor-risk control program as your other third parties.

It uses the same process and controls but adds AI-specific questions. Beyond the usual security review, you assess what happens to prompts and data sent to a model, the model’s provenance and approval state from the AI-BOM, and the vendor’s sub-processors: concerns that are unique or heightened for AI providers.

Because data you send to an AI vendor may be used, retained, or even used to train the vendor’s models depending on the terms. That makes data handling and retention the central risk for an AI provider, so it is the first thing an AI-vendor assessment should establish.

Screening an AI vendor, like any counterparty, is a governed action that maps to internal controls REG-001 and VND-002. So assessing and screening an AI provider both reduces risk and generates vendor and regulatory control evidence, and overdue reviews surface in continuous monitoring.