Assess and govern the risks of third-party AI technology vendors

Overview

The rapid adoption of AI technologies across enterprise technology portfolios has introduced a category of vendor risk that traditional TPM governance frameworks were not designed to address. AI vendors — large language model providers, AI platform vendors, AI component suppliers — present a risk profile that differs from conventional software vendors: their models change continuously without traditional version release cycles, their training data provenance is often opaque, their output quality is probabilistic rather than deterministic, and their regulatory environment is evolving rapidly and inconsistently across jurisdictions.

Best Practice

Extend the technology vendor governance model to address AI vendor risk explicitly. For every AI technology in the Technologies Inventory, assess model provenance and transparency (what training data the model was trained on, and whether the vendor provides adequate documentation); output reliability and quality risk (the consequence of model degradation or hallucination on dependent applications); regulatory and compliance risk (applicable AI governance regulations and sector-specific restrictions); data exposure risk (what organizational data is transmitted to the vendor’s model endpoints); and vendor concentration and lock-in risk (dependency on a single AI vendor’s model or platform and the switching cost if terms change materially). Record this assessment in the technology’s Technologies Inventory record using the same vendor health and risk attributes already established for other technology vendors, supplemented by an AI Vendor Risk Notes attribute capturing the AI-specific dimensions.

Benefit(s)

Governing AI vendor risk explicitly within TPM prevents the pattern, already common in organizations that have adopted AI technologies rapidly and without governance, where AI technologies accumulate vendor dependencies, data exposure obligations, and regulatory compliance gaps that are invisible in the portfolio until they produce a crisis. It also positions the organization to respond quickly when the rapidly evolving AI regulatory environment produces new compliance obligations that apply to technologies already in the portfolio.