What is Third-party (vendor) AI risk?
Third-party AI risk is the risk that arises when an organisation relies on AI built or operated by suppliers, such as software vendors, model providers and AI features embedded in tools. It covers data exposure, reliability, legal obligations, hidden subcontractors and limited visibility into how the AI works.
Managing it usually involves due diligence questionnaires, contract terms on data use and incident notice, ongoing monitoring and evidence from the supplier. Under the EU AI Act, a deployer's obligations depend on the system it uses, so supplier information is an input to classification and oversight.