The risks of relying on an outside provider for an AI tool or service, including data use, model changes, security, service, and lock-in.
Definition
AI vendor risk is the risk that comes from depending on an outside provider for an AI tool or service. It includes risks to your data (where it goes, who sees it, whether it trains the vendor’s models), to performance (answers are probabilistic and the model can change without notice), to security (the vendor’s controls and incident handling), to service (outages and support), and to your freedom to leave (lock-in and the cost of exit). It is a form of supplier risk, with features specific to AI.
History
Supplier quality management and third-party risk management long predate AI. Quality standards such as ISO 9001 require control of externally provided processes, products, and services. AI risk frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001, extend this to AI components and services.
When to Use
Assess vendor risk before you buy or renew an AI service, whenever the vendor changes its terms or its model, and at least yearly for important uses.
Step-by-Step
- Write the requirement and the must-pass gates.
- Send a due-diligence questionnaire and ask for security reports and data terms in writing.
- Test on your own data, blind, and report intervals.
- Score the vendors on weighted criteria, and apply the gates first.
- Agree terms: data use, change notice, service levels, security duties, liability, and exit. Have legal counsel review them.
- Monitor after purchase and record the model version.
Examples
- A vendor that fits best but trains on customer data with no opt-out fails a gate and is out.
- An unannounced model update raises the error rate; the contract now requires change notice.
- A free plug-in with broad access to a document store is removed after a vendor review.
Common Pitfalls
- Believing the demo.
- Reading the terms after signing.
- Choosing on price alone.
- No exit plan.
- No monitoring after purchase.