Much of the AI in an organisation arrives through vendors: features added to existing software, suppliers using AI in their services, and tools employees adopt.
The Challenge
- AI features appear in software updates without formal procurement.
- Suppliers may process your data with AI.
- Employees adopt free tools independently.
Discover
- Ask vendors about AI features and data use.
- Review software update notes.
- Survey teams and monitor network usage for AI services.
Assess
Classify third-party AI by risk: what data it touches and what decisions it influences.
Control
- Update vendor questionnaires and contracts to cover AI.
- Require notice of new AI features and changes in data use.
- Configure or disable features that don't meet policy.
- Provide approved alternatives to shadow tools.
Monitor
Reassess vendors periodically and after incidents or significant product changes.
Share Responsibility
Contracts can allocate duties, but accountability to your customers and regulators remains yours.