Vendor Risk in the Age of AI: What's Actually Changed in Third-Party Due Diligence

Third-party risk assessment has historically asked a relatively stable set of questions — access controls, encryption, incident history, subprocessor lists. AI adoption is adding a genuinely new dimension: does this vendor use AI in a way that touches our data, and if so, what governance actually exists around that use?

The questions vendor-risk teams are starting to ask, and often struggling to answer about themselves

• Does the vendor use customer data to train or fine-tune AI models, and is that use contractually restricted?
• Does the vendor's product make AI-driven decisions that affect the customer's own regulatory obligations (e.g. an AI-assisted screening or scoring feature)?
• Does the vendor have an AI system inventory and a named accountable owner per system — or is "we use AI responsibly" an unverifiable assertion?

The asymmetry is real: many organizations asking these questions of their vendors don't yet have confident answers to the same questions about their own AI use. Vendor risk and internal AI governance are converging into the same underlying discipline faster than most organizational charts reflect.