Third-Party AI Vendor Due Diligence

Objective

Ensure that third-party AI products and AI-enabled services are subject to risk-based due diligence covering data handling, model provenance, security testing, incident response, compliance posture, and contractual safeguards before procurement and on an ongoing basis.

Applicability

AI types

LLM, Agentic AI, Generative AI, Traditional ML, Computer Vision, Multi-modal

Deployment models

SaaS, Hybrid

Lifecycle stages

Strategy & Planning, Deployment, Operation & Monitoring

Risk domains

Third Party, Data, Model

Regulatory regimes

EU AI Act, GDPR, Banking, Healthcare, ISO 42001, NIST AI RMF

Company size

MidMarket, Enterprise

Rationale

Most enterprises consume AI through third-party SaaS rather than building it. Vendor data-handling defaults (training-on-prompts, sub-processor sprawl, unclear deletion guarantees) create the most acute and most common AI risk vectors. Standardized due diligence at intake and on renewal is the only scalable defense; it also satisfies EU AI Act deployer obligations and supervisory expectations (OSFI B-10, OCC third-party guidance).

Control narrative

Every AI product or AI-enabled service intended for production use undergoes structured due diligence using the AI Vendor Questionnaire prior to contract signature, and on renewal. The questionnaire covers vendor profile, data handling (training use of customer data, isolation, residency, retention, deletion), model provenance, security testing and certifications (SOC 2 Type II, ISO 27001, ISO 42001), incident response, compliance posture (EU AI Act, GDPR, sectoral law), contractual provisions (IP indemnity, audit rights, termination assistance, deprecation notice), and operational continuity. A weighted score and explicit red-flag triggers produce a risk-tier classification (Low / Moderate / High / Reject). The AI Governance lead, jointly with Procurement and Legal, owns the process. Findings flow to the AI Risk Register and high-tier vendors enter quarterly monitoring.

Test of Design

Procedures

1. Obtain the Third-Party AI Vendor Policy and confirm it requires structured due diligence before procurement and on renewal for any AI-enabled product/service.
2. Confirm the AI Vendor Questionnaire exists and covers, at minimum: data handling, model provenance, security testing, incident response, compliance, contractual provisions, operational continuity.
3. Confirm the scoring methodology is documented, including weights and red-flag triggers that fail a vendor regardless of total score.
4. Confirm Procurement intake routes any AI-enabled product to the AI Governance lead for assessment.
5. Confirm contracts include required AI-specific clauses (IP indemnification covering training data, training-use of customer data terms, deprecation notice, audit rights, deletion certificate).
6. Confirm linkage to the AI System Inventory (AI-CTRL-001) and Risk Register so vendor risk is tracked.

Inquiries

• Who owns the AI vendor assessment process?
• How is an AI product distinguished from a non-AI product at intake?
• What is the override path if a business team wants to proceed despite a 'High' or 'Reject' classification?
• How are vendors re-assessed on contract renewal or material model change?
• How is sub-processor risk handled when the AI vendor relies on another foundation model provider?

Inspections

• Third-Party AI Vendor Policy.
• AI Vendor Questionnaire template and scoring rubric.
• Procurement intake workflow documentation.
• Sample of completed assessments and resulting scorecards.
• Standard AI contract clauses / addenda.

Test of Operating Effectiveness

Procedures

1. For the audit period, obtain the population of AI-related vendor contracts signed or renewed.
2. For a sample, confirm a completed AI Vendor Questionnaire pre-dated contract signature/renewal.
3. For each sampled assessment, confirm scoring was applied per the rubric and risk-tier classification matches the resulting score and red flags.
4. For any 'High' or 'Reject' classifications that proceeded to contract, confirm documented override approval at the required level (typically CISO or CRO).
5. For a sample, confirm executed contracts include required AI-specific clauses by inspecting the contract directly.
6. For 'High'-tier vendors, confirm quarterly monitoring activities occurred (re-scoring, news/incident monitoring, SOC 2 bridge letter reviews).

Sample-size guidance

Reperformance

• For 2 sampled vendors, independently re-score the questionnaire using the source documentation provided by the vendor and compare to recorded score.
• For 1 sampled contract, independently confirm presence of the required AI-specific clauses against the contract redline.

Evidence requirements

Required

• Third-Party AI Vendor Policy PDF/Word · At fieldwork
• Completed AI Vendor Questionnaires for sampled vendors PDF/Word · Per sample
• Scored vendor scorecards PDF/Excel · Per sample
• Executed contracts (relevant AI-specific clauses) PDF · Per sample
• Override approval records for High/Reject vendors that proceeded Email/system record · Per sample

Supporting

• Vendor SOC 2 Type II reports, ISO 27001/42001 certificates PDF · Per sample
• Quarterly monitoring artifacts for High-tier vendors System export · Quarterly

Retention: Lifetime of vendor relationship + 7 years after termination (regulated); + 3 years (otherwise)

Framework mappings

Related controls

• AI-CTRL-001

  AI System Inventory and Classification

• AI-CTRL-005

  AI Risk Assessment and Impact Assessment

• AI-CTRL-013

  Personal Data Minimization in Training and Inference

References

• ISO/IEC 42001:2023 — AI management systems, clause 8.4
• NIST AI RMF — GOVERN-6 Third-Party Management
• EU AI Act, Articles 25–28
• OSFI Guideline B-10 — Third-Party Risk Management