Third Party risk

Establish and maintain documented provenance and lineage for all training, fine-tuning, and evaluation data used by AI systems, including legal basis, licensing, sensitivity classification, and transformations applied.

Ensure that third-party AI products and AI-enabled services are subject to risk-based due diligence covering data handling, model provenance, security testing, incident response, compliance posture, and contractual safeguards before procurement and on an ongoing basis.