Vendor risk governance for AI-enabled knowledge work

Bound the vendor dependency

Describe the exact service, plan, version, deployment region, model route, integrations, user population, data classes, inputs, outputs, storage, logs, administrative identities, actions, and excluded uses. Separate the vendor's general public claims from the configuration the organization has purchased and enabled.

Map fourth parties and external resources that matter to the workflow, including model providers, hosting, identity, retrieval connectors, monitoring, support access, and content-processing services. Record which party controls each dependency and what evidence is available if it fails. A contract may allocate responsibility without demonstrating that a technical setting operates as expected.

The NIST AI RMF Manage Playbook addresses risks and benefits from third-party resources, ongoing monitoring, documented controls, incident arrangements, and system changes. The suggestions are voluntary and need tailoring to the organization's use case.

Sources: [1]

Assemble the vendor dependency dossier

Create entries for intended use, system diagram, data-flow evidence, identity and privilege model, model and software components, provider statements, contract commitments, configuration proof, test evidence, telemetry, incident route, deletion evidence, exception, owner, review date, and expiry trigger. Bind every entry to the exact service and date.

Use separate dispositions for stated, contractually committed, configured, independently tested, observed in operation, unresolved, or out of scope. Do not let a certification label stand in for data-flow verification. Do not let a passing prompt test stand in for access control, retention, or deletion evidence. Record what cannot be inspected.

The NIST Generative AI Profile discusses risks involving third-party components, information integrity, data privacy, security, and change over time. It provides cross-sector risk-management guidance rather than approval of any vendor or deployment.

Sources: [2]

Worked dossier: a synthetic research service

A synthetic strategy team proposes a research assistant that searches licensed documents and public websites. The dossier shows that employees authenticate through the company identity provider, while a vendor-managed connector uses a shared service identity to read the licensed repository. The contract states that customer content is deleted after thirty days, but the administrative console shows a separate diagnostic-log setting with a longer default.

The reviewer marks retention as unresolved and pauses external-document use. The vendor supplies configuration documentation, the organization disables diagnostic content capture, and a technical test places unique synthetic markers in prompts and attachments. Administrators verify expected deletion from the accessible stores and record the areas they cannot independently inspect.

The approval is narrowed to synthetic and licensed non-sensitive material, with manual review before external release. The dossier includes the remaining dependency on the vendor's deletion statement and a trigger to reopen review if the connector, model provider, logging option, region, or plan changes. This synthetic example proves nothing about a real provider.

Monitor change and exceptions

Assign owners for commercial terms, technical configuration, identity, data governance, incident response, and business use. Subscribe to provider change notices, but also compare current documentation and configuration at a fixed cadence. Sample operating logs and rerun risk-selected tests after material changes.

Every exception should state scope, reason, evidence gap, compensating action, approver, start, expiry, and closure test. Track unavailable evidence separately from failed evidence. Reassess when the workflow, user group, data class, model, subprocessor, region, connector, action permission, retention, or downstream sharing changes.

Two Prune can observe how a participant identifies and reasons about vendor evidence within a controlled assessment. It does not operate supplier controls, approve vendors, provide legal conclusions, certify security, or make employment decisions.