AI Vendor & Third-Party Risk Assessment
The AI risk that gets missed most often isn't the tool your team adopted on purpose — it's the AI quietly embedded in a vendor product you're already using. I assess AI capabilities inside vendor and third-party tools the same way I'd assess any other third-party risk: what data it touches, what it does with that data, and whether the vendor's own controls hold up. I built Autodesk's third-party AI risk criteria specifically to catch this category of risk.
What this covers
AI-specific vendor questionnaires
Questions that actually surface what a vendor's AI does, not generic security boilerplate that skips past it.
Data flow & training-data review
Whether your data trains the vendor's model, and what that actually means for confidentiality.
Embedded-AI discovery
The AI features already live inside tools adopted for an unrelated reason, long before anyone assessed them.
Contract & DPA language
Making sure AI-specific risk is actually addressed in the paperwork, not just assumed to be covered.
Ongoing monitoring
Vendor AI capabilities change fast — a one-time review goes stale quickly without a recheck cadence.
Who this is for
Organizations with an existing vendor risk program that hasn't yet been updated to specifically evaluate AI, or ones discovering that a long-trusted vendor recently added AI features nobody assessed. Most organizations still lack data-security requirements specific to AI — this closes that gap inside an existing third-party risk process rather than building a separate one.
Have this problem right now?
I take on a limited number of clients at a time so every engagement gets real attention. Let's talk about scope, cadence, and fit.
Book an introductory call