Vendor Risk Management (AI)
Framework for assessing and managing risks from third-party AI service providers.
Definition
Vendor Risk Management for AI is the systematic process of identifying, assessing, and controlling risks arising from the use of third-party AI services and products. As organizations increasingly rely on external AI providers, VRM has become critical.
Key components include:
- Vendor assessment: Evaluating AI providers' security, compliance, and ethical practices
- Contractual protections: AI-specific terms covering liability, indemnification, and data rights
- Ongoing monitoring: Continuous assessment of vendor AI performance and compliance
- Exit planning: Strategies for transitioning away from AI vendors if needed
Regulatory guidance (e.g., OCC, FDIC, FRB) requires financial institutions to apply third-party risk management standards to AI vendors, including those providing cloud AI services.
Sources
- •SR 11-7
- •Third-Party Risk Management
Related Terms
Third-Party AI Risk
Risks arising from use of external AI systems, APIs, or services in business operations....
Risk Management
Systematic process of managing AI-related risks....
Model Risk Management (MRM)
Lifecycle controls for development, validation and use of models....
AI Due Diligence
Systematic evaluation of AI risks in M&A transactions, vendor selection, and business decisions....
AI Procurement
Process and policies for acquiring AI systems with appropriate risk controls and governance....