A company relies on an external vendor's AI component: Which of the following situations is the clearest

Relying on an external vendor's AI component the company cannot fully control is the core third-party AI risk.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. A company documents its own internally built AI model's training process solely for its internal audit records.

   Plausible but wrong: internal documentation is a governance activity, not an instance of third-party risk.
2. A company trains its employees on the responsible internal use of an AI tool built by its own staff.

   Plausible but wrong: internal training on an in-house tool does not involve an external supplier's risk.
3. A company's own engineers write and fully control every single line of an internally built AI model.

   Plausible but wrong: fully in-house development is first-party, not third-party, risk.
4. A company relies on an external vendor's AI component whose behavior it cannot fully inspect or control. ✓

   Correct: dependence on an outside supplier's AI component is precisely the third-party/supply-chain risk these policies address.

How to remember it

Relying on an external vendor's AI component the company cannot fully control is the core third-party AI risk.

More Understanding the Foundations of AI Governance questions

• Intellectual property policy: Which existing organizational policy most directly needs to be evaluated and →
• It produces new content such as text: In common AI terminology, what most distinctly characterizes 'generative →
• Ethics and bias risk: Which category of AI risk does this situation most directly illustrate? →
• All 337 Understanding the Foundations of AI Governance questions →