Impose contractual terms on data use: Which action most effectively addresses these constraints?
A pre-procurement risk assessment plus contractual data-use, documentation, and audit terms best manages third-party AI risk.
The question
A retailer plans to procure an AI fraud-detection service from a vendor that will process customer transaction data, retrain on that data, and provide no documentation of its training sources. The retailer must limit supply-chain risk while remaining accountable to regulators. Which action most effectively addresses these constraints?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Rely on the vendor's public reputation and security certifications, since a trusted brand signals acceptable riskPlausible but wrong: reputation and certifications do not give data-use limits, documentation, or audit rights the regulator expects.
- Proceed under the standard acceptable-use policy, treating the vendor like a routine software supplier with no extra termsPlausible but wrong: an AI vendor retraining on customer data is not a routine supplier and needs AI-specific contractual controls.
- Prohibit all external AI vendors and rebuild the fraud-detection capability fully in house to remove third-party riskAlmost right in intent but disproportionate: a blanket ban forgoes viable managed procurement and is rarely feasible or necessary.
- Impose contractual terms on data use, documentation, and audit rights, backed by a pre-procurement risk assessment ✓Correct: assessments plus contractual data-use, documentation, and audit clauses directly address supply-chain risk and accountability.
The trap
Treating vendor reputation or security certifications as a substitute for contractual data-use and audit obligations. How to remember it
A pre-procurement risk assessment plus contractual data-use, documentation, and audit terms best manages third-party AI risk.
How many of these would you get right?
One of 499 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding the Foundations of AI Governance questions
- Differentiate content by role so executives: Which approach best reflects effective AI training and awareness →
- Senior leadership or an AI governance body that owns: In AI governance, which role is generally responsible →
- All stages of the AI life cycle: AI governance policies are intended to ensure oversight and accountability →
- All 104 Understanding the Foundations of AI Governance questions →
Part of the Certsqill AIGP question bank · Understanding the Foundations of AI Governance ·
Every answer, right and wrong, comes with its own explanation.
