Use procurement assessments and contract terms that impose: To govern the third-party risk this introduces,

Third-party AI risk is governed through procurement assessments and contractual obligations on the vendor.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Retrain the vendor's model internally so that the company alone becomes fully accountable for all risk.

   Plausible but wrong: retraining is often not possible or desired and does not address contractual third-party control.
2. Treat the embedded service as internal code exempt from any supplier due-diligence requirements.

   Plausible but wrong: an externally sourced component remains third-party risk requiring due diligence.
3. Rely solely on the vendor's public marketing claims about the safety of its AI service offering.

   Plausible but wrong: marketing claims are not verified assurances and do not create enforceable obligations.
4. Use procurement assessments and contract terms that impose AI obligations and rights on the vendor. ✓

   Correct: third-party AI risk is managed through procurement due diligence, assessments, and contractual obligations binding the supplier.

How to remember it

Third-party AI risk is governed through procurement assessments and contractual obligations on the vendor.

More Understanding the Foundations of AI Governance questions

• Evaluate and update those existing policies so they: Which approach best reflects sound governance as it →
• Supervised learning: Which type of machine learning does this describe? →
• Complexity and scalability: Which characteristic of AI harm does this scenario most directly illustrate? →
• All 337 Understanding the Foundations of AI Governance questions →