Update the dependency map and reassess access controls: What should governance do first?
A new subprocessor changes dependencies and access paths, so mapping and control reassessment should precede approval.
The question
A logistics provider learns that its scheduling vendor will add a new subprocessor to host prompt logs. The service purpose remains unchanged, but the dependency and access path will change. What should governance do first?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Update the dependency map and reassess access controls. ✓The new subprocessor changes the operational dependency and prompt-log access path, requiring refreshed mapping and control assessment.
- Approve the change because the service purpose is unchanged.Unchanged purpose does not eliminate new information, access, security, or responsibility risks introduced by the subprocessor.
- Replace the vendor before reviewing the new subprocessor.Replacement may be considered later, but governance should first understand the changed dependency and evaluate controls proportionately.
- Update the dependency register only after an incident.Waiting for an incident leaves the changed dependency and access path unassessed during ordinary deployment operations.
The trap
A stable purpose does not mean stable risk when suppliers, subprocessors, data paths, or access rights change. How to remember it
A new subprocessor changes dependencies and access paths, so mapping and control reassessment should precede approval.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Classify roles by actual purposes: Which contract approach is required for the described arrangement? →
- Require usable export: Which contract approach best addresses the decisive requirement? →
- Track uptime, routing errors by affected group: For an internal renewal decision, which minimum monitoring set →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.