AI Vendor Risk Exposes Governance Gaps in Third-Party Risk Management (TPRM)

Artificial intelligence (AI) vendor risk exposes governance gaps in third-party risk management (TPRM). Vendor reviews typically begin when procurement records a new relationship, but AI can enter through employee subscriptions, newly activated features, or business-unit integrations. As a result, organizations may be responsible for AI-related risks even when their vendor risk processes didn’t identify the tool, writes Henry Umney of Mitratech. 

Governance gaps in TPRM are not new. Shadow AI resembles the longstanding shadow-vendor problem, but AI tools raise concerns because users can enter confidential information into chatbots, coding assistants, and writing tools. Three potential entry points are important: shadow sign-ups, feature flips within already-approved software, and business-unit integrations that connect AI capabilities to systems. 

The European Union (EU) AI Act has added another layer. The EU AI Act holds organizations accountable for AI tools even if they were undetected during the vendor risk process. Article 50’s general transparency and disclosure requirements took effect on August 2, 2026, while Article 26’s high-risk AI system deployment and monitoring obligations were deferred to December 2027. 

Traditional vendor risk assessments that focus primarily on security and financial stability may no longer provide sufficient oversight. At the same time, information gathered for a vendor risk record provides what is needed for an AI governance review. Integrating these two efforts can reduce duplicated assessments and help organizations address AI-related vendor risks. 

The proposed response is to strengthen the vendor-risk front door rather than create a separate AI program. Organizations should review contracts, broaden intake triggers, reassess vendors when features change, prepare for log-retention requirements, and ask whether vendors use AI to process the company’s data.