How Businesses Can Manage Third-Party AI Risks

Artificial intelligence is becoming part of everyday business operations. Companies use external AI models, cloud-based tools, automated decision systems and third-party software to improve productivity and customer experiences.

However, adopting an AI tool from a vendor does not remove an organisation’s responsibility to understand how that technology is used. A third-party AI system can introduce risks related to data privacy, security, transparency, reliability and regulatory obligations.

This makes AI vendor risk management an important part of modern AI governance. Businesses need to assess their AI suppliers, understand their responsibilities and maintain clear records of how third-party systems are used.

The EU AI Act adds another reason to take this process seriously.

Why Third-Party AI Risk Management Matters

Many organisations depend on external AI providers instead of developing every system internally. A business might integrate a third-party language model into its customer support software, use an AI-powered recruitment tool or purchase a system that analyses financial information.

These arrangements can create risks that are not always visible during procurement.

For example, a company may not know:

• What data an AI vendor collects or processes.

• Whether the vendor uses customer information to improve its models.

• How the AI system produces or validates its outputs.

• Whether the supplier provides sufficient technical documentation.

• How the vendor reports security incidents or system changes.

• Which organisation is responsible for specific AI Act obligations.

Without proper oversight, these gaps can affect business operations and make it harder to demonstrate responsible AI use.

How the EU AI Act Addresses Third-Party AI Relationships

The EU AI Act, Regulation (EU) 2024/1689, establishes responsibilities for different organisations involved in the AI value chain.

Two important roles are providers and deployers.

A provider develops an AI system, has it developed, or places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority for professional activities.

A business purchasing an AI solution may act as a deployer. However, its role can change depending on how it modifies, rebrands or changes the intended purpose of the system.

Article 25 is particularly relevant to third-party relationships. It addresses situations in which third parties supply AI systems, models, tools, services, components or processes used in high-risk AI systems. Where the provision applies, the provider and third party must specify necessary information, capabilities, technical access and assistance through a written agreement.

Article 26 also establishes responsibilities for deployers of high-risk AI systems, including appropriate use, human oversight and monitoring.

The key point is that organisations should understand their role before relying on a third-party AI solution. A vendor contract alone does not answer every regulatory question.

Six Practical Steps for Managing AI Vendor Risks

1. Build an Inventory of Third-Party AI Systems

Start by identifying every AI system used across the organisation. Include externally hosted models, AI APIs, embedded AI features and software products with AI capabilities.

For each system, record its vendor, business purpose, internal owner, data processed and departments using it.

An AI inventory gives teams a clearer picture of their dependencies. It also helps identify systems that may require additional risk assessment.

2. Assess the Vendor Before Adoption

AI vendor due diligence should go beyond price, product features and service availability.

Review the vendor’s security practices, privacy documentation, data retention policies, model limitations, technical documentation and incident response process.

Ask whether the supplier explains how the AI system works, what information it needs and how updates or changes are communicated.

The level of assessment should reflect the system's intended purpose, the data involved and the potential impact of its outputs.

3. Understand Provider and Deployer Responsibilities

Organisations should establish whether they are acting as providers, deployers or another type of operator under the EU AI Act.

This distinction matters because responsibilities can differ across the AI value chain.

For example, integrating an external model into a product does not automatically make a company the provider of that model. However, certain activities, such as substantial modification or changing the intended purpose of an AI system in relevant circumstances, may affect regulatory responsibilities.

Document the role of each organisation and review it when the system or its use changes.

4. Include AI-Specific Requirements in Vendor Agreements

Traditional supplier agreements may not cover all the information needed for AI governance.

Depending on the system and applicable obligations, contracts should address:

• Data access, processing, and retention.

• Technical documentation and system information.

• Security incident notification.

• Model updates and significant changes.

• Audit cooperation and evidence requests.

• Human oversight and operational support.

• Responsibilities for regulatory assistance.

For relevant high-risk AI system relationships, Article 25(4) specifically addresses written agreements covering the information, capabilities, technical access and assistance needed by the provider.

5. Monitor Vendors After Deployment

Vendor risk management should continue after a contract is signed and an AI tool goes live.

AI models and services can change through updates, new features, altered data practices or changes in their intended use. These developments may affect the organisation's risk assessment.

Set up regular reviews and define who is responsible for monitoring vendor communications, reviewing changes and escalating concerns.

If an AI incident occurs, the organisation should have a clear process to contain the issue, notify relevant internal teams, contact the vendor, preserve evidence and assess applicable reporting or notification duties.

6. Maintain Documentation and Evidence

Risk assessments are useful only when their findings and decisions can be demonstrated.

Keep records of vendor evaluations, contracts, system inventories, risk classifications, approvals, incidents and monitoring activities. Assign owners and review dates so that information remains current.

Well-organised evidence also helps teams respond more efficiently to internal audits, customer questions and regulatory requests.

Why AI Governance Software Can Help

Managing third-party AI risks across spreadsheets, emails and separate documentation tools can become difficult as the number of AI systems grows.

AI compliance software can help organisations centralise important governance activities, including AI system inventories, risk assessments, obligation mapping, documentation and evidence management.

For example, AnnexOps AI compliance software supports organisations in managing EU AI Act and GDPR-related governance workflows. It brings key information about AI systems, risk classifications, obligations and compliance evidence into a more structured process.

This can help AI, legal, security and compliance teams work with shared information instead of maintaining disconnected records.

Organisations can also use an EU AI Act compliance lifecycle approach to connect initial system identification and risk assessment with documentation, oversight and ongoing monitoring.

For a closer look at the role of supplier relationships, risk assessments and governance processes, read this guide to AI vendor and third-party risk management under the EU AI Act.

Make Third-Party AI Risk Management an Ongoing Process

Third-party AI tools can help businesses innovate faster, but they also introduce dependencies that need active oversight.

A practical approach starts with knowing which AI systems are in use, assessing vendors before adoption, clarifying regulatory responsibilities and maintaining appropriate documentation. Organisations should also review supplier relationships regularly instead of treating due diligence as a one-time procurement task.

The EU AI Act makes it especially important to understand how responsibilities are distributed across the AI value chain. With clear ownership and structured governance processes, businesses can manage third-party AI risks while continuing to adopt useful AI technologies.