Two or three years ago, "does this vendor use AI" was a niche question asked of a handful of analytics suppliers. Today it is the wrong question, because the answer is almost always yes. Generative AI has been added to the products you already buy: the support desk that now drafts replies, the code scanner that explains findings, the HR platform that summarizes candidates, the security tool that triages alerts. Many of these features are powered by a foundation model from a provider your organization has never assessed and, in some cases, your vendor did not prominently disclose. The AI your vendors have adopted is now part of your risk surface whether or not you have written it down.

This paper is a due-diligence playbook for that reality. It is deliberately narrower than a general treatment of AI governance: it assumes you have decided a vendor's AI is in scope and need to assess it well. It gives an evidence-based question set, a method for finding the model providers hiding behind your vendors, a clear account of what AI certifications do and do not prove, and the obligations that fall on you as the organization deploying someone else's AI. For the wider question of governing AI inside your own TPRM program, including using AI to review vendor evidence, see the companion paper, AI in Third-Party Risk Management. The guidance here is vendor-neutral; confirm specific obligations with counsel and your regulators.

What AI certifications prove, and what they do not

Two references now appear in AI vendor conversations, and both are useful when read correctly.

ISO/IEC 42001, published in December 2023, is a management-system standard for AI, the AI equivalent of ISO/IEC 27001 for information security. A certificate is meaningful evidence that a vendor has a governed process for building and operating AI: roles, risk assessment, testing, oversight and improvement. Read it exactly as you read a SOC report. Check the scope: which parts of the organization and which systems it covers, the certification body, and the dates. A certificate scoped to one product line says nothing about the feature you are buying if that feature is out of scope. Crucially, it certifies the management system, not the accuracy, fairness or safety of any specific model.

The NIST AI Risk Management Framework, released in January 2023 with a Generative AI Profile added in 2024, is a voluntary framework, not a certification. A vendor that maps its practices to it is showing a structured approach. There is no NIST AI RMF certificate, so treat any claim of one with caution.

The practical stance: certifications and framework alignment are inputs that raise or lower how deeply you probe, not substitutes for the evidence in the question set above.

Obligations that land on you: the deployer

Assessing a vendor's AI is not only about the vendor. In several regimes, using someone else's AI creates duties for you. The clearest example is the EU AI Act, which entered into force on 1 August 2024 and applies in phases: prohibitions on certain practices from February 2025, obligations for general-purpose AI models from August 2025, and most high-risk system obligations from August 2026. The Act distinguishes the provider who builds an AI system from the deployer who uses it, and places obligations on both. If your organization deploys a vendor's AI in a use the Act treats as high-risk, you may carry duties such as human oversight, using the system per instructions, and monitoring, regardless of what the vendor has done.

The point for TPRM is that the assessment must record which AI systems you deploy, in what use, and therefore which obligations attach to you, not just to the vendor. That record is also what an examiner or regulator will ask to see.

Shadow AI: the exposure that is already here

While programs debate model evaluation, the immediate exposure is simpler and closer. Staff paste customer data, source code and confidential documents into consumer AI tools that were never assessed. Vendors enable AI features by default in products already in use, so data begins flowing to a model provider without a decision being made. Neither of these is a sophisticated model-safety problem; both are discovery and contract problems. The controls that help most are unglamorous: know which vendors have AI features and whether they are on, require disclosure and change notice in contracts, and give staff a sanctioned alternative so the incentive to use unsanctioned tools falls.

Contract clauses for vendor AI

Standard technology contracts rarely address AI. The following clauses, scaled to materiality, close the gaps the assessment surfaces:

• AI disclosure and change notice: the vendor discloses AI features that process your data or affect decisions, and notifies material changes before they take effect
• No training on your data: your data, prompts and outputs are not used to train or improve any model without written agreement
• Model and hosting provider flow-down: foundation model and hosting providers named as subprocessors with equivalent obligations and prior notice of changes
• Data residency and retention: where prompts and outputs are processed and how long any provider retains them
• Human oversight and logging support: features and information you need to oversee and log AI use
• AI incident notification: timely notice of malfunctions, harmful outputs or data exposure, aligned to your incident regime
• Regulatory cooperation: the vendor supports your obligations under applicable AI laws, including the EU AI Act where relevant
• Evaluation and audit rights: access to testing results, limitations and evidence about the AI feature, consistent with existing audit clauses

How VendRisk360 supports this

VendRisk360 lets you run the assessment this paper describes, and treats AI the same way it asks your vendors to: scoped narrowly, with people making the decisions.

Artifact-based assessments across 30+ control domains and configurable questionnaires let you add an AI-specific evidence request to any vendor whose product uses AI, scoped by criticality tier, with reassessment cadence set to your own policy. Because the questions ask for artifacts, the review turns on evidence rather than assurances. The vendor portal gives each vendor one-time-code access to only their own requests, and evidence is checked for scope and currency, not just filed. See Comprehensive Vendor Risk Assessment Services.

The foundation model provider problem is a concentration problem, and [nth-party intelligence](/solutions/nth-party-intelligence/) is built for it: relationships and subservice organizations discovered from SOC reports and your own records map the model and hosting providers sitting behind several vendors, so a provider that supports many of your AI features surfaces as a blast-radius and data-flow question rather than a hidden dependency. Where a vendor's own AI features process your evidence, VendRisk360's optional AI is limited to completeness checks and key-date extraction and an AI-assisted first pass on SOC reports that an expert assessor verifies; every review, rating and sign-off is performed by a person, and the platform does not depend on AI. Our AI governance is aligned to the NIST AI RMF and ISO/IEC 42001; VendRisk360 is not certified to ISO/IEC 42001.

Findings, remediation and formal risk acceptance run through multi-stage sign-off with segregation of duties and a sign-off certificate, so a decision to accept an AI-related risk has an owner and a review date. When an examiner asks how you assessed a vendor's AI, the examiner package export bundles the assessment, evidence, sign-offs and audit trail. Customer data is protected by row-level-security tenant isolation, encryption in transit and at rest, SSO (SAML/OIDC), mandatory MFA, custom roles and a full audit trail. See Security and Board and executive reporting.

How to work with VendRisk360. On the Vendor Lifecycle Management Platform, your team manages vendors, sends AI-specific due diligence through the vendor portal, performs the review and signs off, with every step tracked. With Comprehensive Vendor Risk Assessment Services, you onboard the vendor and certified assessors collect the evidence, perform the review scaled to the vendor's tier with a second-expert quality review, and follow findings through remediation, while you keep final approval. Continuous Monitoring Services add the outside-in view between assessments, and Report-Specific Reviews are available standalone or alongside either. Assessors hold certifications such as CISSP, CISA, CISM, CRISC and ISO/IEC 27001 Lead Auditor and Lead Implementer.

To see an AI-supplier assessment, from evidence request to human sign-off, book a demo.