How do you manage third-party AI risk?

Identifying third-party AI risk

Identifying third-party AI risk requires a complete inventory of AI tools in use; including AI features embedded in software platforms, not just standalone AI tools. Once the inventory exists, each tool should be assessed against three risk dimensions. Data privacy: what data enters the tool, where is it processed, is it used for training, what are the contractual protections? Reliability: what is the vendor’s documented accuracy and error rate for this tool in contexts like yours, what monitoring exists, and what is the vendor’s escalation process for reliability issues? Regulatory compliance: what is the EU AI Act classification of this tool in your usage context, has the vendor provided the required technical documentation, and what deployer obligations does your use of this tool create? Many organisations have no formal process for this assessment, meaning AI tools are adopted based on functionality and price, with no systematic evaluation of the risks the vendor relationship creates.

Due diligence on AI vendors

Ask the supplier for evidence relevant to the intended use: instructions, limitations, security and data-processing terms, change notifications and incident routes. For a high-risk system, establish the provider's applicable conformity position and the information needed for your deployer duties. A customer does not automatically have a right to the entire technical file or training dataset. Article 27 fundamental-rights assessment applies to specified entities and uses, not all purchasers. Where personal data is involved, assess GDPR roles, processing terms, retention and international-transfer safeguards. Record unresolved points before approving a consequential use.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.