Sign up with Google
Sign in with Zoho
Businesses are adopting artificial intelligence faster than ever. From customer support chatbots to automated decision-making tools, AI is becoming part of everyday business operations.
But there is something organisations often overlook: not every AI system is developed internally.
Many companies depend on external AI models, APIs, cloud services and third-party software. These suppliers can influence how an AI system performs, handles data and manages security risks.
This creates an important question: Who is responsible when an AI system supplied by a third party creates a regulatory or operational problem?
The answer depends on the organisation's role, the system's intended purpose and the applicable requirements of the EU AI Act.
This is why AI vendor risk management needs to become part of business governance rather than remaining only a procurement activity.
Why Third-Party AI Risks Need Attention
Consider a software company that integrates an external language model into its customer support application.
The company may not have developed the underlying model, but its product still depends on that technology. If the supplier changes the model, experiences a security incident or provides incomplete technical documentation, the software company's operations may also be affected.
Common third-party AI risks include:
- Inaccurate or harmful AI-generated outputs.
- Exposure of personal or confidential information.
- Weak cybersecurity controls.
- Limited access to technical documentation.
- Undisclosed subcontractors or model dependencies.
- Unexpected changes to AI services.
- Unclear regulatory responsibilities.
A structured AI supplier risk assessment helps organisations identify these issues before they become serious problems.
Understanding Provider and Deployer Roles Under the EU AI Act
One of the first steps in EU AI Act compliance is identifying the organisation's role.
A provider develops an AI system, has it developed, and places it on the market or puts it into service under its own name or trademark.
A deployer uses an AI system under its authority for professional activities.
A business can have different roles across its AI systems.
For example, a company using an external AI chatbot for internal support may act as a deployer. A SaaS company integrating an external model into its own commercial application may have provider responsibilities for the resulting AI system, depending on the circumstances.
This distinction matters because provider and deployer obligations are different. Organisations should not assume that purchasing an AI service transfers every regulatory responsibility to the supplier.
EU AI Act Articles That Matter for AI Vendor Management
Several provisions of the EU AI Act are particularly relevant to third-party AI relationships.
Article 25: Third-Party Relationships
Article 25 addresses certain situations in which responsibilities can change within the AI supply chain.
Article 25(4) covers relationships between providers of high-risk AI systems and third parties supplying AI systems, tools, services, components or processes used in or integrated into those systems.
Where applicable, written agreements must specify the information, technical access, capabilities and assistance needed by the provider to fulfil its obligations.
This makes vendor contracts and technical cooperation important parts of AI governance.
Article 53: General-Purpose AI Model Documentation
Businesses integrating general-purpose AI models should also consider Article 53.
Under Article 53(1)(b), providers of general-purpose AI models must make relevant documentation available to downstream providers intending to integrate those models into their AI systems. Annex XII specifies the information to be provided.
Organisations should establish a process for requesting and reviewing the documentation relevant to their integrations.
Article 26: Deployer Responsibilities
Deployers of high-risk AI systems have responsibilities under Article 26.
These include using the system according to instructions, assigning competent human oversight, monitoring operation and retaining automatically generated logs under their control for the required period, where applicable.
A third-party supplier's involvement does not remove the deployer's own responsibilities.
Six Steps to Improve AI Vendor Risk Management
A practical third-party AI risk management process should cover the entire supplier relationship.
1. Create an AI Vendor Inventory
Start by identifying all AI systems used across the organisation.
Include external APIs, foundation models, AI-powered SaaS applications and tools adopted by individual departments.
Record the supplier, system purpose, internal owner, intended use and data processed.
Without an accurate inventory, organisations may overlook AI tools that are already being used in daily operations.
2. Assess Vendor Documentation
Request technical documentation, model limitations, instructions for use and information about system updates.
Understand what the supplier can provide when the organisation needs to investigate an incident or reassess an AI system.
Documentation should be reviewed in the context of the actual business use case.
3. Review Security and Privacy Controls
AI vendors may process customer information, personal data and confidential business records.
Review data storage, processing locations, access controls, security measures and subprocessors.
Also assess applicable GDPR responsibilities and contractual data protection arrangements.
4. Define Contractual Responsibilities
Supplier agreements should establish clear responsibilities for documentation, technical cooperation, incident notification and relevant service changes.
Where Article 25(4) applies, the agreement must address the information, capabilities, technical access and assistance required by the high-risk AI system provider.
5. Monitor Changes and Incidents
Vendor approval should not be treated as a one-time activity.
Models, APIs and AI services can change. These changes may affect performance, data processing and regulatory risk.
Establish a review process for significant updates, incidents and changes in supplier arrangements.
6. Maintain Evidence
Keep records of supplier assessments, risk decisions, technical documentation, agreements and corrective actions.
These records help teams understand why a vendor was approved and how risks are being managed.
How ISO 42001 and ISO 27001 Can Support Supplier Management
ISO standards can provide useful management structures for organisations working with third-party AI suppliers.
ISO/IEC 42001:2023 includes Annex A.10 controls covering relationships with third parties and customers, including supplier-related responsibilities.
ISO/IEC 27001:2022 includes supplier relationship controls 5.19 to 5.23. These address supplier relationships, agreements, ICT supply chains, supplier monitoring and cloud services.
Both standards can support repeatable supplier governance processes. However, certification does not automatically establish that an AI system complies with the EU AI Act. System-specific legal and technical assessments are still necessary.
Can AI Compliance Software Make Vendor Governance Easier?
Managing AI inventories, supplier assessments, documentation and regulatory obligations across different departments can become complicated.
This is where AI compliance software can help.
AnnexOps Ai Compliance Software supports AI governance operations through AI system inventory, regulatory risk classification, obligation mapping, documentation management and evidence tracking.
These capabilities help organisations organise governance activities and maintain visibility into their AI systems and third-party dependencies.
Businesses can also explore the EU AI Act Compliance lifecycle to understand how governance activities can be organised from system identification and risk assessment to documentation and ongoing monitoring.
AnnexOps supports compliance operations but does not replace legal advice or guarantee regulatory compliance.
Final Thoughts
Third-party AI services can accelerate innovation, but businesses need to understand the risks that come with these dependencies.
Effective AI vendor risk management requires more than checking supplier credentials. Organisations need to identify their AI systems, understand provider and deployer responsibilities, review technical documentation, establish contractual safeguards and monitor suppliers over time.
The EU AI Act makes these responsibilities an important part of AI governance.
Companies that build a clear process for managing third-party AI risks will be better positioned to maintain oversight, respond to incidents and organise their compliance activities as their use of AI grows.
