Why your organisation may be exposed and unaware.
AI has quietly embedded itself into the infrastructure of most large organisations. Not just through in-house tools, but via third-party providers, vendors offering everything from automated translation to risk scoring, chatbots, hiring support, compliance monitoring and beyond. And in many cases, these third-party tools are already processing sensitive data, influencing decisions, and learning continuously… all outside the scope of formal oversight.
This is the new frontier of AI risk, and it’s not theoretical. Most firms aren’t exposed because they’ve built the wrong frameworks. They’re exposed because they’ve built nothing at all.
This blog examines why third-party AI requires a new oversight model, the regulatory urgency behind it, and what risk and compliance leaders must do now to regain control.
The Quiet Invasion: Third-Party AI Is Already Here
Third-party AI tools aren’t some future issue. They’re already embedded in:
- SaaS products used by customer service, HR, finance and legal teams
- Third-party vendors conducting onboarding, KYC, transaction monitoring, and data analysis
- Embedded features in CRM platforms, cloud suites, compliance dashboards and more
A 2024 Compliance Week and GAN Integrity report found that just 6% of organisations had complete oversight of how vendors were using AI within their services, and only 8% considered their internal AI governance model mature.
It’s not the AI you know that will hurt you. It’s the one you’re already paying for but can’t see inside.
The Overlooked Risks Lurking in Third-Party AI
Security Weaknesses
Many vendor-supplied models are cloud-hosted, lack robust penetration testing, and share infrastructure with other clients. They’re attractive targets for attackers, especially if they’re handling PII, payment data, or strategic IP.
In 2024, a supply chain attack against MOVEit software affected over 2,500 organisations, largely due to vulnerabilities in a vendor’s file transfer AI layer (NCSC, 2024).
Implication: Your cybersecurity is only as strong as your least transparent vendor. And most aren’t disclosing model architecture, patch timelines, or drift detection.
IP Creep and Data Leakage
What if your data is being used to train someone else’s model?
Many contracts lack specific clauses that prevent vendors from retaining, replicating, or adapting customer data for broader training purposes. This opens up the risk of data leakage, intellectual property exposure, and even regulatory breaches around unauthorised data processing.
Under the UK GDPR, organisations are responsible for ensuring processors (vendors) handle data appropriately, even when the AI logic is opaque.
Implication: If a vendor uses your business data to optimise their model and that model makes a wrong call, you could face both commercial loss and legal risk.
Explainability Black Holes
Explainability is at the heart of ethical AI. But most vendor models operate as black boxes, offering no transparency on how outputs are generated, what data is used, or how decisions are weighted.
The EU AI Act (2024) explicitly requires high-risk systems – used in areas like credit scoring, HR, and legal compliance – to include clear logic documentation. This applies to providers and deployers alike (Article 13 of the EU AI Act).
Implication: If your board or regulator asks, “Why did the system reject this customer?” and the answer is “The vendor won’t say”, that’s a governance failure.
Model Drift, Misalignment and Hidden Decay
AI models are not static. They drift over time as inputs change. A model trained on data from 2022 may behave very differently when applied to 2025 market dynamics.
Models begin to degrade as soon as they go live and that drift can become a “strategic blind spot” if not actively managed, as highlighted in this 2024 Superwise article.
Implication: Vendors may not alert you when model performance degrades, in fact, the vendor may not themselves even be aware of the degradation. That means reputational risk, compliance exposure, and poor decisions, delivered with confidence.
Why the Regulatory Pressure Is Now Impossible to Ignore
EU AI Act: Shared Liability Is Law
The 2024 EU AI Act places legal accountability on both providers and deployers of AI systems, particularly those deemed high-risk. This means that you can be held liable for the output of a vendor model if it’s used within your operations.
UK Regulators: Accountability by Design
In April 2024, the FCA, Bank of England, and PRA issued a joint statement encouraging regulated firms to establish impact assessments and oversight mechanisms for third-party AI tools, even those not directly developed in-house (Skadden, May 2024).
“Boards must not assume third-party provision limits accountability.” – FCA Guidance Note 2024
Audit Standards Are Coming
The BSI is preparing to launch a third-party AI audit standard (expected late 2025) to help firms formalise vendor oversight. This will likely include criteria for transparency, bias detection, and decision logging.
In short: oversight is no longer optional; it’s a precondition for strategic credibility.
A Modern Framework for Third-Party AI Oversight
Here’s what good oversight actually looks like in a third-party AI context:
1. Discover
- Maintain a live registry of all third-party tools with AI components
- Tag each tool with risk level (data access, automation authority, use case sensitivity)
2. Assess
- Perform structured risk reviews on each vendor: security, fairness, IP controls, model explainability
- Require documentation of training data sources, drift history, and update frequency
- Include the AI tool in your models register and subject it to the same levels of review, validation and testing, including any and all data used, as any other high-risk model
3. Contract
- Include AI-specific clauses in vendor agreements:
- Model explainability
- Audit rights
- Prohibition on data reuse
- Escalation procedures for model errors
4. Monitor
- Shadow test key models in production
- Set up internal metrics for drift, performance degradation, fairness anomalies
- Review vendors update logs regularly
5. Review
- Conduct quarterly vendor oversight meetings across compliance, IT and procurement
- Log any operational or reputational issues tied to vendor AI decisions
6. Respond
- Build vendor-specific response protocols into your incident management plan
- Assign named “model owners” internally for key third-party AI services
What Risk and Compliance Leaders Should Do This Quarter
✅ Map where third-party AI already exists across your supply chain
✅ Identify where contracts lack AI-specific clauses
✅ Start a vendor-by-vendor oversight plan using the 6-part framework
✅ Engage procurement teams to embed these checks into onboarding
✅ Report findings to the board, with a request for support, not fear
Final Word: If You Use It, You Own It
Third-party AI might reside outside your firewall, but it now resides within your risk exposure. If a vendor system misbehaves, forget who built it. You’ll be the one explaining it.
Oversight isn’t just due diligence; it’s a sign of operational maturity. It’s about building trust with regulators, credibility with the board, and resilience in every AI-assisted decision.
If you didn’t build it – but rely on it – you have two options:
- Ignore the blind spot and hope.
- Govern it like it’s yours.
The second option might just save your career.
Stay up to date with the latest stories from the world of governance, risk, audit and compliance >>
