Enterprise AI
Vendor risk management
Also known as: vendor risk, provider risk, third-party risk, AI vendor risk
Vendor risk management is the process of assessing, approving and monitoring the third parties an organisation depends on, including AI model providers, SaaS platforms and agencies. In an AI context it covers how a supplier handles your data, how its models behave, and what happens if the service changes, degrades or disappears. It usually combines pre-contract due diligence with ongoing review.
What it is
Vendor risk management is a structured way of deciding which suppliers you trust with data, workflows and customer-facing output, and on what terms. It spans security, privacy, legal, commercial and operational concerns, and for AI tools it adds questions about training data, model changes, retention and output accuracy. The output is normally a risk rating, a set of contractual controls and a review schedule.
Why it matters
Marketing and search teams now buy AI tools quickly, often with a card and a login, which means sensitive content, customer data and brand voice can end up in systems nobody has reviewed. If a vendor changes its model, its pricing or its data handling, published output and reporting can shift without warning. Good vendor risk management keeps that exposure visible and gives you an exit route.
How it works
Practitioners keep an inventory of every AI and martech tool in use, then run each through a proportionate assessment covering data flows, sub-processors, security certification, model and training data policies, and retention. Higher-risk vendors get contractual controls such as data processing terms, no-training clauses, audit rights and notice periods, plus a named internal owner and a re-review date. Findings are tracked in a register so open risks have owners and deadlines rather than sitting in email.
When it applies
It applies before any new tool is adopted, at renewal, and whenever a vendor changes its terms, model provider or ownership. It is especially relevant when a tool touches customer data, generates published content or has write access to your site or ad accounts.
Examples
- A content team wants a generative writing tool, so legal reviews whether prompts and drafts are used for model training before approval.
- A retailer discovers three separate AI transcription tools in use across departments and consolidates onto one reviewed vendor.
- An agency renewing an AI search visibility platform adds a clause requiring notice before the underlying model provider is changed.
How it is measured
- Share of AI and martech tools in the inventory with a completed, in-date assessment
- Average time from vendor request to approval decision
- Number of open high and medium risk findings, and average age of each
- Proportion of contracts containing agreed data processing, training and exit clauses
Insights on Vendor risk management
Related terms in Enterprise AI
- AI agentsAI agents are software systems that use a language model to plan and carry out multi-step tasks, rather than simply returning a block of text. They can call tools, query APIs, browse websites and write to other systems in pursuit of a goal, with varying degrees of human oversight. The term covers everything from a scripted assistant that books a meeting to a research agent that gathers sources and drafts a report.
- AI chipsAI chips are processors designed or optimised to run machine learning workloads, especially the large matrix operations behind training and inference. The category covers GPUs, tensor and neural processing units, and custom ASICs, usually paired with high-bandwidth memory and fast interconnects. They are also called AI accelerators or AI semiconductors.
- AI cost managementAI cost management is the practice of tracking, forecasting and controlling what an organisation spends on AI systems, including model API calls, inference compute, vector storage and the tooling around them. It applies familiar financial discipline to usage that is variable, token based and easy to scale without noticing. The goal is predictable spend at an acceptable level of quality and latency, rather than the lowest possible bill.
- AI drug discoveryAI drug discovery is the use of machine learning and computational models to support the early stages of finding and refining new medicines. Models are applied to tasks such as predicting protein structures, identifying candidate molecules, prioritising targets and estimating properties like toxicity or binding affinity. The aim is to narrow a very large search space before expensive laboratory and clinical work begins.
- AI infrastructureAI infrastructure is the stack of hardware, networking, storage and software needed to train, fine-tune and serve AI models at scale. It spans accelerators such as GPUs, the data centres and power that house them, and the orchestration and serving layers that turn raw compute into working model endpoints. For most marketing teams it is a cost and capacity constraint they consume through APIs rather than something they build.
- AI procurementAI procurement is the process of evaluating, buying and contracting artificial intelligence tools and services, from assistants and content platforms to models accessed through an application programming interface. It covers commercial terms alongside security, data protection, accuracy and integration questions that do not arise with ordinary software. Most organisations run it as a structured review with pilots, stakeholder sign off and defined exit conditions.
Primary research · August 2026
How ChatGPT Shortlists Software Brands
An audit across 10 categories and 60 buying questions. I recorded what ChatGPT reads, throws away and links to when a buyer asks it which software to buy, and what that decides.
- 60
- Questions asked
- 10
- Software markets
- 2,680
- Results read
- 367
- Links shown
Free download
Get the full report
35 pages · PDF · 536 KB. Enter your details and it downloads straight away.