ai Vendor Risk Assessment

# 22. AI Vendor Risk Assessment

**Domain:** Third-Party Risk
**Level:** Practitioner

## Use Case

Conduct a structured, tier-calibrated risk assessment of an AI vendor, model provider, or AI-powered third-party service before onboarding or at periodic review. Depth of assessment is automatically calibrated to the vendor's criticality and data access. Covers AI model governance, data privacy, transparency, security, regulatory compliance, contractual protections, and concentration risk. Produces a risk rating, due diligence questions, and onboarding conditions.

## Variables

| Variable | What to Enter | Example |
|----------|--------------|---------|
| `[VENDOR_NAME]` | Name of the AI vendor or product | e.g. OpenAI (GPT-4o via Azure), Salesforce Einstein, a bespoke ML model from a specialist provider |
| `[AI_PRODUCT_OR_SERVICE]` | The specific AI product or service being assessed | e.g. LLM API processing customer service queries; AI credit scoring model; AI-powered document review tool |
| `[INTENDED_USE_AND_DATA]` | How the AI will be used and what data it will access | e.g. Drafting customer responses - processes customer PII and account data; automated credit decisions - accesses financial transaction history |
| `[CRITICALITY_TIER]` | The vendor's criticality to your organisation | e.g. Tier 1 Critical: failure halts core operations or affects regulated decisions; Tier 2 Important: significant operational impact; Tier 3 Standard: limited impact, easily replaceable |
| `[YOUR_REGULATORY_CONTEXT]` | Your organisation's key regulatory obligations | e.g. FCA regulated - SYSC 8 outsourcing; NHS - DSPT; EU AI Act deployer; GDPR controller; or list your key regulations |

## The Prompt

Copy everything below this line. Replace all `[VARIABLES]` with your specific information. Paste into Claude, GPT-4o, Gemini, or any capable LLM.

---