- 01Third party model risk requires extending your vendor risk framework with AI specific questions covering training data provenance, fine tune access controls, inference time data retention, and model update notification procedures.
- 02Data sent to a third party model API is subject to that vendor's data handling policy. Input classification must determine what data is permitted to reach which external model.
- 03Model updates from a third party provider can change behavior without a version bump. Regression testing for safety and policy properties must run automatically on every model update.
- 04Contractual protections for AI use should specify data retention periods, right to audit, model update notification windows, and incident notification timelines.
Most enterprise AI programs depend on at least one model that is trained, hosted, and updated by a vendor they do not control. The security implications of this dependency are not fully addressed by traditional vendor risk management, which was designed for services with well defined inputs and outputs and stable behavior over time.
A third party language model is a system where the vendor controls the weights, the inference infrastructure, the training data provenance, and the update schedule. Each of these creates a distinct risk surface that requires specific controls, not generic vendor questionnaire responses.
AI specific vendor assessment criteria
Extend your existing vendor risk framework with these questions for any vendor providing a model API that processes enterprise data.
/AI_VENDOR_ASSESSMENT
| Assessment Area | Question | Acceptable Answer |
|---|---|---|
| Training data provenance | Was enterprise customer data used in training, and if so under what consent mechanism? | No customer data in training, or explicit consent with right to exclude |
| Inference time data retention | How long is input and output data retained after an API call, and is it used for training? | Zero retention or explicit opt out, with contractual backing |
| Model update notification | How much advance notice is provided before a model version update? | Minimum 14 days, with a version pin option for enterprise customers |
| Fine tune access control | If enterprise fine tunes are used, who has access to the fine tune data and weights? | Customer controls access, vendor has no read access without explicit permission |
| Incident notification | What is the notification timeline for a model related security incident? | 24 hours for critical, 72 hours for high, with a named contact |
Input classification as a third party risk control
Not all enterprise data should reach all third party models. Input classification is the control that enforces this boundary. Before any AI feature is launched, the data classification of inputs must be documented and matched against the vendor's data handling policy.
- 01Public data. May be sent to any approved third party model without restriction.
- 02Internal data. May be sent to third party models with a zero retention or enterprise tier data handling agreement. Document the agreement before deployment.
- 03Confidential data. May only be sent to third party models under a signed data processing agreement with explicit data handling terms. Legal review required.
- 04Restricted data. Must not be sent to any third party model. Self hosted or on premises inference required.
Default API tiers often include training data rights.
Many model providers include a right to use API inputs for model improvement in their default terms. Enterprise data sent to a standard tier API endpoint may be used to train future model versions. Check the contract tier before deploying any feature that processes internal, confidential, or restricted data.
Metrics for third party model risk management
- 01Vendor assessment coverage. Percentage of third party model providers that have completed an AI specific assessment. Target is 100 percent.
- 02Input classification coverage. Percentage of AI features with documented input classification aligned to the vendor data handling tier. Target is 100 percent.
- 03Model update regression pass rate. Percentage of vendor model updates that passed automated safety and policy regression before reaching production. Target is 100 percent.
- 04Contract currency. Percentage of third party model contracts reviewed in the past 12 months. Model vendor terms change frequently. Target is 100 percent annually.
Building a third party model risk program that scales
Third party model risk management does not require a separate program. It requires adding AI specific criteria to the vendor risk management program you already operate. The most effective implementation assigns an AI security reviewer to the vendor onboarding process and gives them a standard questionnaire and a set of contractual requirements to verify before approval.
The program should also include a model update review process. When a vendor updates a model version, the update should trigger an automated regression test suite that checks safety properties, policy compliance, and behavioral consistency with the previous version. Features that fail regression should be rolled back to the previous model version until the regression is investigated and resolved.