This checklist extends traditional third-party risk management to address AI-specific vendor risks. It provides structured questions to add to existing assessments, covering whether vendors deploy AI systems, whether those systems qualify as high-risk, and how AI is used. The checklist dives deeply into training data sources, data quality, bias mitigation, ownership and licensing, retention, deletion, versioning, and traceability. It also addresses informed consent, data augmentation practices, update frequency, handling of sensitive data, and overall data governance frameworks. The checklist enables organizations to evaluate AI vendors responsibly without creating entirely new assessment processes.

Join for free to read