Governing Third-Party AI: Assessments, Contracts, and Ongoing Assurance
summary
Practical playbook for governing third‑party AI: treat a new AI vendor as a fresh onboarding with full assessments and a new MSA amendment, treat AI added by an existing vendor as a scope change; insist on warranties, continuous monitoring and model degradation checks; run a pilot in a controlled environment before broad rollout; refuse blanket training on customer data unless purpose and controls are documented; map sensitive sets (PHI / HIPAA examples) and consolidate questionnaires across procurement, security and privacy using a RACI roles chart.
AI-written summary · about
chapters (13)
- 0:00Governing third-party AI
- 1:05Speaker introductions
- 2:26Third-party AI explosion
- 3:30Balancing vendor assessments
- 5:57Shadow AI challenges
- 7:20AI contracts perspectives
- 9:48Transparency in AI vendor relations
- 11:13AI privacy risks in TPRM
- 14:46Cross-functional AI governance
- 17:16AI model training guardrails
- 21:50Avoiding assessment fatigue
- 23:32Prohibitions on customer data training
- 27:05Starting AI governance
related talks
30mAgentic AI in Action: From Framework to Deployment
39mBuilding a Responsible AI Governance Program
20mSecuring generative AI: Privacy and compliance considerations
28mFrom the Trenches: Solving AI Governance Challenges
16mNavigating the AI Jungle
52mAI Governance: The Security Perspective
27m📙 AI as an Accountable Entity: Governing Risk When Machines Make Decisions ⚖️
30mResponsible and Ethical Governance of AI Models