Key Takeaways
- Most enterprise AI exposure arrives through vendors—and questionnaires can’t see it, verify it, or keep up with it.
- AI governance platforms assess vendor AI in four moves: discover it, profile it, verify claims against observed behavior, and keep the assessment current.
- The output is a living vendor AI Card—an assessment that describes the system as it is today, not as it was at procurement.
The uncomfortable math of enterprise AI: the models you built are the minority of your exposure. The majority arrived inside products you bought—the CRM that summarizes calls, the HR suite that screens candidates, the support desk that now drafts replies. Each one is somebody else’s model processing your data, under your regulatory obligations.
Traditional vendor risk management meets this with a questionnaire. Here’s what a platform does instead.
Step 1: Find the Vendor AI You Don’t Know About
Vendor AI assessment fails before it starts if the list is wrong. Platforms build the list by observation: scanning SaaS integrations, watching network traffic to model endpoints, flagging AI features vendors enable inside products already under contract. The distinction matters because the riskiest vendor AI is precisely the AI nobody submitted for review—the feature flipped on in a quarterly release, three years after procurement’s questionnaire.
Step 2: Profile What It Touches
For each vendor system: what data flows in, what comes back, where the model runs, who the sub-processors are. This profile—not the vendor’s marketing—determines the risk tier. A vendor chatbot answering public product questions and a vendor model scoring loan applications may come from the same supplier and deserve entirely different scrutiny. AI risk assessment tied to use keeps the effort proportionate.
Step 3: Verify Claims Against Observed Behavior
This is the step questionnaires cannot do. The vendor says the service runs on a specific model, redacts PII, and doesn’t train on your data. A platform can check: probing that verifies model make and version, monitoring that watches what actually crosses the wire, drift detection that flags when the vendor quietly changes something. When a declared posture and observed behavior disagree, you want to be the first to know—not the regulator.
Step 4: Map Findings to Your Obligations
Vendor answers arrive in vendor language. Your examiners speak EU AI Act, NIST AI RMF, and ISO 42001. Platforms translate—each finding lands in your control framework, gaps become tracked items with owners, and AI compliance reporting stops requiring a bilingual analyst reconciling spreadsheets.
Step 5: Keep the Assessment Alive
The defining weakness of third-party AI vendor risk work is staleness: the assessment describes March, the incident happens in September. Continuous attestation—re-probing, re-scoring on change, alerting when behavior shifts—turns the vendor file from a snapshot into a feed. Cranium’s vendor AI Cards are built on this principle: the card is attested by what the system does, not by what the vendor once said.
What This Looks Like in Practice
A mid-size bank runs discovery and finds 34 vendor AI touchpoints; procurement’s register had nine. Profiling tiers them; six are high-risk by use. Verification finds one vendor whose declared model doesn’t match observed behavior—the conversation that follows is awkward and extremely worth having before the exam. The remaining assessments refresh themselves, and the annual vendor review becomes a report read, not a quarter-long project.
That’s the shift platforms make possible: from interrogating vendors annually to observing them continuously, with responsible AI obligations covered by evidence instead of correspondence.
Book a demo to see vendor discovery against your own estate—or go deeper on third-party AI risk.
