Third-Party AI Risk: Governing the AI You Do Not Own

In brief

Most of the AI that can hurt an organization was never approved as an AI project. Staff bring some of it in themselves, suppliers switch more of it on inside products already in use, and engineers call the rest through outside model APIs. IBM’s 2025 breach study found that one in five breached organizations reported a breach due to shadow AI. Contract data TermScout shared with Stanford’s CodeX shows AI vendor contracts that cap the vendor’s liability far more often than the customer’s, and rarely promise compliance with the law. The rules push the exposure toward the buyer: Mobley v. Workday may add the vendor as a defendant without removing the employer, the EU AI Act gives deployers duties of their own from 2 December 2027 for Annex III uses, and DORA already keeps banks fully responsible. Five steps, taken in order, cover most of it, and the contract terms are in a free scorecard.

Key Takeaways

→Third-party AI comes in three ways: staff sign up for tools, suppliers switch on model features, and engineers build on models someone else runs. No single control covers all three.
→In IBM’s 2025 breach study, one in five breached organizations reported a breach due to shadow AI, and those with high shadow AI use paid about $670,000 more per breach than those with little or none.
→In contract data TermScout shared with Stanford’s CodeX, 88% of AI vendor contracts capped the vendor’s liability and 38% capped the customer’s. Only 17% committed to comply with all applicable laws.
→The rules push liability toward the buyer: the open Mobley v. Workday case adds the vendor as a possible agent, the EU AI Act gives deployers their own duties, and DORA keeps banks “fully responsible”.
→Govern in five steps, in order: inventory all three layers, score the vendors that matter, contract for what the score found, monitor between renewals, and plan the exit before you sign.

Third-party AI risk is the exposure an organization carries from AI it did not build and cannot inspect: tools staff adopt on their own, models built into the software it buys, and model APIs its products call. Contracts push that exposure toward the buyer, and regulators give the buyer duties of its own that a vendor’s compliance does not discharge.

Most AI governance programs start from a list of the AI projects the company approved. I think that list misses most of the AI in use, and nobody has measured how much of the risk sits outside it. The AI an organization is least ready for arrived without a decision anyone recognized as an AI decision: a browser tab, a feature switched on at renewal, a call to a model API that a developer added in an afternoon. This piece is for the head of third-party risk, or whoever signs off vendors, who has been asked to cover AI with a process built for software that does the same thing every day.

Where Does Third-Party AI Come From?

It comes in by three routes, and each needs a different first control.

Layer	How it gets in	What you can see	First control
Shadow AI	Staff sign up for tools on their own accounts	Very little, until you check network, expense and sign-on records	Find it, then offer an approved tool that is as easy to use
AI inside software you buy	A supplier adds model features to a product you already use	What the contract and the release notes say	Score the vendor and renegotiate at renewal
Model APIs your product calls	Your engineers build on a model someone else runs	Your own code, and the provider’s status and deprecation pages	A fallback, and an exit you have tested

Shadow AI

In the 2024 Work Trend Index from Microsoft and LinkedIn, a survey of 31,000 people in 31 countries, 75 percent of knowledge workers said they used AI at work. Of those, 78 percent said they brought their own tools. Each of those tools is a vendor nobody signed, running on click-through terms. There is no contract with your company, no data agreement and no right to audit.

It shows up in breaches. IBM's 2025 Cost of a Data Breach study covered 600 organizations breached between March 2024 and February 2025. One in five reported a breach due to shadow AI, and organizations with high levels of it paid about $670,000 more per breach than those with little or none. Policy on its own finds none of this. The records you already hold do: traffic to AI providers on your network, expense claims, single sign-on logs and the OAuth grants staff have given to outside apps. In the EU, bring in your data protection officer and any works council first, and report by tool, not by person.

AI Inside the Software You Buy

The second layer is harder to see because nobody bought it as AI. A supplier of HR, sales or service software adds a model to a product you have used for years, often switched on by default. The contract was written for software. Contract data that TermScout shared with Stanford Law School's CodeX center in 2025, drawn from thousands of IT services agreements, shows where that leaves the buyer. CodeX does not say how many of them were AI contracts.

The first two compare badly with contracts in general: the market average for such data rights in TermScout’s data is 63 percent, and 36 percent of SaaS agreements commit to obey the law. Read the last two figures together. In at least half of these contracts the vendor’s exposure has a ceiling and the customer’s does not. Only a third of them, the same data shows, indemnify the customer against third-party intellectual property claims.

The access these features need is a risk of its own. In August 2025 Google's threat intelligence group reported that an actor it tracks as UNC6395 had stolen OAuth tokens belonging to Salesloft’s Drift chat application, which Salesloft sold as an AI chat agent. Between 8 August and at least 18 August the actor used them to export data from numerous corporate Salesforce instances. Salesloft and Salesforce revoked the tokens on 20 August. Nothing in the attack involved the model. The attackers came in through the access an AI agent needs to be useful, a connection to customer records that the victims had approved themselves.

Model APIs Your Product Calls

The third layer is the one your engineers choose. A product built on a hosted model inherits the provider’s roadmap. OpenAI told developers on 14 April 2025 that gpt-4.5-preview would be withdrawn, and it shut the model down on 14 July, three months later. On 26 August 2025 it gave users of its Assistants API a year’s notice that the API would be removed on 26 August 2026. OpenAI gave notice both times. Developers still had to rework their products on OpenAI’s schedule. Teams that run an open-weight model themselves still accept terms its maker wrote, and Open Weight Is Not Open Source, and Nobody Read the Licence covers what those licences ask.

Who Carries the Liability When Vendor AI Fails?

More of it than most buyers assume. One open case, EU law and the main US framework point the same way.

In Mobley v. Workday, in the Northern District of California, the court ruled on 12 July 2024, at the pleading stage, that Workday could plausibly be liable as an agent of the employers using its screening tools. In May 2025 it let an age discrimination claim proceed as a collective. The case is still running, with a class certification hearing set for March 2027, and no court has found that the tools discriminate. My reading, which no court has ruled on, is that the agent theory adds the vendor as a defendant and leaves the employer where it was. An agent acts for a principal. The vendor scorecard piece has the full account.

The EU AI Act gives the business that uses a high-risk system duties of its own. Under Article 26, a deployer must use the system according to the provider’s instructions, assign human oversight to people with the competence and authority to exercise it, monitor it, keep its logs for at least six months, and, if it presents a risk, suspend it and tell the provider and the market surveillance authority. For the Annex III uses, which include screening job applicants and scoring creditworthiness, those duties apply from 2 December 2027. Regulation (EU) 2026/1744, the Digital Omnibus, moved that date from 2 August 2026.

EU banks and insurers are already there. DORA, which has applied since 17 January 2025, says in Article 28 that a financial entity using ICT services from a third party shall "remain fully responsible" for its obligations, and it requires a register of every such contract. For services that support critical or important functions, Article 30 requires "unrestricted rights of access, inspection and audit". DORA defines ICT services as digital and data services provided on an ongoing basis, and I would expect a supervisor to read an AI service a bank subscribes to as one.

In the US, the voluntary NIST AI Risk Management Framework leaves liability to the law. It still expects an organization using third-party AI to manage it, and its GOVERN 6 category asks for policies and procedures "to address AI risks and benefits arising from third-party software and data and other supply chain issues", and contingency processes for failures in third-party AI systems deemed high-risk.

How Do You Govern AI You Do Not Own?

Five steps, in order. Each depends on the one before, and skipping the first is the usual mistake.

Inventory all three layers. List the AI you built, the AI inside your suppliers’ products and the AI staff use without approval. At renewal at the latest, ask each supplier which features in its product use a model, and whose model it is. That second question finds your fourth parties: a vendor running on a foundation model API brings that provider’s risks with it.
Score the vendors that matter. Tier first. Vendors whose AI makes decisions about people, touches regulated data or faces customers get the full assessment. I use the AI Vendor Assessment Scorecard: 30 questions in six equally weighted categories, and ten red flags that pause the deal whatever the score.
Contract for what the score found. The scorecard’s contract section lists ten provisions: audit rights, an AI incident SLA, model change notification, data usage restrictions, portability and exit, liability allocation, compliance maintenance, bias testing, performance transparency and supply chain disclosure. For third-party risk two carry the most weight. Change notification, because a retrained model can move the outputs your controls were set against. And a liability cap sized to what you could owe in a high-risk use, which is rarely the fee you pay. Large vendors often will not move on either. Then record the gap, limit what their AI may decide, and lean harder on monitoring and the exit.
Monitor between renewals. Annual reviews miss what changes in between. Write triggers into the contract that reopen the assessment and oblige the vendor to tell you when one fires: a new model version, a new sub-processor, an enforcement action against the vendor, or a measured drop in performance.
Plan the exit before you sign. Agree what comes back to you and in what format: your data, prompts and outputs, embeddings, and any fine-tuned model you paid for. Agree how long the vendor helps you move, then run one export while the relationship is good. A vendor closing a product, or closing down, will help you more slowly than one that wants your renewal.

If Your Product Runs on Someone Else’s Model

Startups meet the third layer first, usually with no vendor process at all. Four questions are enough to begin. What happens to your product if the model API is down for a day? What changes if the provider retires the model you tuned your prompts on, with three months’ notice? Which customer data goes to the provider, and may it train on that data? And if you serve EU customers in a high-risk use such as hiring, do you know whether you are the provider or the deployer? Providers carry the heavier duties, and neither set depends on company size.

Where an answer is "we don’t know", that is the first piece of work. For the dates and duties in EU law, start with the EU AI Act guide. For a US program, use the NIST AI RMF crosswalk. Then run the inventory. Most of what it finds will not be on your list of AI projects.

Sources and Changes

Microsoft and LinkedIn, 2024 Work Trend Index, 8 May 2024; 31,000 people in 31 countries, 15 February to 28 March 2024.
IBM, Cost of a Data Breach Report 2025, press release of 30 July 2025; 600 organizations, March 2024 to February 2025.
Olga Mack, Stanford CodeX blog, 21 March 2025, reporting TermScout contract data on AI vendor agreements.
OpenAI, API deprecations, read 6 October 2026.
Google Threat Intelligence Group, "Widespread Data Theft Targets Salesforce Instances via Salesloft Drift", August 2025.
Mobley v. Workday, Inc., N.D. Cal. 3:23-cv-00770: docket; order of 12 July 2024.
Regulation (EU) 2024/1689 (AI Act), Article 26 and Annex III; Regulation (EU) 2026/1744, OJ L, 24 July 2026; Regulation (EU) 2022/2554 (DORA), Articles 3, 28, 30 and 64.
NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023, GOVERN 6.

Updated 6 October 2026. Rewritten and cut from about 4,700 words. Removed figures I could not trace to a primary source, among them several shadow AI percentages, a per-incident penalty figure, an outage length and a startup cost estimate, and the weighted assessment the earlier version described, which never matched the scorecard. The ten contract clauses moved into the scorecard’s contract section. Corrections: tell me.

Questions readers ask

What tools help evaluate third-party AI vendors and models?

A written assessment the vendor did not prepare, applied the same way to every vendor that matters. The free AI Vendor Assessment Scorecard asks 30 questions in six categories, lists ten red flags that pause a deal whatever the score, and sets out ten contract provisions. For policy, the NIST AI Risk Management Framework covers third-party AI under GOVERN 6. EU banks and insurers also keep DORA’s register of information on every ICT third-party contract.

Is a company liable for discrimination by its vendor’s AI?

Assume so. In Mobley v. Workday, a US court ruled in July 2024, at the pleading stage, that the vendor could plausibly be liable as the employers’ agent, which adds a defendant without removing the employer. The case is still running and no court has found that the tools discriminate. In the EU, a business using a high-risk system has its own duties under Article 26 of the AI Act, from 2 December 2027 for uses such as hiring and credit scoring.