If you read Parts I and II of this series and concluded that the AI governance problem is primarily an internal one — about what your employees do with AI inside your organization — you have only identified half the exposure.

The other half lives outside your walls. It lives in your vendors, your service providers, your agents, your supply chain. And for the vast majority of organizations, it is completely unaddressed.

This is the third-party AI blind spot, and it may be the most dangerous AI risk that compliance programs are ignoring today.

The Governance Reality

As organizations race to scale AI, many have relied upon traditional vendor risk management policies to vet third-party AI vendors and tools. However, implementation of third-party AI tools presents distinctive risks that require tailored due diligence, auditing, contracting, and governance. Because businesses are accountable for outputs generated by third-party AI tools and for vendors’ processing of prompts and other business data, boards and management should ensure legal, IT and procurement teams apply a principled, risk-based approach to vendor management that addresses AI-specific considerations.

That guidance from Cleary Gottlieb’s 2026 Board Directors publication is exactly right — and most organizations are nowhere near meeting it.

Traditional vendor risk management was built for a different era. It asks whether a vendor is financially stable, whether their cybersecurity practices meet baseline standards, whether they carry appropriate insurance, and whether their contracts include the right indemnification provisions. It was not built to evaluate whether a vendor’s AI systems make discriminatory employment decisions, generate inaccurate outputs that will be attributed to your organization, violate privacy frameworks through model training practices, or create regulatory exposure in the jurisdictions where you operate.

Governance teams focus on internal models. The real exposure is vendor AI running inside core business processes with no oversight, no audit trail, and contract terms that shift liability to you. A third of major breaches in 2025 involve third parties. Your AI vendors are part of that attack surface.

Read that again: vendor AI running inside your core business processes, with no oversight and no audit trail, and contract terms that put the liability on you.

The Two Categories of Third-Party AI Risk

As we discussed earlier in this series, third-party AI risk falls into two distinct categories that demand different compliance responses.

The first is legal liability risk. When a vendor acts on your behalf — managing your customer relationships, screening your job applicants, processing your transactions, delivering services in your name — that vendor’s AI is effectively operating as your agent. If that AI engages in discriminatory decision-making, generates false outputs that harm your customers, or violates applicable laws, the liability does not stay with the vendor. It comes home to you.

This is not a novel legal theory. It is the same agency principle that has governed FCPA third-party liability for decades, now applied to AI. Regulators are not waiting for courts to develop the doctrine — they are asserting it now. The EEOC has issued guidance making clear that employers bear accountability for AI-assisted hiring decisions regardless of who built the tool. The CFPB has addressed AI in credit decisions. The FTC has made explicit that consumer protection principles apply to algorithmic outputs.

The second category is reputational risk. When a vendor provides incidental goods or services and does not act on your behalf, your direct legal exposure for their AI misconduct is limited. But your reputational exposure is not.

Reputational risk does not follow legal doctrine. It follows public perception. If your packaging supplier is exposed for deploying racially biased AI in its hiring. If your logistics provider’s AI systems are found to have violated worker privacy. If your technology vendor’s AI tools generate a major ethics controversy. Your organization’s name will appear in proximity to that controversy — and in today’s environment, that association carries real cost regardless of where the legal liability sits.

What Adequate Third-Party AI Due Diligence Requires

The compliance response to third-party AI risk must be proportionate and risk-tiered — but it must actually exist, which for most organizations it currently does not.

For acting third parties — vendors who perform functions on your behalf — due diligence must now include specific AI risk components: What AI tools does this vendor deploy in performing services for us? How are those tools trained and tested? What human oversight exists over AI outputs? Does their AI use comply with applicable employment, privacy, and consumer protection frameworks? What audit rights do our contracts provide?

These questions need to be built into vendor onboarding questionnaires, periodic reassessment processes, and contract templates — right now.

For incidental service providers, a lighter-touch baseline assessment is appropriate, but it must ask whether the vendor’s AI practices create meaningful reputational association risk and whether the vendor interacts with your employees, customers, or data in ways that could generate downstream exposure.

Contracts must also be revisited. Standard vendor agreements were not drafted with AI in mind. They typically do not address what AI tools the vendor may use, how your data may be used to train AI models, what representations the vendor makes about AI accuracy and compliance, or what remedies exist if AI-related misconduct occurs. Every significant vendor contract should be reviewed and updated to address these issues.

The Urgency Cannot Be Overstated

Here is the blunt truth that every compliance officer, general counsel, and board member needs to hear.

The third-party AI risk landscape is not something that can be addressed gradually, through a multi-year compliance program roadmap. The risks are materializing now. Vendors are embedding AI into their products and services faster than procurement teams can track. Regulatory enforcement is accelerating. The EU AI Act’s full enforcement provisions hit in August 2026. And as we noted in Part I of this series — the organizations that wait for the enforcement wave to make the urgency undeniable will be the ones paying the price for that delay.

The FCPA parallel is instructive here too. The companies that faced the harshest FCPA enforcement outcomes were not always the ones with the worst conduct. They were the ones with the weakest governance infrastructure — the ones whose due diligence programs were not built to catch what their third parties were actually doing.

Do not let that be your organization’s story in the AI era.

Build the governance framework. Extend your due diligence program. Update your contracts. Assess your reputational exposure. And do it now — before the enforcement action, the data breach notification, or the front-page story forces the issue in the worst possible way.

The window to get ahead of this is still open. But it is closing faster than most compliance programs are moving.