Governance & Compliance

Vendor AI Risk Register

Every AI vendor you use is a question an examiner can ask.

You can't manage a risk you haven't logged. This is the log examiners expect to see.

What it does

Tracks every third-party AI tool in use and its risk posture in one register, built so the answer to "which AI vendors touch member data" is always current.

What this demonstrates

Designing a vendor risk management framework specific to third-party AI tools, structured around what an examiner actually asks for, not a generic vendor risk template.

Third-party AI risk framework design
Structuring a register around examiner-facing questions
Ongoing-monitoring workflow design, not a one-time inventory

Curious how this was built?

Reach out, I’m happy to walk through the approach and compare notes with other analysts and data folks tackling similar problems.

Get in Touch