Walk into almost any enterprise AI governance meeting this quarter and the conversation will circle a familiar set of choices: should the organization align to the NIST AI Risk Management Framework, pursue ISO/IEC 42001 certification, build a bespoke internal framework, or simply track EU AI Act compliance and call that governance. Committees spend months on this decision. Consultants build comparison matrices. Boards ask which one the peer group is adopting. It is, by most measures, a reasonable and well-intentioned question.
It is also, on its own, the wrong place to spend the scarce attention a governance program has in its first year. A framework tells an organization how to classify, assess, and monitor AI risk once it knows where that risk sits. It does not tell anyone which of the organization's several hundred or several thousand vendor relationships already carry AI exposure, what those AI systems actually do, or whether the vendors behind them can produce the documentation a regulator, auditor, or customer will eventually ask for. Choose the most rigorous framework available and apply it only to systems built in-house, and the coverage gap remains exactly as large — because for most enterprises, AI arrives predominantly through procurement, not through internal development.
That gap is no longer a theoretical governance concern. It is becoming an active area of regulatory and procurement scrutiny, and the shift accelerated meaningfully this month.
Most risk and procurement leaders can't answer that with confidence — see how a vendor intelligence platform makes AI exposure visible across an entire third-party portfolio, not just the systems built in-house.
Explore Crest IntelligenceThe Framework Debate Is Real Work — But It's the Wrong First Question
None of this is an argument against frameworks. The NIST AI Risk Management Framework and ISO/IEC 42001 both give a governance program real structure — shared vocabulary for risk categories, a defined lifecycle for assessing and monitoring AI systems, and in ISO 42001's case, a certifiable management-system standard that can be pointed to externally. Choosing one, or blending elements of several against a company's specific regulatory footprint, is legitimate and necessary work.
The problem is sequencing, not substance. A framework answers "how do we assess AI risk once we've found it." It does not answer "where is our AI risk actually located," and for most enterprises that second question is unresolved. Internal AI development is usually visible — it goes through data science teams, model registries, and internal review. Vendor-introduced AI is not. A CRM adds a generative summarization feature in a quarterly release. A background-check provider swaps in a new matching model. A customer-support platform starts routing tickets through an LLM-based triage layer. None of these changes typically triggers a new contract review, a security reassessment, or a governance committee meeting — yet each one moves AI risk directly into the enterprise's operations, under a vendor relationship that predates the feature and was never assessed for it.
Where AI Risk Actually Enters the Enterprise
The uncomfortable finding for most governance programs, once they look honestly, is that internally built AI is usually the minority of total exposure. The majority arrives embedded in software the organization already licenses — HR platforms scoring resumes, finance tools flagging anomalous transactions, sales platforms generating outreach content, security tools classifying threats. Each of these products may have added AI capability well after the original procurement decision, through an update the vendor announced in a release-notes blog post rather than a formal notification to the customer's risk or legal team.
This is precisely the gap most third-party risk programs are structurally positioned to close, and most AI governance programs are not — because TPRM already runs the discovery, questionnaire, and continuous-monitoring machinery needed to track a vendor relationship over its full lifecycle, not just at the point of signing. The organizations moving fastest on this problem are not the ones with the most sophisticated internal AI framework. They are the ones connecting AI governance to the vendor governance discipline that already exists inside third-party due diligence and extending it to ask a question most current vendor questionnaires still don't: does this product use AI, and if so, what kind.
Why August 2026 Changes the Urgency, Not Just the Theory
On August 2, 2026, the EU AI Act's main transparency obligations — including Article 50's disclosure requirements — took effect as originally scheduled, and the European AI Office's enforcement powers over providers of general-purpose AI models became active. The Act's more prescriptive high-risk system obligations were not part of this phase; those apply from December 2027 for stand-alone high-risk systems and August 2028 for AI embedded in regulated products. But treating that runway as reason to wait misreads what already changed: transparency, technical documentation, and post-market monitoring duties are now live and enforceable for the providers of the underlying AI models — which, for most enterprises, means a growing share of software vendors sit somewhere in that chain.
Procurement-facing guidance published around this milestone is converging on the same practical demand: enterprises should expect to conduct full inventories of AI systems in use, classify them by risk level, and require vendors to produce conformity information, technical documentation, and traceability evidence — not as a future compliance project, but as a present procurement qualification. Governance certification and third-party assessment reports are shifting from a competitive differentiator to a threshold requirement for AI-enabled vendors, well ahead of the high-risk deadlines that dominate most framework discussions.
Crest.Digital layers a dedicated AI Risk Assessment alongside existing Cyber, ESG, BCP, and Compliance questionnaires — with agentic AI workflows that keep vendor AI disclosures current instead of stale at renewal.
This is the specific shift that separates this moment from the general "AI governance is coming" framing many organizations have already absorbed and, in some cases, tuned out. The transparency and documentation duties are not hypothetical anymore — they are active obligations sitting on the providers many enterprise vendors depend on, and the practical question for a buyer is no longer whether to eventually assess AI-enabled vendors, but whether the assessment mechanism exists today or will have to be built under pressure once a customer, auditor, or regulator asks for evidence the organization does not yet have.
An 8-Point Framework for AI Vendor Governance
The following framework does not replace a chosen governance standard — it operationalizes the vendor-facing half of whichever framework an organization has already selected, closing the gap between "we have a framework" and "we know which vendors it needs to cover."
Mandatory AI Disclosure at Onboarding and Renewal
Every new vendor and every renewal cycle asks directly whether the product uses AI, machine learning, or an embedded third-party model, rather than assuming vendors will volunteer it.
Continuous Cross-Referencing Against Product Usage
Check vendor disclosures against release notes, product documentation, and API integrations, since AI features routinely ship through updates that bypass contract review.
A Dedicated AI Risk Assessment Track
Run a distinct AI-specific questionnaire alongside existing Cyber, ESG, BCP, and Compliance assessments rather than retrofitting AI questions into a cyber template built for a different threat model.
Model and Provider Identity Capture
Record which model or foundation model powers the vendor's AI feature, who provides it, and whether it is proprietary, licensed, or open-source.
Human Oversight and Documentation Evidence
Collect the technical documentation, human-oversight description, and post-market monitoring approach the vendor can produce today — not a general compliance attestation.
Business-Impact Classification
Tier AI-enabled vendors by the consequence of the decision the AI makes — credit, hiring, safety, customer outcomes — rather than by contract value or vendor size.
Reassessment Triggers Beyond Renewal
Treat a disclosed model change, retraining event, or new AI feature launch as its own reassessment trigger, independent of the standard contract renewal calendar.
Audit-Ready Evidence Trail
Keep every disclosure, assessment, and documentation request retrievable in a form that can be produced the day a customer, auditor, or regulator asks for it.
Points one and two are where most programs are currently weakest. Disclosure at onboarding is common enough; catching AI capability added after onboarding, through a routine product update, is rare — and it is precisely the gap that lets a vendor relationship carry undisclosed AI exposure for years without anyone noticing.
Building the AI Questionnaire Track: A Six-Step Playbook
Standing up this capability does not require a new procurement platform or a parallel governance function — it requires extending workflows most TPRM programs already run.
AI Vendor Governance Checklist
- Add the disclosure question everywhere: Onboarding, renewal, and any material contract amendment — not just new vendor intake.
- Don't wait for vendors to tell you: Cross-reference disclosures against product documentation and release notes on a recurring basis.
- Build the AI track once, apply it broadly: A single dedicated AI Risk Assessment can trigger for any vendor confirmed to use AI, regardless of category.
- Ask for evidence, not assurance: Model identity, training-data provenance, and human-oversight description carry more weight than a general compliance statement.
- Prioritize by impact, not contract size: A low-spend vendor whose AI touches hiring or credit decisions can carry more exposure than a large vendor whose AI only optimizes internal scheduling.
- Make re-screening continuous: Model updates and subprocessor changes happen faster than annual review cycles can catch them.
The step organizations most often skip is the second one — assuming vendor disclosure is complete simply because a question was asked once. AI features are added to products at a pace that outruns the typical annual or biennial vendor review, which means a disclosure captured at onboarding is frequently stale well before the next scheduled reassessment arrives.
Where Agentic AI Fits — Closing the Vendor Visibility Gap at Scale
Cross-referencing vendor AI disclosures against product documentation, release notes, and integration points across a portfolio of hundreds or thousands of third parties is not a task a compliance team can sustain through periodic manual review. This is exactly the kind of continuous, high-volume cross-referencing work agentic AI is well suited to, applied directly to the vendor AI discovery problem.
Continuous Discovery of Undisclosed AI Dependencies
An agentic workflow can continuously monitor vendor product updates, release notes, and public documentation for signals that a product has added AI capability since the last disclosure was captured, flagging the vendor for reassessment rather than waiting for the next scheduled review. This extends the same discovery discipline behind shadow AI detection to the specific problem of AI arriving quietly through an already-contracted vendor relationship.
AI-Assisted Cross-Referencing at Portfolio Scale
Once a potential AI dependency is flagged, an agentic layer can pre-assemble the relevant evidence — the vendor's prior disclosures, any technical documentation already on file, public statements about the model or provider involved — into a form ready for human review, compressing what would otherwise be hours of manual research per vendor into a pre-built case file. This mirrors the evidence-assembly discipline behind structuring a dedicated AI vendor risk assessment, applied specifically to surfacing vendors that need one in the first place.
Human-in-the-Loop on Every Risk-Acceptance Determination
What the agentic layer does not do is decide whether a vendor's AI use is acceptable, whether a disclosed gap is tolerable, or how to weigh a low-probability but high-impact AI risk against a commercial relationship the business depends on. That judgment stays with a named risk owner, informed by evidence the agent surfaced rather than replaced — consistent with how Crest.Digital frames accountability for third-party AI risk more broadly: automation handles the continuous, volume-heavy discovery and evidence work, while the acceptance decision remains a human one.
Enterprises that treat this as a vendor visibility problem first and a framework-selection problem second will find the framework decision gets easier, not harder — because a framework applied to a portfolio the organization can actually see is a materially more tractable exercise than one applied to an AI footprint still being discovered.
Frequently Asked Questions
On August 2, 2026, the EU AI Act's main transparency obligations (including Article 50) took effect as scheduled, and the AI Office's enforcement powers over general-purpose AI model providers became active. High-risk system obligations were not part of this phase — those apply from December 2027 for stand-alone high-risk AI systems and August 2028 for AI embedded in regulated products. In practical terms, transparency, technical documentation, and post-market monitoring duties are now live and enforceable for GPAI providers, while the more prescriptive high-risk rules are still on the runway. Enterprises procuring AI-enabled products from vendors should expect transparency and documentation requests to arrive well before the high-risk deadlines land.
A framework such as the NIST AI Risk Management Framework, ISO/IEC 42001, or an EU AI Act alignment program defines how an organization should classify, assess, and monitor AI risk. It does not, by itself, tell an enterprise which of its vendors are actually using AI, which specific systems that AI touches, or whether those vendors can produce the technical documentation and human-oversight evidence the framework calls for. A well-chosen framework applied only to internally built systems still misses the majority of an enterprise's real AI exposure, since most organizations encounter AI far more often through purchased software than through models they build themselves.
Most existing cyber, ESG, business-continuity, and compliance questionnaires were built around different risk models and don't ask the questions that matter for AI — model or foundation-model identity, training-data provenance, retraining cadence, human-oversight thresholds, or subcontracted model dependencies. Rather than overloading a cyber questionnaire with AI questions it wasn't designed to interpret, most enterprises are better served by a dedicated AI Risk Assessment track that runs alongside existing questionnaires and is triggered whenever a vendor's product involves AI, machine learning, or an embedded foundation model.
Start with a targeted disclosure question added to vendor onboarding and renewal workflows — does this product use AI, machine learning, or a third-party foundation model, in any capacity — rather than relying on vendors to volunteer the information unprompted. Cross-reference disclosed answers against product documentation, release notes, and API integration points, since AI features are frequently added to existing products through updates that don't trigger a new contract review. Vendor AI adoption is also accelerating quickly enough that a one-time inventory goes stale within months, which is why the discovery step increasingly needs to be continuous rather than a point-in-time exercise during onboarding.
Manually re-checking every vendor relationship for new or changed AI usage does not scale once a portfolio reaches hundreds or thousands of third parties. An agentic AI layer can continuously cross-reference vendor disclosures against product documentation and public signals, flag vendors whose AI footprint appears to have changed since the last assessment, and pre-assemble the evidence a reviewer needs to make a determination. It does not decide whether a given AI use case is acceptable or replace the human judgment call on risk acceptance — that determination stays with a named person, informed by evidence the agent surfaced rather than replaced.