Third-party risk management for AI systems should beproportional and risk-based, involvinginitial due diligenceandongoing monitoringthat reflects thelevel of risk posedby the third party's AI system.
From theAI Governance in Practice Report 2024:
“Third-party due diligence assessments to identify possible external risk and inform selection.” (p. 11)
“Legal due diligence may include verification of the personal data's lawful collection by the data broker, review of contractual obligations…” (p. 19)
Afocuses too narrowly on financial stability.
Cis excessive and not scalable or aligned with best practices.
Dinappropriately separates ethical and technical risks; both must be evaluated holistically.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit