Third-party AI governance introduces issues that arise specifically because an organization depends on an external model provider. These include limited visibility into model architecture, training sources, capabilities and limitations; cybersecurity and information-security risks created through external integrations; and determining contractual responsibility and liability between the organization and vendor. These considerations make A, C, and D directly relevant to third-party governance. Back testing, by contrast, is primarily a model testing or validation methodology rather than a compliance consideration specific to the third-party relationship. Testing third-party AI systems remains an important governance practice, but the term " back testing " itself describes performance evaluation rather than vendor governance. NIST guidance emphasizes third-party transparency, due diligence, security, procurement controls, contractual expectations, and continuing risk management when organizations acquire or integrate external AI systems.

================