Only 15% of Organizations Track Vendor AI Use, Survey Finds
What happened
The Compliance Week webcast The State of AI Governance in Third-Party Risk was presented by practitioners James Lindstrom and Andrew McBride on November 4, 2026. It released survey data showing only 15 percent of organizations track all relevant third parties' AI use or governance. The session identified fabricated citations in vendor AI outputs and personal data exposed by vendor AI systems as the two most common failure modes. These failures are reaching enterprise compliance programs because the deploying organization, not the vendor, typically faces the regulatory consequence. The webcast examined how existing third-party risk programs, built around non-AI vendor controls, are structurally mismatched to these risks. Procurement controls, contractual requirements, monitoring, and incident response were each identified as functions requiring AI-specific updates.
Why it matters
- ·An enterprise deploying a vendor's AI-powered service is typically treated as the data controller under laws like the General Data Protection Regulation (GDPR) and US state privacy rules. If that vendor's AI exposes personal data, the regulatory liability lands on the enterprise, not the vendor.
- ·Fabricated citations from vendor AI systems create legal and financial exposure when relied upon in contracts, regulatory filings, compliance reports, or litigation. Most organizations have no contractual provision requiring vendors to disclose when AI generated a deliverable, or to flag outputs that could be hallucinated.
- ·Only 15 percent of organizations track vendor AI governance. Most enterprises cannot respond to regulator inquiries about which third-party AI systems process regulated data. They also lack visibility into what controls those vendors have in place, or who to notify when a vendor AI incident occurs.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Send a targeted questionnaire to your top 20 vendors by data access asking: do you use AI in any service you provide to us, what personal data does that AI process, and what governance controls are in place?
- ☐Review your standard vendor contracts to confirm they require disclosure of AI use, include an obligation for vendors to notify you within a defined timeframe of any AI-related incident that affects your data, and allow you to audit vendor AI controls.
- ☐Ask your legal team whether existing vendor agreements would hold the vendor accountable for harm caused by fabricated AI outputs, or whether that liability currently rests entirely with your organization.
- ☐Build a register of vendors where AI-generated outputs are incorporated into your own regulatory filings, compliance reports, or customer-facing documents, and establish a human review step for those outputs before they are relied upon.
- ☐Identify which internal business units are most likely to have engaged new AI-using vendors without informing your third-party risk function, and require those units to retroactively complete an AI vendor risk assessment.
What to watch next
Regulatory pressure on third-party AI governance is intensifying from multiple directions. Financial regulators including banking examiners are already asking institutions to demonstrate that vendor AI can be audited. EU supervisory authorities treat deploying organizations as accountable for vendor AI failures. Scrutiny will increase as the EU AI Act (Regulation (EU) 2024/1689) moves into full enforcement across high-risk categories. US state privacy regulators are also expanding their automated decision-making inquiries to cover third-party systems. Organizations that cannot document their vendor AI inventory will be poorly positioned when that scrutiny arrives.