The 2026 Black Kite Third-Party Breach Report found that for every vendor breached, an average of 5.28 downstream organizations were compromised-the highest cascading impact on record-with a 117-day median gap between breach occurrence and public disclosure. In a growing number of those incidents, the vector was an AI tool: a productivity application connected to corporate identity infrastructure, a generative AI service with access to sensitive data, or a vendor-side model operating without visibility on either end of the relationship.
Regulators have already acted on this pattern. In May 2025, the Pennsylvania Attorney General settled with Home365, a property management company, over allegations that its AI platform contributed to delays in maintenance and unsafe housing conditions. Home365 was not an AI developer. It was a company that deployed an AI tool purchased from a third-party vendor. The defense, "we bought it from a vendor," did not hold.
The NIST AI Risk Management Framework (AI RMF) anticipates this kind of issue. Its companion resources and expanded guidance published through 2025 explicitly elevated supply chain vulnerabilities and third-party model assessment from secondary considerations to primary ones. Most TPRM programs haven't caught up. Each of the four NIST AI RMF functions-GOVERN, MAP, MEASURE, and MANAGE-has direct application to the AI risk your vendors introduce.
What Is the NIST AI Risk Management Framework?
The NIST AI Risk Management Framework, released in January 2023, is a voluntary framework developed by the U.S. National Institute of Standards and Technology to help organizations manage risks associated with AI systems throughout their lifecycle. It applies across any industry, company size, or geography. Since its initial release, NIST has expanded the framework's ecosystem considerably, most notably with the Generative AI Profile (NIST AI 600-1), released July 2024, which addresses risks from vendor-supplied AI models and large language systems specifically.
While voluntary, the AI RMF carries significant regulatory weight. The FTC, CFPB, FDA, SEC, and EEOC all reference its principles in enforcement guidance. On February 19, 2026, the Treasury Department released the Financial Services AI Risk Management Framework, built directly on NIST's structure in partnership with the Cyber Risk Institute, introducing 230 control objectives mapped across the AI lifecycle for financial institutions, including a dedicated third-party risk section. The AI RMF is also widely used as an operational companion to EU AI Act compliance, particularly for organizations managing high-risk AI system obligations phasing in through August 2026.
Part 1 covers risks and characteristics of trustworthy AI systems. Part 2 describes four functions: GOVERN, MAP, MEASURE, and MANAGE. Three categories are explicitly scoped to third-party and supply chain risk: GOVERN 6 (policies for third-party software and data), MAP 4 (risk mapping for all AI system components, including third-party), and MANAGE 3 (managing risks and benefits from third-party entities). NIST built third-party accountability into the framework's core, and those provisions carry the same weight as any other.
Why Is Third-Party AI Risk Harder to Govern than Internal AI?
Vendors introduce risks that are structurally harder to govern than internal AI, because they operate outside your audit perimeter and rarely disclose the information you would need to assess them. Without proper governance, exposure from third-party AI includes security vulnerabilities in the AI application itself, a lack of transparency in how AI risk is measured and reported, and AI security policies inconsistent with your organization's broader risk management procedures.
The expanded NIST AI RMF guidance through 2025 made the framework's position on this explicit: third-party risk is a primary concern, not an afterthought. TPRM programs that haven't integrated AI-specific governance into their vendor lifecycle are operating with a gap that regulators and auditors are increasingly prepared to identify.
GOVERN: Build the Policy Foundation for Vendor AI
The GOVERN function establishes the organizational culture, policies, and accountability structures that make AI risk management possible. GOVERN 6 requires policies and procedures to address AI risks and benefits arising from third-party software, data, and other supply chain issues. Meeting that requirement means building AI governance into your TPRM program as a formal component, integrated with your broader information security and GRC frameworks.
In practice, GOVERN 6 requires your program to define and document governing policies to protect data from AI risks introduced by third parties, legal and regulatory requirements for assessing those parties, clear roles and responsibilities through a RACI structure, risk scoring thresholds based on your organization's risk appetite, and assessment methodologies calibrated to third-party criticality. It also demands third-party AI inventories and fourth-party mapping to understand exposure in your extended ecosystem, contractual requirements including the right to audit vendors' AI practices, and KPIs and KRIs for measuring program effectiveness over time.
For professionals building these capabilities, AI Learning Path for Supplier Relationship Managers provides structured training on integrating AI governance into vendor oversight workflows. Organizations working toward ISO 42001 compliance will find significant crosswalk here; the standard's vendor-specific AI controls align closely with GOVERN 6's requirements.
MAP: Discover and Inventory Third-Party AI
The MAP function establishes context for understanding AI risk: who is using what systems, for what purposes, with what potential for harm. Employees routinely connect AI writing assistants, coding tools, meeting summarizers, and productivity applications to corporate accounts without security review. Vendors do the same. The April 2026 Vercel breach shows how a single AI productivity tool with excessive OAuth permissions can become an attack vector across an entire identity surface. MAP 4 requires that risks and benefits be mapped for all components of an AI system, including third-party software and data.
Operationalizing MAP starts with profiling and tiering third parties based on their AI-related inherent risk. Criteria include the type of content required to validate controls, criticality to business operations, locations and related legal considerations, level of reliance on fourth parties, interaction with protected data, and exposure to operational or client-facing processes. From this assessment, your team can tier suppliers, set appropriate levels of further diligence, and determine the scope of ongoing assessments. Rule-based tiering logic makes the process repeatable and auditable rather than ad hoc.
MEASURE: Assess Your Vendors' AI Practices
The MEASURE function covers how organizations analyze, benchmark, and monitor AI risk over time. In a third-party context, it covers structured assessment of vendors' AI practices and continuous external monitoring of threats across your vendor ecosystem. Third-party vendors should be assessed for AI-specific controls during onboarding and at defined intervals thereafter, typically at contract renewal or on a quarterly or annual basis, depending on material changes in the relationship.
For continuous monitoring, the scope needs to extend well beyond cybersecurity data. Vendor risk events that matter for AI systems include financial instability, regulatory sanctions, leadership changes, operational disruptions, and breach history-all of which affect whether a vendor's AI systems and governance practices remain trustworthy between formal assessment cycles. Cyber monitoring infrastructure alone typically covers less than half of the relevant signal surface. All monitoring data should be correlated with assessment results and centralized in a unified risk register for each vendor.
This function also requires continuously measuring third-party KPIs and KRIs against your defined requirements to identify risk trends, determine third-party risk status, and flag exceptions to common behavior that warrant further investigation. For managers overseeing these processes, AI for Management resources cover the governance frameworks and risk assessment methodologies that align with NIST's measurement requirements.
MANAGE: Respond to Third-Party AI Incidents
The MANAGE function covers how organizations allocate risk resources, respond to incidents, recover from them, and communicate throughout. MANAGE 3 explicitly addresses third-party AI risk: risks and benefits from third-party entities must be managed, with documented response and recovery plans that are monitored on a regular basis.
Your third-party incident response program needs to enable your team to identify, respond to, report on, and mitigate the impact of vendor AI security incidents rapidly. Key capabilities include continuously updated incident management assessments, real-time questionnaire completion tracking, defined risk owners with automated reminders, consolidated views of risk ratings and flagged responses for each vendor, workflow rules that trigger automated playbooks based on potential business impact, and data and relationship mapping to identify at-risk information paths across your third, fourth, and nth parties.
Where the NIST AI RMF Stands in 2026
The NIST AI RMF that most organizations first encountered in 2023 was designed primarily for organizations governing AI they had built or directly deployed. The framework has since expanded considerably. The Generative AI Profile (NIST AI 600-1), released July 2024, provides specific guidance for managing risks from vendor-supplied large language models and generative AI systems. Companion resources through 2025 reinforced supply chain and third-party model assessment as primary concerns. Programs that haven't been updated to reflect this expansion are being assessed against a version of the framework that no longer represents current expectations.
For TPRM teams, three gaps are worth checking now. First, vendor AI questionnaires built before 2024 may not reflect this expanded guidance; they should be reviewed and updated to cover model provenance, data supply chain integrity, and third-party model vetting specifically. Second, the framework's alignment with ISO 42001, which includes specific controls for AI systems managed by vendors and suppliers, means organizations working toward that certification are simultaneously building toward NIST AI RMF alignment. Third, the Treasury Department's Financial Services AI Risk Management Framework, released February 19, 2026, includes 230 control objectives with third-party risk explicitly addressed. Financial services organizations should treat it as the applied version of the principles described here.
Why This Matters for Management
The Home365 settlement made clear that "we bought it from a vendor" is not a viable defense when AI systems cause harm. For managers overseeing TPRM programs, the NIST AI RMF provides a structured, function-by-function framework for governing the AI risk that arrives through vendor relationships. A mature program is built function by function: GOVERN establishes the policy and accountability foundation, MAP surfaces what you don't yet know about your vendors' AI usage, MEASURE validates it through structured assessment and continuous monitoring, and MANAGE prepares you for when something goes wrong. The expanded 2025 guidance made clear this is a current concern, and organizations that have already implemented the framework's general TPRM capabilities are typically one program update away from AI-specific alignment.
Your membership also unlocks:
