Control · C-086 · Third Party & Supply Chain
Ongoing AI vendor monitoring
Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is.
- Control type
- Detective
- Risks addressed
- 5
- Audience
- Heads-of · Practitioner
- Frameworks
- Article 28 · MANAGE 3 · Chapter 8
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it does
It keeps the organisation's knowledge of a supplier current after the contract is signed. On a set cycle the relationship owner reviews how the supplier has performed, what incidents it has had, what it has changed or announced, whether its terms or sub-contractors have altered, and whether it remains sound. Retirement dates for the models in use are tracked. The owner of the supplier relationship is accountable; third-party risk sets the standard. It operates through the life of the contract.
How to implement it
- Set review frequency by supplier tier.
- Track availability, error rates and quality against what was agreed.
- Log the supplier's incidents, model changes and deprecation notices.
- Check for changes to terms, data use, sub-processors and ownership.
- Maintain a calendar of model retirement dates and plan migrations against it.
- Escalate concerns, and refresh due diligence when something material changes.
Evidence it operates
Design: a vendor monitoring standard with frequencies and measures. Operation: review records for each material supplier; a deprecation calendar; issues raised with suppliers and their resolution; due diligence refreshed after a material change.
Where it fits
In operation, between due diligence at the start and exit at the end. It is the primary control for model deprecation and forced migration, and supports unannounced upstream model change, AI service outage and vendor concentration and exit strategy gap. It relies on AI contract terms for the information it needs.
Limits
Monitoring depends on what the supplier reports and what the contract entitles the organisation to see. Most of what matters about a model provider is not visible from outside. Reviews on a calendar miss changes between them. Knowing that a supplier is deteriorating helps only if there is somewhere else to go.
Risks this mitigates
Primary mappings
- Model deprecation and forced migration Medium
- Tracks deprecation notices so migration is planned. A provider withdraws a model version on its own timetable, forcing the organisation to migrate to a different model before it has tested the replacement.
Supporting mappings
- AI service outage High
- Tracks the supplier's service record. An inference service, model endpoint or supporting platform becomes unavailable, and the business process that depends on it stops or queues.
- Inadequate AI vendor due diligence High
- Continues the assessment after signing. An AI supplier is taken on without due diligence proportionate to how material its system is, or with a generic assessment that never asks the questions specific to AI.
- Unannounced upstream model change High
- Tracks provider announcements and deprecations. A provider updates, replaces or reconfigures a hosted model, and the organisation's system behaves differently without any change of its own.
- Vendor concentration and exit strategy gap High
- Watches the supplier's standing for early warning. The organisation depends on a single AI model or supplier for a critical function, with no tested exit plan and no alternative identified.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Digital Operational Resilience Act (DORA) | Article 28 | General principles on ICT third-party risk Monitoring of providers. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MANAGE 3 | Risks from third-party entities are managed Third-party risk managed. |
| SS2/21: Outsourcing and Third-Party Risk Management | Chapter 8 | Access, audit and information rights Ongoing oversight rights. |
Related terms
How to cite
Axiom Verity (2026). Ongoing AI vendor monitoring. Reference Library, C-086. https://axiom-verity.com/controls/ongoing-ai-vendor-monitoring. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.