Your AI governance program doesn't stop at the tools your employees use directly. It extends to every vendor in your stack that uses AI.
This is the part most companies skip. It's also the part that auditors and enterprise customers are starting to ask about.
Your vendors are using AI too
Your customer support platform probably added an AI feature last quarter. Your CRM has AI-powered insights. Your code review tool uses AI to suggest changes. Your marketing platform generates content with AI. Your analytics tool summarizes data with AI.
Each one of those AI features processes your data. Some of them process your customers' data. And most companies have no idea what's happening under the hood.
The questions to ask
For every vendor that handles your data, add these to your vendor assessment:
Does your product use AI or machine learning? If so, for what functions?
Is our data used to train AI models? Can we opt out?
Where is AI processing performed — same infrastructure as the rest of the product, or a third-party AI provider?
If you use a third-party AI provider (OpenAI, Anthropic, Google), is our data covered under your agreement with them?
What's the data retention policy for AI-processed data specifically?
Do you have an AI governance policy or framework? Have you assessed your AI features against relevant regulations (EU AI Act, state AI laws, sector-specific requirements)?
For healthcare companies
If your vendor processes PHI and uses AI, the stakes are higher. The BAA needs to cover AI-specific data flows. If the vendor sends your PHI to a third-party AI provider for processing, that provider is a subcontractor under HIPAA and needs their own BAA in the chain.
Ask explicitly: does PHI enter any AI model, API, or processing pipeline? If yes, is that covered under our BAA? Is the AI provider a listed subcontractor?
Most vendors haven't thought through this yet. That doesn't mean you can ignore it. It means you need to push them.
AI in your supply chain
If you build a product that uses AI, your customers will ask you the same questions. Having clear, documented answers positions you ahead of competitors who haven't done this work.
Build a one-page AI disclosure document: what AI your product uses, what data it processes, how you govern it, and what controls are in place. Share it proactively with enterprise customers. This is becoming a sales differentiator, especially in healthcare.
Updating your vendor register
Add an AI column to your vendor register. For each vendor, flag whether they use AI, whether your data is involved, and whether you've assessed the AI-specific risk. Prioritize vendors that handle sensitive data or PHI. Review annually or when the vendor announces new AI features — which is basically quarterly at this point.
Up next in the series
In Part 5, we'll cover ongoing governance: how to keep the program running and evolving as AI changes.
Read Part 5 →