Vendor due diligence that survives contact with a real supplier

Most organisations are deployers, which means most of their AI risk arrives through procurement. The due diligence questionnaire is therefore the highest-leverage governance artefact in the programme, and it is usually the weakest, because it was adapted from a SaaS security questionnaire and asks about encryption at rest rather than about the model.

What you are actually establishing

Five things, and each one has a consequence if the answer is unsatisfactory.

What the AI inside the product actually is, including features added by vendor update. This is the question that distinguishes a live inventory from a stale one. A product assessed as low risk in March can be something else by September because a feature was switched on, and no purchase order was raised.

Who is provider and who is deployer, under each applicable regime, for each component. The answer is often split: the vendor is the provider of the system, the vendor's upstream supplier is the provider of the underlying general-purpose model, and you are the deployer, unless something you do flips that.

What documentation they provide, and what they refuse. Under Article 13(3) a provider of a high-risk system must supply instructions for use covering the provider identity, the characteristics, capabilities and performance limitations including the accuracy metrics validated against, foreseeable-misuse risks, pre-determined changes, human oversight measures, computational and hardware resources, expected lifetime and maintenance, and how to interpret the logs. You cannot write your Article 26 oversight arrangements or an Article 27 FRIA without those instructions. If they do not exist, your compliance position depends on a document that does not exist.

Their sub-processors and upstream model providers, because your exposure runs through them and because a model swap upstream is a change to your system that nobody will tell you about unless the contract says they must.

What remains yours regardless. This is the item most often left off, and the one that matters most in a regulatory conversation.

The rule that carries across sectors: validate in your own context

US interagency model risk guidance SR 26-2, with OCC 2026-13 and FDIC FIL-15-2026, issued 17 April 2026, superseded SR 11-7. The core expectations carry over: effective challenge, validation covering conceptual soundness, ongoing monitoring and outcomes analysis, a model inventory, and documentation sufficient for a knowledgeable third party to understand the model. Third-party models are expressly in scope, and the expectation is that the institution validates a vendor model in its own context.

The NAIC Model Bulletin on the Use of AI Systems by Insurers, adopted 4 December 2023, does comparable work for insurers. It is a model bulletin rather than a model law, effective only as each state adopts it, and it expects a written AI Systems Program covering governance, risk management and internal controls, with third-party AI expressly addressed.

Both point at the same practitioner rule. A vendor's validation report is evidence about the vendor's data, the vendor's population and the vendor's threshold. It is an input to your validation. It is not your validation. Accepting it as such is the single most common finding in supervisory reviews of third-party model use, and it is also the easiest to avoid: run the model on your own population, against your own pre-declared thresholds, and record the result.

The same principle appears in European sector guidance. FINMA Guidance 08/2024, issued 18 December 2024, is guidance rather than a circular and creates no new rules, but it states plainly that responsibility remains with the institution even where AI is bought in or outsourced. Its four themes are governance and accountability, robustness and reliability, explainability and transparency, and non-discrimination, and its expectations include an inventory of AI applications, risk classification, clearly allocated roles, testing before deployment and continuous monitoring, documentation proportionate to risk, and independent review separate from the developing unit.

The EIOPA Opinion on AI governance and risk management, EIOPA-BoS-25-360 of 6 August 2025, is addressed to national competent authorities rather than directly to undertakings and creates no new rules. Note one structural point: it deliberately excludes prohibited and high-risk AI Act systems to avoid overlap. Insurers therefore face two tracks, and a system can fall under the Opinion's expectations or under the AI Act's, which changes which document you reason from.

Worked example: an insurer assesses a claims-triage vendor

An insurer is buying a claims-triage service. The security questionnaire comes back clean. The AI-specific questions return three findings that the security review could never have surfaced.

First, the vendor's accuracy claim is stated on a benchmark of mixed personal lines claims across several markets. The insurer's book is concentrated in one market and one product. Under the SR 26-2 expectation, that claim is an input and not a result, so the insurer negotiates a validation window on its own historical claims before go-live, with pre-declared acceptance thresholds. The model underperforms the vendor's figure by a material margin on the insurer's population, which is exactly what validating in context is for.

Second, the vendor cannot say which underlying model version is in use at any given time, because it routes between suppliers for cost and availability. That is a governance problem rather than a technical one: the insurer cannot reconstruct a decision if it cannot identify the model behind it, and it cannot assess drift if the model changes without notice. The remedy is contractual, and it belongs in the next lesson.

Third, the instructions for use are a product brochure. There is no statement of the performance limitations or the accuracy metric validated against. The insurer records the refusal, dated, and carries it as an open risk with a named owner rather than treating the field as complete.

None of these stopped the purchase. All three changed the contract, the go-live conditions and the monitoring plan, which is what due diligence is for.

As of 24 September 2026.