_{PART THREE}
AI AS A NEW RISK TO MANAGE

in partnership with GAN Integrity

AI as a Risk to Manage

It is no small irony that the use of AI to manage risk creates its own risks to manage. The risks can be significant, including:

Data Privacy & Security

Carefully vet AI systems handling confidential or regulated data.

Regulatory Compliance

Emerging legislation (e.g., EU AI Act) could impose new liability on companies using AI-based tools.

Reputational Damage

AI errors or biases (e.g., discriminatory lending algorithms, user bullying, or data hallucination) can undermine brand trust

Without a clear understanding of where and how AI is used, organizations face potential compliance, security, and ethical risks, including exposure to data privacy and intellectual property security violations and regulatory non-compliance. Cataloging use cases (both internal to the organization and within third-parties) is a must and with the speed of evolution in this space, is not a “one-and-done” proposition.

AI AS A RISK TO MANAGE

Lack of Visibility

There is also the issue of a lack of visibility into and third party’s use of AI. According to GAN Integrity survey data, only 6% of respondents have full knowledge of how their vendors leverage AI tools, while 25% have no visibility at all.

Similarly, Ethisphere’s own survey data shows that only 35% of organizations are including AI risk in their ethics and compliance third-party due diligence, and only 15% of organizations have provisions for Use of AI in their third-party code.

Like other technology solutions, there is always the risk of being lured by the promises of features that at the end of a long hard implementation, may not pay off in terms of efficiencies or improved quality. However, integrating AI into a TPRM program is very much emerging as the way to build a best-in-class program that can not only withstand the rigors of modern third-party risk, but place organizations ahead of their peers.

4 AI Risk Management Strategies

AI Governance Model

Define roles, responsibilities, and escalation protocols for AI-related breaches or bias incidents.

AI-Specific TP Codes and Contractual Clauses

Only 15% of organizations currently include AI usage clauses in their third-party codes. Introduce AI-specific clauses in contracts (e.g., requirement to advise if systems or services use AI)

Human Oversight

Even the best AI systems need human review for nuance. Train staff to spot algorithmic anomalies and interpret complex risk alerts.

Continuous Improvement

Regularly update AI models and TPRM policies to reflect changing regulations (e.g., potential EU AI Act). Also, auditing AI processes ensures they remain aligned with evolving standards and best practices.