Your vendors added AI. Has anyone reviewed it?

Most organizations never decided to adopt AI. It arrived in a software update.

The writing assistant in your email, the summary button in your CRM, the chatbot your help desk vendor switched on last quarter. Each one may send your data to a model your policies never approved, under contract terms nobody re-read.

That matters for more than security. Under GDPR and CCPA, a vendor that handles personal information on your behalf must use it only for the purposes in your contract. If a new AI feature uses that data in a new way, your obligations did not change, but your exposure did.

Three steps to take this quarter

1. Take inventory. List every tool that now includes an AI feature, what data it can reach, and who approved it. Start with email, CRM, HR and help desk systems.

2. Map each tool to a framework. The NIST AI Risk Management Framework gives you four plain functions: Govern, Map, Measure and Manage. Use them to decide which tools need a closer look.

3. Name an owner and read the terms. Give each tool one accountable person, and check whether the vendor can use your data to train its models. If the answer is unclear, ask in writing.

Start with the inventory. You cannot govern what you have not listed.

Reference: NIST AI Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, January 2023.

To talk about your AI risk, message us.

Ahead of Risk.