Treat third-party AI like any supplier, with extra attention to data flows and model changes. Inventory every provider with access to your content, keep an approved list, monitor their risks, and plan for failure. NIST's GOVERN 6 and MANAGE 3 cover this, and the generative AI profile adds specific actions.
What the framework asks
GOVERN 6.1 asks for policies that address AI risks from third-party entities, including infringement of someone else's intellectual property. GOVERN 6.2 asks for contingency processes for failures or incidents in third-party data or AI systems judged high-risk. MANAGE 3.1 asks that third-party risks and benefits be regularly monitored with controls applied and documented. MANAGE 3.2 adds that pre-trained models used in development be monitored as part of normal maintenance.
MAP 4 asks you to map the risks of all components, including third-party software and data.
Actions from the generative AI profile
The profile's suggested actions include inventorying all third-party entities with access to organizational content and establishing approved provider lists. It also suggests documenting incidents involving third-party generative AI data and systems, including open data and open source software, and establishing incident response plans for third-party generative AI that define ownership, are rehearsed regularly, and are checked against breach reporting and data protection laws.
A review checklist
- Data. What data do we send? Is it retained? Used for training? Where is it processed?
- Model. Which model and version? How are changes announced? Can we pin a version?
- Security. Independent assurance reports, vulnerability handling, access controls, logging.
- Contract. Data processing terms, breach notice windows, subprocessors, audit rights, exit and deletion.
- Reliability. Availability history, rate limits, fallback behavior.
- Provenance. Where did training data and base models come from? What do they disclose?
- Intellectual property. Indemnity, output ownership, licensing of any open models.
Plan for the vendor failing
Decide in advance what happens if the provider is down, changes behavior, is breached, or retires a model. Options include a secondary provider, a degraded manual mode, or turning the feature off. Test the plan.
Open models and datasets
Downloading a model or dataset is also a third-party decision. Record the source, license, hash and who approved it. Scan model files and dependencies the same way you scan code.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, which can help you see which libraries and packages your AI features pull in. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Do we review every AI vendor equally?
No. Tier them by the data they touch and the decisions they influence, then apply deeper review to the top tier.
What if the vendor will not share training data details?
Record that as residual risk, limit the data you send, and have the risk owner accept it in writing.
Sources
- NIST, AI Risk Management Framework 1.0 (NIST AI 100-1)
- NIST, Generative AI Profile (NIST AI 600-1)
- NIST, AI RMF Playbook
Last reviewed: 19 October 2026.
