The third-party AI accountability problem
Regulators are clear that accountability for AI cannot be outsourced. The EU AI Act Articles 25–26 (value chain responsibilities and deployer obligations), APRA's CPS 230, FCA outsourcing guidance, and ASIC's operational resilience expectations all establish that organisations remain accountable for AI they deploy regardless of who built it.
What to assess in vendor AI due diligence
AI capability transparency: what AI does the product actually use? Training data: does the vendor use your data to train its models? Most standard SaaS terms allow this — restrict it explicitly if it concerns you. Accuracy and bias testing: can the vendor produce documentation? AI governance framework: does the vendor have its own AI governance programme?
AI-specific contract provisions
Negotiate beyond standard contracts: AI capability disclosure obligations (notification of material AI changes); training data restrictions (prohibition on using your data to train models without consent); right to audit bias audits and accuracy testing; liability allocation for AI errors; and Data Processing Agreements for AI involving personal data. Assign a designated owner for ongoing vendor AI governance monitoring with authority to escalate concerns.
