Course Objective & Scope
Most enterprises do not train foundation models from scratch; they consume model APIs, adopt AI-enabled SaaS applications, deploy open-weight models or connect third-party agents. Traditional IT vendor questionnaires fail to capture training data provenance, silent model deprecations or external agent tool-execution risks.
This course upgrades Third-Party Risk Management (TPRM) and Model Risk Management (MRM) practices for modern AI. It covers evaluating model cards, comparing proprietary APIs against self-hosted open-weight models, mapping fourth-party dependencies and designing exit strategies. Participants build an AI Vendor & Model Due Diligence Questionnaire for their organisation.
Who Should Attend?
- Procurement, vendor management and Third-Party Risk Management (TPRM) specialists
- Model Risk Management (MRM), information security and compliance teams
- Enterprise architects and AI product managers selecting external models or platforms
- Legal counsel and IT contract managers
Key Takeaways
- Audit the AI-specific risks that standard SaaS security questionnaires miss
- Evaluate model cards, safety evaluations and training data provenance disclosures
- Compare the risk profiles of commercial LLM APIs and self-hosted open-weight models
- Assess permissioning and data exfiltration risks in third-party agents and tool integrations
- Define contractual SLAs, model-version pinning requirements and vendor exit strategies
Curriculum
Mapping the AI Value Chain and Fourth-Party Model Dependencies
- Uncovering which upstream LLM APIs power your SaaS vendors' AI features
- Concentration risk when multiple business processes rely on one foundation model provider
- Vendor archetypes: frontier API providers, AI-native startups, SaaS add-ons and external agents
Model Due Diligence: Proprietary APIs vs Open-Weight Models
- Reading Model Cards, System Cards and independent safety benchmarks
- Licensing restrictions, provenance and supply-chain security in open-weight models
- Managing silent model updates, deprecations and version pinning
Third-Party AI Agent and Tool-Integration Risks
- Governing OAuth scopes, API keys and MCP connections granted to external agents
- Data exfiltration and cascading failure risks in multi-agent ecosystems
- Sandboxing, rate limiting and human confirmation gates for external agents
The AI Vendor Due Diligence Questionnaire (RFx & TPRM Addendum)
- Zero-data-retention guarantees, no-training clauses and tenant isolation checks
- Requesting ISO/IEC 42001, SOC 2, ISO 27001 and EU AI Act compliance attestations
Contractual Safeguards, Ongoing Monitoring and Exit Strategy
- SLAs, model deprecation notice periods, audit rights and liability caps
- Avoiding lock-in through model-agnostic routing and portable evaluation sets
Other Courses in This Category
-
Design meaningful human oversight (EU AI Act Article 14) that avoids rubber-stamping and automation bias, using human-in-the-loop, human-on-the-loop, confidence routing and friction-aware review interfaces.
- Live Course
- 5 modules
-
Identify bias sources in machine learning and LLMs, select context-appropriate fairness metrics, and translate explainability methods (SHAP, LIME, citations) into clear disclosures for customers and regulators.
- Live Course
- 5 modules
-
Design an internal control framework and audit programme for AI systems covering data, model, prompt/RAG, guardrail and oversight controls, evidence collection and control effectiveness testing.
- Live Course
- 5 modules
-
Establish end-to-end AI traceability across prompts, retrieved context, model versions and human overrides, and build an AI incident response playbook for hallucinations, drift, jailbreaks and data leaks.
- Live Course
- 5 modules
-
Implement an AI Management System (AIMS) under ISO/IEC 42001 Clauses 4–10 and Annex A/B controls, define scope, draft the Statement of Applicability (SoA), and prepare the organisation for audit.
- Live Course
- 5 modules
-
Plan, conduct and report internal audits of an ISO/IEC 42001 AI Management System (AIMS) aligned with ISO 19011, verify Clause 4–10 and Annex A evidence, and write clear nonconformity reports.
- Live Course
- 5 modules
Get in touch
