Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Most enterprises do not train foundation models from scratch; they consume model APIs, adopt AI-enabled SaaS applications, deploy open-weight models or connect third-party agents. Traditional IT vendor questionnaires fail to capture training data provenance, silent model deprecations or external agent tool-execution risks.

This course upgrades Third-Party Risk Management (TPRM) and Model Risk Management (MRM) practices for modern AI. It covers evaluating model cards, comparing proprietary APIs against self-hosted open-weight models, mapping fourth-party dependencies and designing exit strategies. Participants build an AI Vendor & Model Due Diligence Questionnaire for their organisation.

Who Should Attend?

  • Procurement, vendor management and Third-Party Risk Management (TPRM) specialists
  • Model Risk Management (MRM), information security and compliance teams
  • Enterprise architects and AI product managers selecting external models or platforms
  • Legal counsel and IT contract managers

Key Takeaways

  • Audit the AI-specific risks that standard SaaS security questionnaires miss
  • Evaluate model cards, safety evaluations and training data provenance disclosures
  • Compare the risk profiles of commercial LLM APIs and self-hosted open-weight models
  • Assess permissioning and data exfiltration risks in third-party agents and tool integrations
  • Define contractual SLAs, model-version pinning requirements and vendor exit strategies

Curriculum

Mapping the AI Value Chain and Fourth-Party Model Dependencies
  • Uncovering which upstream LLM APIs power your SaaS vendors' AI features
  • Concentration risk when multiple business processes rely on one foundation model provider
  • Vendor archetypes: frontier API providers, AI-native startups, SaaS add-ons and external agents
Model Due Diligence: Proprietary APIs vs Open-Weight Models
  • Reading Model Cards, System Cards and independent safety benchmarks
  • Licensing restrictions, provenance and supply-chain security in open-weight models
  • Managing silent model updates, deprecations and version pinning
Third-Party AI Agent and Tool-Integration Risks
  • Governing OAuth scopes, API keys and MCP connections granted to external agents
  • Data exfiltration and cascading failure risks in multi-agent ecosystems
  • Sandboxing, rate limiting and human confirmation gates for external agents
The AI Vendor Due Diligence Questionnaire (RFx & TPRM Addendum)
  • Zero-data-retention guarantees, no-training clauses and tenant isolation checks
  • Requesting ISO/IEC 42001, SOC 2, ISO 27001 and EU AI Act compliance attestations
Contractual Safeguards, Ongoing Monitoring and Exit Strategy
  • SLAs, model deprecation notice periods, audit rights and liability caps
  • Avoiding lock-in through model-agnostic routing and portable evaluation sets

Other Courses in This Category

  • Human-in-the-Loop Process Design and Effective AI Oversight

    Design meaningful human oversight (EU AI Act Article 14) that avoids rubber-stamping and automation bias, using human-in-the-loop, human-on-the-loop, confidence routing and friction-aware review interfaces.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Algorithmic Bias, Fairness and Explainability (XAI) for Governance

    Identify bias sources in machine learning and LLMs, select context-appropriate fairness metrics, and translate explainability methods (SHAP, LIME, citations) into clear disclosures for customers and regulators.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • AI Audit and Internal Control Framework

    Design an internal control framework and audit programme for AI systems covering data, model, prompt/RAG, guardrail and oversight controls, evidence collection and control effectiveness testing.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • AI Traceability, Audit Logging and Incident Response Management

    Establish end-to-end AI traceability across prompts, retrieved context, model versions and human overrides, and build an AI incident response playbook for hallucinations, drift, jailbreaks and data leaks.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • ISO/IEC 42001 AI Management System (AIMS) Implementation

    Implement an AI Management System (AIMS) under ISO/IEC 42001 Clauses 4–10 and Annex A/B controls, define scope, draft the Statement of Applicability (SoA), and prepare the organisation for audit.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • ISO/IEC 42001 Internal Auditor Training for AI Management Systems

    Plan, conduct and report internal audits of an ISO/IEC 42001 AI Management System (AIMS) aligned with ISO 19011, verify Clause 4–10 and Annex A evidence, and write clear nonconformity reports.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View

Get in touch