Third-Party Risk & AI: Due Diligence Guide

Why Procurement AI Vendors Are Critical Third Parties

When you adopt procurement AI, you're inviting a third party into your financial control environment. That vendor becomes a de facto participant in your P2P process, affecting supplier selection, contract decisions, and payment execution. If that vendor fails — technically, financially, or compliance-wise — your entire procurement operation is at risk. This article walks through comprehensive due diligence for procurement AI vendors, covering DORA, SOC 2, GDPR compliance, financial stability, business continuity, and ongoing monitoring frameworks.

This is part of our comprehensive Procurement AI Compliance cluster, which covers all major compliance frameworks for procurement AI.

DORA and Critical Service Provider Requirements

The EU's Digital Operational Resilience Act (DORA) and EBA guidelines specifically require financial firms to vet their critical service providers — including AI vendors. If your organization is regulated by the EBA (European Banking Authority), DORA is mandatory. Even if you're not regulated, the framework is becoming a best practice standard.

DORA Due Diligence Requirements for AI Vendors

• Cyber risk assessment: What's the vendor's track record on security incidents? Have they been breached?
• Operational resilience: What's their disaster recovery time objective? Can they restore service within your required timeframe?
• Data security: Where is data stored? What encryption is used? What's their access control model?
• Concentration risk: How critical is this vendor to your operations? Do you have fallback options?
• Outsourcing arrangements: Does the vendor outsource to sub-processors? Who? Where? What are their compliance standards?

SOC 2 Type II Audit Reports

Request the vendor's latest SOC 2 Type II audit report. This verifies that their security, availability, and confidentiality controls have been independently audited. Key things to review:

What to Look for in a SOC 2 Report

• Audit scope: Does the report cover the AI platform you're buying? (Some vendors have multiple products; make sure the audit covers yours)
• Date: Reports should be recent (within the last 12 months). Older reports may not reflect current security posture.
• Auditor: Reputable Big 4 accounting firms are standard. Be skeptical of lesser-known auditors.
• Findings: Any exceptions noted? Some reports include management's remediation plans for issues found during audit.
• Controls tested: Does the report cover access controls, data encryption, availability monitoring, incident response?

Key SOC 2 Control Areas for Procurement AI

• Access Controls (CC6, CC7): Does the vendor enforce role-based access control? Can you control who accesses your data?
• Encryption (C1, SC7): Is data encrypted in transit and at rest? What's the encryption standard (AES-256)?
• Availability (A1): What's the vendor's uptime SLA? Is it 99.9%, 99.99%? Are they meeting it?
• Incident Response (CC8): Does the vendor have a formal incident response process? How quickly do they notify customers of breaches?

GDPR Compliance Assessment

If your vendor processes any supplier personal data, they must be GDPR-compliant. Key checks:

Vendor Checklist

• Does the vendor have a published Data Processing Agreement (DPA) ready to sign?
• Does the DPA cover Standard Contractual Clauses (if data is transferred outside the EU)?
• Does the vendor publish their sub-processor list? Can you object to new sub-processors?
• Has the vendor had GDPR audits or inspections? Any fines or enforcement actions?
• Does the vendor support data subject rights (access, erasure, portability)?
• What's the vendor's data breach notification timeline? (Should be within 72 hours to your DPO)

Financial Stability and Continuity Risk

A well-engineered AI platform is no good if the vendor goes bankrupt. Assess:

Financial Health Questions

• Is the vendor profitable? Check recent funding announcements, revenue growth rate, burn rate.
• Do they have at least 12 months of cash runway? (If a startup, look for recent funding rounds.)
• What's their customer retention rate? If they're losing customers, that's a red flag.
• Are they expanding or contracting? Expanding suggests confidence; contracting suggests trouble.
• What's their top customer concentration? If one customer is >30% of revenue, that's risky.

Continuity Planning

• Does the vendor have a business continuity plan? Can they provide a summary?
• What's their disaster recovery time objective (RTO)? Data recovery objective (DRO)? (Should be < 4 hours for critical systems.)
• Is their disaster recovery plan tested regularly? (Should be quarterly.)
• If the vendor goes out of business, what's their data retrieval and portability plan?

AI Model Governance and Validation

The AI models powering procurement decisions need governance. Ask vendors:

Model Governance Questions

• How often do you retrain models? (Quarterly is good; annually or less is concerning.)
• What's your process for detecting and removing bias? Can you share recent bias audit results?
• If you discover a bias issue, how do you remediate? Do you retrain the model, or apply fairness adjustments?
• How do you validate model accuracy? Do you have holdout test sets? What's your target accuracy?
• Can you provide documentation of training data sources? (This is required for EU AI Act compliance.)
• If there's a model update, do you notify customers and provide a rollback option?

Critical Contract Terms for Procurement AI Vendors

Liability and Indemnification

• Liability caps: What's the vendor's maximum liability? (Should be at least 12 months of fees, not a cap like $1M.)
• Indemnification: Does the vendor indemnify you for AI-driven errors? (E.g., if the AI makes a discriminatory decision and you're sued.)
• Data breach liability: What's the vendor's liability if they have a data breach?

Service Levels and Remedies

• Uptime SLA: 99.9% is typical; 99.99% is premium. What credits do you get if they miss it?
• Performance SLA: Does the vendor guarantee model accuracy? Response time for AI decisions?
• Support SLA: How quickly will they respond to critical issues? (Should be < 4 hours.)

Data and Termination

• Data portability: If you terminate the relationship, how long do you have to retrieve your data? (Should be 30-60 days.)
• Data deletion: Can you require deletion of your data after termination? (Should be allowed.)
• Wind-down support: Will the vendor provide transition support (data exports, API access) if you switch platforms?

Creating a Vendor Risk Scorecard

Consolidate your due diligence into a scoring framework. Use a 1-5 scale for each category:

Ongoing Monitoring After Contract Signature

Due diligence doesn't end at signature. Monitor vendors continuously:

Quarterly Monitoring

• Review uptime metrics. Are they meeting their SLA?
• Check for any publicised security incidents or breaches
• Review model update releases and any bug fixes relevant to your use case

Annual Review

• Request updated SOC 2 audit report
• Review GDPR compliance (any DPA changes, new sub-processors)
• Assess financial stability again (recent funding, revenue growth)
• Conduct bias audit on vendor's models (if they provide raw prediction data)

Conclusion: Rigorous Due Diligence as Competitive Advantage

Companies that are rigorous about vendor due diligence can deploy AI faster, with more confidence. You're not avoiding AI because of risk — you're managing risk systematically so you can embrace AI boldly. Start with a vendor assessment checklist, score your current and prospective vendors, and establish quarterly monitoring processes. Within 6 months, you'll have a vendor management framework that regulators and auditors recognize as mature.