Here’s the truth nobody wants to hear:
If you use an AI system to make decisions about people, you’re liable for what it does.
It doesn’t matter who built it, what your contract says, or if the vendor promised it was compliant.
If the AI discriminates, you’re getting investigated. If it violates privacy laws, you’re getting fined. If it makes unfair decisions, you’re getting sued.
Your vendor contract might give you a path to recover costs later. But it won’t stop the regulatory action. It won’t prevent the lawsuit. And it definitely won’t protect your reputation.
Why Buying AI Is Riskier Than Building It
When you build AI internally, you control everything.
The data, the model, the deployment, and the monitoring.
When you buy AI? You control almost nothing. And yet you’re still fully liable.
Think about what you don’t know about most AI vendors:
- What data did they train on
- Whether they tested for bias
- How they handle model updates
- What happens to your data
- Whether their system actually works as advertised
You’re trusting they did all the compliance work. Most didn’t.
Vendors are optimizing for speed and features, not regulatory risk. Their legal team wrote contracts to limit their liability, not yours. And they’re selling to hundreds of clients, they can’t customize compliance for your specific use case.
So they ship you a black box, tell you it’s “AI-powered,” and leave you holding the compliance risk.
The Three Vendor Risks Nobody’s Managing
Risk #1: You Don’t Actually Know What Their AI Does
Go ask your procurement team to explain how your AI vendors’ systems work.
Not the marketing claims. The actual decision-making logic.
Here’s what you’ll hear:
- “It uses machine learning to optimize…”
- “It’s powered by advanced algorithms…”
- “It provides AI-driven insights…”
Translation: we have no idea.
What you actually need to know:
- What inputs does the AI use?
- What outputs does it produce?
- How does it weigh different factors?
- What training data was used?
- Has it been tested for bias?
- How often is it updated?
If your vendor can’t answer these questions, you can’t assess your compliance risk. And if you can’t assess the risk, you definitely can’t manage it.
Risk #2: Your Vendor’s Compliance Claims Are Marketing, Not Fact
Every AI vendor’s website says they’re compliant with everything: GDPR, CCPA, SOC 2, ISO 27001, and now the EU AI Act.
Most of those claims are aspirational at best, false at worst.
I’ve reviewed dozens of AI vendor “compliance” programs. Here’s what I typically find:
Their data privacy compliance is just a standard SaaS privacy policy—nothing AI-specific.
Their security certifications cover infrastructure, not AI model governance.
Their “bias testing” was done once, at launch, using synthetic data.
Their “explainability” is a black-box confidence score.
Their contracts disclaim all responsibility for how you use their system.
In other words, they’ve done the bare minimum to avoid obvious liability, and they’re passing all AI-specific compliance risk to you.
Risk #3: You Have No Idea When Things Go Wrong
Here’s a scenario happening right now at companies everywhere:
Your AI vendor pushes a model update. It changes how decisions get made. Some edge case that worked before now fails. You don’t find out until someone complains—or worse, until you get investigated.
Why does this keep happening?
Vendors don’t tell you when they update models. You’re not monitoring vendor AI outputs. Your teams assume “it’s working” because it hasn’t obviously broken. Nobody’s tracking whether outcomes have changed over time.
By the time you realize there’s a problem, you’ve made hundreds or thousands of decisions using a system that doesn’t work as intended.
And guess who’s liable for all those decisions? Not the vendor.
What Your AI Vendor Contracts Are Missing
I review a lot of AI vendor contracts. Most were written by lawyers who’ve never dealt with AI-specific risks.
Here’s what’s almost always missing:
1. Specific AI Compliance Warranties
Standard tech contracts have generic warranties: “the software will perform substantially as documented.”
That’s not enough for AI.
What you actually need:
- Warranty that the system was tested for bias and discrimination
- Warranty that the training data complies with applicable laws
- Warranty that the system meets explainability requirements
- Warranty that the vendor will maintain compliance as regulations evolve
Without these, you’re taking the vendor’s marketing claims on faith.
2. Your Right to Audit the AI System
You wouldn’t buy a financial system without the right to audit it. Why are you buying AI without audit rights?
What you need in the contract:
- Right to review training data and model documentation
- Right to test the system for bias using your own data
- Right to inspect how the system makes decisions
- Right to audit after incidents or regulatory inquiries
If the vendor says “our system is proprietary,” that’s not an answer. You can have proprietary systems and still provide audit rights under appropriate confidentiality protections.
3. Vendor Obligations When Regulations Change
The AI regulatory landscape is evolving fast. What’s compliant today might not be compliant in six months.
Your contract needs to specify:
- Vendor’s obligation to maintain compliance with new regulations
- Timeline for implementing required changes
- Who pays for compliance updates (hint: it shouldn’t be you)
- What happens if the vendor can’t or won’t comply
Without this, you’re stuck: either continue using a non-compliant system, or rip it out and start over.
4. Incident Response and Notification Requirements
When something goes wrong with an AI system, time matters.
Your contract must require:
- Immediate notification of AI failures, bias incidents, or compliance issues
- Vendor cooperation in root cause analysis
- Vendor support in regulatory responses
- Detailed incident documentation
The standard “we’ll notify you of material breaches” language isn’t enough. AI incidents might not trigger that threshold until it’s too late.
5. Data Rights and Portability
What happens to your data if you stop using the vendor? Can you take it with you? Can they keep using it to train future models?
Questions your contract must answer:
- Who owns the data you provide to the vendor?
- Can the vendor use your data to improve their models?
- Can you retrieve all your data if you terminate?
- What happens to your data after termination?
Many vendors want to use your data to make their AI better. That might be fine—but you need to know about it and control it.
How to Actually Manage AI Vendor Risk
Stop signing vendor contracts without doing proper AI due diligence. Here’s what that actually looks like:
Step 1: Do Real AI Vendor Risk Assessment (Before You Buy)
Before signing anything, complete an AI-specific risk assessment.
Technical Due Diligence:
- What type of AI is this? (Rule-based, ML, generative, etc.)
- What data does it use to make decisions?
- Has it been tested for bias and fairness?
- How transparent and explainable is it?
- How often does the vendor update the model?
Regulatory Due Diligence:
- Does this AI system fall under high-risk categories in the EU AI Act?
- Does it make decisions subject to state AI laws (Colorado, etc.)?
- What compliance documentation can the vendor provide?
- Has the vendor been subject to regulatory action or lawsuits?
Operational Due Diligence:
- How will we monitor this system after deployment?
- Can we integrate it with our governance processes?
- What happens if it stops working as expected?
- Do we have the expertise to oversee this system?
If the vendor can’t answer these questions to your satisfaction, walk away.
Step 2: Negotiate Contracts That Actually Protect You
Use the leverage you have during contract negotiation. Vendors want your business. Make them earn it with proper compliance commitments.
Non-negotiable contract terms:
- AI-specific compliance warranties
- Audit rights
- Regulatory change obligations
- Incident notification requirements
- Clear data rights and usage limitations
- Meaningful indemnification for AI-specific harms
If the vendor pushes back hard, ask yourself:
“If they won’t commit to these protections, how confident are they in their own system?”
Step 3: Integrate Vendor AI Into Your Governance Program
Don’t treat vendor AI differently from internal AI. It carries the same risk.
What that means in practice:
- Add vendor AI to your AI system inventory
- Conduct the same risk assessments you’d do for internal systems
- Monitor vendor AI outputs just like you monitor internal models
- Document decisions to use vendor AI and approval processes
- Train users on the responsible use of vendor AI systems
If your governance program only covers internal AI, you’re managing maybe 30% of your actual risk.
Step 4: Monitor Vendor AI Performance Continuously
You can’t just set up vendor AI and walk away. You need ongoing monitoring.
What to track:
- Are outputs consistent with expectations?
- Are there patterns that suggest bias or errors?
- Have outcomes changed since implementation?
- Are users reporting problems?
- Has the vendor pushed updates that changed behavior?
Red flags that require immediate action:
- Sudden changes in decision patterns
- User reports of unfair or unexpected outcomes
- Vendor model updates without proper documentation
- Inability to explain specific AI decisions
- Gaps in vendor compliance documentation
If you don’t have monitoring in place, you’re flying blind.
The Uncomfortable Truth About AI Vendor Liability
Here’s what your legal team might not be telling you: your carefully negotiated indemnification clauses probably won’t help.
Why not?
Because when regulatory investigations or class action lawsuits start, they name everyone in the chain: you, the vendor, sometimes even individual executives.
Your vendor’s indemnification might give you a claim against them. But that doesn’t stop you from being a defendant. It doesn’t prevent the regulatory fine. It doesn’t unwind the reputational damage.
And if your vendor goes out of business, gets acquired, or just decides to fight the indemnification claim? You’re on your own.
The only real protection is proactive risk management: proper due diligence, strong contracts, and continuous oversight.
Stop Hoping Your Vendors Have This Covered
If your AI vendor strategy is “we buy from reputable companies, so we’re probably fine,” you’re not managing risk. You’re outsourcing hope.
Reputable vendors get things wrong, too. Established companies ship non-compliant AI. Even the biggest names in tech are facing regulatory scrutiny for their AI systems.
Your liability doesn’t depend on your vendor’s reputation. It depends on whether your AI systems actually comply with the law.
And the only way to know that is to do the work: proper due diligence, strong contracts, ongoing monitoring, and real governance.
Schedule a 30-minute AI Vendor Risk Assessment, and we’ll analyze:
- Your current vendor AI exposure
- Gaps in your contracts and due diligence processes
- What monitoring should you have in place
- How to integrate vendor AI into your governance program
We’ve helped dozens of organizations fix their vendor AI risk management—before it turned into regulatory actions or lawsuits.
Because when a regulator investigates your AI vendor’s system, they’re not calling your vendor.
They’re calling you.
Are you ready for that call?
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor
brian@visionaiconsult.com | 877-424-7853