What is AI vendor governance?
AI vendor governance is the structured assessment and ongoing oversight of third-party AI system providers. When an organisation deploys an AI system built by an external vendor, the deployer cannot outsource its governance responsibility.
AI vendor governance ensures that the vendor's system documentation, data governance practices, risk management, and compliance posture meet the deployer's requirements under the EU AI Act and GDPR. It bridges the gap between provider obligations and deployer obligations.
Key points
- Deployers must assess whether the AI provider has fulfilled their provider obligations: technical documentation, instructions for use, conformity assessment, post-market monitoring.
- Vendor governance extends GDPR processor governance: data processing agreements, TOM profiles, and sub-processor management apply when the AI system processes personal data.
- Vendor changes — new versions, modified terms, changed data practices — may trigger re-assessment of the deployer's governance record.
- Vendor governance documentation must be part of the AI system's governance record, not managed separately in procurement files.
Why it matters
Most enterprise AI systems are third-party products. The organisation is a deployer, not a provider. But deployer obligations under Art. 26 require active governance of how the system is used, monitored, and evidenced. Vendor governance provides the information basis for this: what the provider guarantees, what documentation exists, what gaps the deployer must fill.
How EAB approaches this
Vendor Governance in EAB documents third-party assessments. TOM Profiles capture technical and organisational measures per vendor. The GDPR–AI Act Bridge connects vendor data practices with AI governance requirements. Vendor information feeds into the AI governance record.