nerdexam
Isaca

AAIA · Question #24

When using off-the-shelf AI models, which of the following is the MOST appropriate way for organizations to approach vendor management?

The correct answer is B. Establish responsibility and clear terms for model updates and support. Effective vendor management for AI models requires clear contractual terms that define who is responsible for model updates, bug fixes, support, and what happens when the model behaves unexpectedly. AI models change over time through updates that can alter outputs, so…

AI Risk Management and Controls

Question

When using off-the-shelf AI models, which of the following is the MOST appropriate way for organizations to approach vendor management?

Options

  • AEnsure a minimum of three quotes have been obtained for market research and comparison.
  • BEstablish responsibility and clear terms for model updates and support.
  • COnly use models from vendors with globally recognized accreditation.
  • DUse the vendor only if the contract has been reviewed by the information security department.

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    73% (27)
  • C
    8% (3)
  • D
    16% (6)

Explanation

Effective vendor management for AI models requires clear contractual terms that define who is responsible for model updates, bug fixes, support, and what happens when the model behaves unexpectedly. AI models change over time through updates that can alter outputs, so accountability must be formally established. Option A (three quotes) is a procurement practice, not an ongoing vendor management strategy. Option C (globally recognized accreditation) is overly restrictive and not a reliable proxy for fit-for-purpose AI governance. Option D (security review) is one input but insufficient on its own for comprehensive vendor management.

Topics

#AI Vendor Management#AI Model Lifecycle#Operational Risk#Contractual Controls

Community Discussion

No community discussion yet for this question.

Full AAIA Practice