AI Vendor & Supply Chain Risk
Risk assessment for the AI vendors, models and data your business depends on.
Much of your AI risk sits outside your walls. Vendors build AI into the tools you already use, third-party models power your products, and data providers shape what those models learn. You remain accountable for each link. Ethos helps you find those links, assess them and set the standards your vendors must meet.
Book a discovery call
How we start
A vendor interview, using a written form and a conversation, maps the third-party AI in your stack: tools, models, data providers and integrations. What we learn sets the focus of the due diligence framework and the monitoring plan.
What we assess
- Which vendors use AI in the products and services you rely on
- Third-party models and data providers, and how data flows to and from them
- Current vendor due diligence and onboarding practice
- Vendor commitments on AI use, data handling and incident notice
- Where a single vendor or model failure would stop critical work
- Alignment with frameworks such as the EU AI Act, NIST AI RMF, ISO/IEC 42001, and Colorado and California AI rules
What we advise on
- A vendor AI due diligence framework and questionnaire
- Risk tiers for vendors, based on AI use and data access
- Contract safeguards to raise with your legal team
- Ongoing monitoring and a periodic reassessment schedule
Start with a discovery call
Discovery call → scoping assessment → vendor interview and maturity assessment.