Share with your CISO
At the 2026 Third-Party Risk Management and Supply Chain Summit in Chicago, compliance practitioners put a sharper point on a problem most enterprises have been circling: AI isn’t just a tool inside your vendor-risk program, it’s a new risk category that demands its own due diligence lane. Michel Paradis of Steptoe LLP flagged anchoring bias, the tendency to treat an LLM’s first answer as the correct one, as a live operational hazard. Maurice Crescenzi of ECI Compliance Week confirmed that AI governance is now a standard checkpoint when vetting suppliers or acquisition targets in TPRM reviews.
What this means for your business
If your third-party risk management program still treats AI as a subcategory of data privacy or cybersecurity, you’re already behind the practitioners setting the new baseline. The question that decides whether this story is about you is simple: does your vendor questionnaire ask how a supplier governs its own AI systems, not just what data they touch? Companies with mature TPRM processes are adding that layer now; companies that haven’t will find it in their next regulatory exam or M&A due diligence request.
The anchoring-bias warning from Paradis is the sharper, less-discussed half of the argument. When AI accelerates adjudication inside a TPRM workflow, it compresses the time a reviewer spends before they’ve seen a machine-generated answer, and compressed time is precisely when anchoring bites hardest. The process risk isn’t that AI gives wrong answers; it’s that human reviewers stop generating independent ones. That’s a control failure dressed up as an efficiency gain, and your audit committee won’t distinguish between the two after the fact.
The vendor whose AI governance you can’t assess clearly is now the same category of risk as the vendor whose SOC 2 you can’t obtain. If a supplier can’t explain how its models are trained, monitored, or overridden, that opacity belongs in your risk register with a materiality weight attached. The budget case for upgrading your TPRM tooling gets much easier the moment a single third-party AI failure lands in a board report, and that moment is no longer hypothetical.
Based on reporting from ECI-CW TPRM 2026: The two sides of the coin in AI risk management, originally published 2026-11-06 17:12:00.
