AI Vendor Risk Assessment: How to Build a Security and Privacy Risk Register for AI Providers

Your risk process rates a meeting-notes assistant as low risk because the contract is small. It records every board call. Spend is a poor proxy.

An insurer does not price a policy by asking what the car cost. It asks who drives it, where and how often. Many risk programmes still rate software by contract value, which badly misprices AI tools. This guide shows how to tier AI providers by use, keep one risk register, rate risk before and after controls, and decide what to accept.

Why spend-based tiering misprices AI

Traditional tiering looks at data held, criticality and spend. AI tools break those assumptions. Data arrives through prompts and uploads, so exposure depends on how people use the tool. Outputs can be confidently wrong, and many tools now take actions.

Usage also runs ahead of procurement. The 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. IBM's 2025 research found that high levels of shadow AI, meaning unapproved tools, added about USD 670,000 to the average breach cost. It also found that 63% of organisations had no AI governance policy.

Step 1: Tier each provider by inherent risk

Inherent risk is the exposure before any provider controls. Score five factors from 1 to 3 and add them. Each factor describes how your organisation will use the tool, which you can verify.

Factor	1: Low	2: Medium	3: High
Data sensitivity	Public or synthetic data	Internal business data	Personal, regulated or confidential data, or source code
Autonomy	Suggests text a person reviews	Drafts used with light review	Acts without human approval
Decision impact	Internal convenience	Indirect effect on customers or finances	Affects rights, money, safety or legal position
Reach	Small pilot group	One department	Organisation-wide or customer-facing
Model supply chain	One disclosed model	Disclosed third-party models	Undisclosed or frequently changing models

5 to 8 is Tier 3, 9 to 11 is Tier 2, 12 to 15 is Tier 1. Adjust the bands to your risk appetite.

The tier sets the depth of review. A Tier 3 tool may need only a short questionnaire. A Tier 1 tool warrants the full register, hands-on testing, privacy review and a named business owner. Re-tier whenever a factor changes.

Step 2: Build one register for security and privacy

A risk register lists specific risks, each with an owner, a rating and a decision. Keep security and privacy together, because one control often treats both. A contractual ban on training with your data is a good example. The NIST AI 600-1 Generative AI Profile, published in July 2024, names 12 generative AI risks. Six recur in most assessments.

Data privacy: personal data used, retained or disclosed beyond your purpose, including for training.
Information security: attacks on the AI itself, such as prompt injection, where hidden text manipulates the model.
Confabulation: confident but false output, often called hallucination.
Human-AI configuration: over-trust in outputs, or actions taken without the right approval.
Value chain: untraceable upstream models, data or components.
Intellectual property: inputs or outputs that create infringement or confidentiality exposure.

Add conventional risks too, such as provider viability and difficulty of exit. ISO/IEC 23894:2023 guides AI risk management. ISO/IEC 42001 sets requirements for an AI management system that a mature provider may hold.

Step 3: Rate before and after verified controls

Rate likelihood and impact from 1 to 5 and multiply them. Do it twice: once for inherent risk, and once for residual risk after verified controls. Verification means a contract clause, a test result or an independent report. Controls you have only been told about do not reduce the score.

Hypothetical example: a customer-support assistant that reads tickets containing personal data and can issue refunds up to a set limit.

Risk	Inherent	Verified control	Residual
Tickets used for training	16	Training banned in data processing agreement	4
Prompt injection triggers refunds	15	Staff approval above a threshold; sandbox tested	6
One customer's data in another's reply	15	Scoping claimed, not yet tested	15
Confabulated policy answers	12	Grounded answers; weekly sampling	6
Ticket text kept in logs	12	30-day retention with deletion confirmation	4

Hypothetical example. Scores are likelihood × impact, out of 25. Residual 15 or more blocks go-live.

The provider's rating follows its worst residual risk, not the average. The average here is 7, which looks acceptable and hides an untested cross-customer leak. The decision is conditional approval, with go-live blocked until a retest proves retrieval is scoped per customer.

Step 4: Treat each risk, then reassess on change

Every risk above the acceptance line needs a treatment and an owner. Reduce likelihood with verifiable controls, such as approval steps and rate limits. Reduce impact with caps, such as refund ceilings. Otherwise transfer cost through contract terms, avoid the use case, or accept the risk in a signed, dated decision.

In NIST AI Risk Management Framework terms, tiering sits in Map, rating in Measure and treatment in Manage, all under Govern. Reassess at least yearly. Reassess sooner when the model, capabilities, data categories or terms change, or after an incident.

The window is now. EU AI Act Article 50 transparency obligations have applied since 2 August 2026, and Annex III high-risk obligations were postponed to 2 December 2027. India's DPDP Rules, notified on 14 November 2025, phase in over 12 to 18 months.

Conclusion

An underwriter who priced every car by its sticker would lose money on the cheap ones driven hardest. AI tools are the same: low spend says nothing about what a tool sees, decides or does.

A defensible assessment tiers by use, keeps one register, credits only evidenced controls and lets the worst residual risk decide. This week, list every AI tool your teams already use, paid or free, and score each against the five factors. The Tier 1 names are your first register entries.

Frequently asked questions

What is the difference between inherent and residual AI risk?

Inherent risk is the exposure before relying on any controls. Residual risk is what remains after controls verified with evidence. Controls that are only described should not lower the residual rating.

Should an AI risk register cover privacy as well as security?

Yes. Many controls, such as a contractual ban on training with customer data, treat both, and a single register avoids gaps between separate reviews.

Which framework lists AI-specific risk categories?

The NIST AI 600-1 Generative AI Profile lists 12 risks unique to or worsened by generative AI, including data privacy, information security and confabulation. ISO/IEC 23894:2023 gives broader guidance.

Why not average risk scores into one provider rating?

Averaging lets strong controls in one area hide a critical gap in another. Letting the highest residual risk drive the rating keeps serious issues visible.

How often should AI provider risk be reassessed?

At least annually, and whenever the model, capabilities, data categories, sub-processors or terms change, or after an incident at the provider or its model supplier.

Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.