Most organisations don’t have an AI privacy problem. They have a vendor-assessment problem: a tickbox questionnaire that gets signed off, filed, and never checked against what the tool actually does with a person’s data.
That gap is where the damage happens — and by the time it surfaces, the vendor may not even exist to answer for it.
The 30-second take
Generic vendor privacy assessments are built to satisfy a checklist, not your obligations.
They rarely map data flows specific to your use case, rarely account for state-based obligations, and say nothing about what happens if the vendor itself fails.
Three recent events show why treating a signed-off form as evidence of control is a mistake: a national health records provider where regulatory follow-through evaporated the moment the vendor collapsed, a lender fined twice by two different regulators for governance failures that outlasted its original breach, and new industry data showing vendor-side incidents now drive the majority of large-scale breaches. None of that risk shows up in a generic assessment.
When the vendor disappears, so does accountability
MediSecure, the electronic prescription provider used across the Australian health system, was breached in 2024, compromising personal and health information linked to an estimated 12.9 million people — one of the largest breaches in the country’s history. MediSecure said the incident likely originated with a third-party vendor, though it never publicly named which one. Before the full scope was established, MediSecure entered administration. The Office of the Australian Information Commissioner (OAIC) reviewed the matter but ultimately closed its inquiry, stating that a full investigation into MediSecure’s information-handling practices would not be a proportionate use of resources once the company had ceased operating.
The lesson isn’t really about MediSecure’s specific failure. It’s that the accountability chain your vendor assessment assumes exists can simply stop existing. A signed data-processing agreement is not evidence that anyone will still be answerable in twelve months.
Repeat governance failures compound
Latitude Financial’s 2023 data breach exposed roughly 7.9 million driver licence numbers, 53,000 passport numbers and 6.1 million customer records — among the largest breaches in Australian corporate history. In 2026, a different regulator altogether, the Australian Communications and Media Authority, fined Latitude $3.96 million after finding more than 2.7 million spam law breaches between March 2024 and April 2025, including hundreds of thousands of marketing messages with no working unsubscribe function. It was Latitude’s second such penalty.
The specific violation was unrelated to the original data breach, but the pattern is familiar: a governance gap identified once, left unresolved, resurfacing under a different regulator’s jurisdiction years later.
Vendor and data-handling risk doesn’t stay contained to the incident that first exposed it.
The vendor-breach share keeps climbing
This isn’t isolated. The Privacy Rights Clearinghouse’s 2025 Data Breach Report found that eight of the twenty largest breaches reported that year originated at service providers and vendors, not the organisations whose customers were ultimately affected — together accounting for 231 million of the roughly 375 million people impacted across all reported breaches that year.
Vendor and supply-chain exposure isn’t the exception in AI and data risk. Increasingly, it’s the majority case.
Why generic assessments miss all of this
AI systems frequently process personal and sensitive data in ways vendors do not fully disclose, let alone tailor an assessment to.
Local privacy obligations — for example, the NSW Privacy and Personal Information Protection Act’s requirements around transparency, proportionality and accountability — sit outside what a generic, nationally-pitched vendor questionnaire is built to address.
None of the three examples above would have been caught by a standard sign-off. Each needed someone inside the organisation asking harder, more specific questions before the relationship began — and continuing to ask them after.
Questions to ask your organisation
- Have we mapped exactly what personal data this AI vendor touches, where it flows, and who can access it — or are we relying on their summary of it?
- What happens to our data, and our ability to get answers, if this vendor enters administration or is acquired?
- Does this vendor’s assessment address the specific state, sector, or jurisdictional obligations we operate under, or just a generic national baseline?
- Who inside our organisation owns the follow-up when a vendor’s evidence doesn’t match what the system actually does?
- If this vendor had a breach tomorrow, could we tell a regulator what data was exposed and how, inside the required notification window?
- Have we revisited this vendor’s risk profile since onboarding, or is the original assessment still the only evidence on file?
Where to start
Generic assessments are a starting point, not a control.
If you want to see how your organisation’s AI vendor oversight actually holds up, run our readiness snapshot.