Audit evidence

Three real 2026 outages — AWS's cascading Middle East failure, Microsoft Copilot's five-hour blackout, and Claude's multi-model cascade — show why AI risk management can't stop at the vendor you signed with. With EU AI Act deployer obligations enforceable from August 2026 and Gartner naming \u201cfourth-party\u201d AI risk directly, boards need to map the AI hiding inside their vendors' vendors.

The UK's new Critical Third Parties regime — covering AWS, Microsoft, Google Cloud and Oracle — signals that strong AI vendor oversight is becoming the new baseline for trust. Organisations that build this capability now, ahead of the curve, stand to gain faster vendor decisions, stronger customer confidence and far fewer surprises.

Many organisations unknowingly inherit significant AI risks through third-party technology and vendor services. Without rigorous independent challenge and clear ownership, vendor assurances fall short. Leaders must demand tailored evidence and embed structured AI risk governance that addresses supply chain complexities and local obligations.

Third-party vendors increasingly embed AI into their services, yet many organisations rely too heavily on vendor assurances without independent verification. Effective AI risk management demands clear ownership, thorough evidence review, and ongoing oversight to meet governance and regulatory expectations.