Third-party AI
Artificial Intelligence (AI)
Why Clear AI Use-Case Ownership Is Crucial to Avoid Risk Bottlenecks and Accelerate Innovation
AI initiatives often stall not because of the technology itself, but because unclear ownership creates risk bottlenecks and delays. Business leaders must claim clear accountability for AI use cases to enable faster, safer innovation and better risk management.
Artificial Intelligence (AI)
How to Master AI Risk Control Testing for Real-World Assurance
NIST’s August 2026 TEVV-Athlon draft makes real-world AI evaluation a current governance issue. Businesses should connect every test to pre-agreed acceptance thresholds, a named decision owner and clear retest triggers.
Artificial Intelligence (AI)
Why Clear Third-Party AI Evidence Requirements Are Non-Negotiable for Risk Management Success
ASD’s Australian Cyber Security Centre and the UK National Cyber Security Centre show why AI supplier assurance must cover the full lifecycle and extended supply chain. Moffatt v Air Canada demonstrates that business accountability remains with the organisation using the automated service.
Artificial Intelligence (AI)
Why AI Risk Management Must Treat Privacy as a Dynamic, Context-Specific Challenge
The UK Information Commissioner’s Office expects AI transparency and supply-chain due diligence to evolve as processing purposes become clearer. NIST’s AI Risk Management Framework shows how privacy risk should be documented, measured and monitored throughout the AI lifecycle.
Artificial Intelligence (AI)
Why AI Risk Management Must Address Vendor Change Controls to Prevent Operational Disruption
Microsoft Azure AI Foundry and Amazon Bedrock show how model retirement can shorten notice periods, stop requests and require code changes. The EU's DORA framework shows why notification, objection and exit rights must connect to a tested operational response.
Artificial Intelligence (AI)
Why AI Risk Management Must Focus on Third-Party Evidence Verification, Not Vendor Promises
The Australian Cyber Security Centre's procurement and AI supply-chain guidance shows why vendor assurance must be refreshed when services change. OAIC guidance adds a clear requirement for organisations to conduct privacy due diligence on commercially available AI products.
Artificial Intelligence (AI)
Managing AI Model Risk Beyond Traditional Frameworks: A New Approach for Business Leaders
This piece looks at the questions Australian business and risk leaders should be asking before their own AI model drifts
Artificial Intelligence (AI)
Third-Party AI: Someone Else Built the Autopilot, but You’re Still Flying the Plane
APRA's April 2026 letter named third-party AI risk as the biggest gap in bank and insurer oversight — and weeks later, a compromised account at AI tooling vendor Context.ai gave attackers a path into Vercel's infrastructure. This piece uses both to show why vendor assurance paperwork isn't AI risk management, and what to ask instead.