AI Vendor Risk & Procurement Compliance
Most organizations don't build AI, they buy it, and when purchased AI fails, the consequences land on the buyer. This course teaches you to find the AI already in your vendor stack, tier each use by data and decision, and run a procurement gate people actually use. You'll learn the questionnaire that matters, how to verify vendor claims with a pilot, and the data, performance, and exit clauses to bring to counsel. You'll finish with a vendor governance lifecycle and a register that answers audits in a day.
Course details
Duration
1h 02m 56s
Lectures
15
Video
1 hour
Quizzes
1
Level
Beginner
Course Description
Vendor AI arrives embedded in software you already license, wired in through APIs, and adopted by staff with a credit card. When it fails, regulators, courts, and customers look to the deployer, and "the vendor said it was fine" is not a defense. This course teaches you to buy AI on terms you can defend.
What you'll learn
- The buyer's four-layer risk stack and the regulatory hooks that reach AI deployers
- Running a vendor AI census and catching feature-flag creep in approved tools
- Tiering each use by data sensitivity and decision consequence, then gating by tier
- The vendor questionnaire, evidence over assertion, and a pilot on your own cases
- Data, performance, liability, and exit clauses, including no-training and model-change notice
- Monitoring, model change management, vendor incidents, and the vendor register
Who it's for
Procurement, vendor management, IT, security, privacy, legal operations, and compliance professionals, plus any manager who buys, approves, or owns AI tools.
15 short video lessons in three modules: The Third-Party AI Problem; Due Diligence & Contracts; and Ongoing Vendor Governance.
This course is educational and is not legal advice. Counsel drafts contract language, and your organization's policies govern.
Module 1: The Third-Party AI Problem
-
1.1 You Bought It, You Own the RiskThe deployer's position — why vendor AI failures land on the buyer.
In this lesson:
- Explain the deployer's accountability position
- Understand why vendor assurances aren't a defense
- Name the four layers of the buyer's risk stack
-
1.2 Where AI Hides in Your Stack
Embedded features, APIs, shadow procurement — the vendor AI census.
In this lesson:
- Recognize the three ways vendor AI enters an organization
- Run a vendor AI census
- Catch feature-flag creep in existing tools
-
1.3 The Regulatory Hooks
The rules that reach AI buyers — deployer duties, privacy flow-through, customer flow-downs.
In this lesson:
- Identify deployer duties under AI regulation
- Trace privacy obligations through vendor relationships
- Recognize customer flow-down requirements
-
1.4 Risk-Tiering Vendors & Use Cases
Data sensitivity times decision consequence — tier the use, not the logo.
In this lesson:
- Tier vendor AI by data sensitivity and decision consequence
- Match diligence depth to tier
- Tier uses, not vendors
-
1.5 The Procurement Gate
The intake gate that catches AI purchases before the risk arrives.
In this lesson:
- Run the four-question intake
- Route requests by tier — fast lane and full review
- Make the gate faster than going around it
Module 2: Due Diligence & Contracts
-
2.1 The Questionnaire That Matters
Past the marketing — the questions that expose how a vendor's AI really works.
In this lesson:
- Ask the data-handling questions that matter
- Ask the model questions vendors don't volunteer
- Read answers: specific beats vague, refusal is information
-
2.2 Evaluating Vendor Claims
Evidence over assertion — verification, pilots, and the red flags.
In this lesson:
- Demand evidence for vendor claims
- Run a pilot on your own cases
- Spot the red flags that end conversations
-
2.3 The Contract: Data Clauses
No-training, processing terms, and provenance warranties — the data half of the deal.
In this lesson:
- Require the no-training clause
- Set the data-processing terms
- Get provenance and IP warranties on the vendor's training data
-
2.4 The Contract: Performance & Liability
AI SLAs, model-change notice, audit rights, and who pays when outputs go wrong.
In this lesson:
- Set SLAs that fit AI systems
- Require model-change notice
- Negotiate real audit rights and liability terms
-
2.5 Exit Rights & Portability
Data return, certified deletion, transition help — negotiating the ending first.
In this lesson:
- Secure data return and certified deletion at exit
- Negotiate transition assistance and avoid lock-in
- Apply the 90-day exit test
Module 3: Ongoing Vendor Governance
-
3.1 Continuous Monitoring
Why annual reviews fail for AI vendors — and the signals to watch instead.
In this lesson:
- Explain why annual questionnaires fail for AI
- Watch the three monitoring signal types
- Set cadence proportionate to tier
-
3.2 Model Change Management
The vendor updated the model — the playbook that keeps it from breaking you.
In this lesson:
- Treat vendor model updates as re-validation triggers
- Run the change playbook
- Use version pinning where offered
-
3.3 When Their Failure Is Your Incident
Vendor AI incidents land on you — coordination, clocks, and the post-incident loop.
In this lesson:
- Coordinate response when a vendor's AI fails
- Manage the two-clock notification problem
- Close the loop: joint review and contract feedback
-
3.4 The Vendor Register & Audit Trail
One source of truth that answers "show me your third-party AI governance" in a day.
In this lesson:
- Maintain the vendor register's core fields
- Answer governance requests in a day
- Feed procurement lessons back into the gate
-
3.5 The Vendor Governance Program
The full lifecycle assembled, right-sized — the course finale.
In this lesson:
- Assemble the vendor AI lifecycle
- Right-size the program to organization scale
- Complete the AI Vendor Risk & Procurement course
AI Vendor Risk & Procurement Compliance — Final Exam
Learn at your own pace
Study the materials at your convenience, you can always return to them to repeat
Certificate of completion
Complete every lesson and pass the final exam to earn a RiseCert certificate of completion you can download and share.
Your Name
AI Vendor Risk & Procurement Compliance
RISECERT
CERTIFICATE
For demonstrated knowledge and successful completion of all course requirements for:
MM.DD.YYYY
Certificate Date
Ready to get started?
Enroll in AI Vendor Risk & Procurement Compliance and earn your RiseCert certificate of completion.
Got Questions? We've Got Answers!
Answers to the most common questions about this course.
What is the AI Vendor Risk & Procurement Compliance course?
AI Vendor Risk & Procurement Compliance is a RiseCert online course on buying and governing third-party AI. It covers where vendor AI hides, risk-tiering uses, a procurement gate, the vendor questionnaire, pilots, the contract clauses that matter, exit rights, monitoring, model change management, vendor incidents, and a vendor register that answers audits in a day.
Who should take an AI vendor risk management course?
The course is built for procurement and vendor-management staff, IT and security teams, privacy and compliance professionals, legal operations, and any manager who requests, approves, or owns AI tools. It suits small organizations and enterprises alike, since the same vendor AI lifecycle is shown at both scales, from a simple form and spreadsheet to dedicated tooling.
Who is responsible when a vendor's AI tool causes harm?
The deployer, meaning the organization that chose to use the AI, answers to its customers. Your customers, your data, and your name stay yours whatever the contract says, and recovering anything from the vendor is a separate, contract-dependent fight. That is why AI Vendor Risk & Procurement Compliance treats diligence as the job of choosing well.
What is feature-flag creep in vendor AI?
Feature-flag creep is when a tool you approved years ago ships an AI feature in a routine update, often switched on by default. No new purchase happens, so no procurement review fires, and the old approval silently stretches to cover a new AI tool. The course teaches a four-step census, list, ask, trace, and record, to find it.
What contract clauses should an AI vendor agreement include?
The course's data checklist covers a no-training clause that also binds subprocessors, scope limits, defined retention, certified deletion, named subprocessors, a provenance warranty, and an output IP indemnity. Module 2 adds AI service levels with an accuracy floor, model-change notice with a re-validation window, usable audit rights, liability carve-outs, and exit terms. You bring the checklist; counsel drafts.
How do you evaluate an AI vendor's accuracy claims?
Treat a claim without evidence as marketing. The course ranks evidence as test reports with methodology, certifications and audits such as SOC 2 or ISO 42001, and references asked hard questions. The strongest evidence is a pilot on your own representative cases, including hard ones, scored against a success bar you set before seeing results.
How often should AI vendors be reviewed after purchase?
By tier, and more often than once a year for anything important. The course sets quarterly reviews plus live signals for high-tier uses, a semi-annual check for medium, and an annual glance for low. At any tier, events such as a vendor incident or acquisition trigger review immediately, and a material model change triggers re-validation.
What will I be able to do after this course?
You'll be able to run a vendor AI census, tier each use on data and decision axes, operate a four-question procurement gate, question and pilot vendors, bring a clause checklist to counsel, apply the 90-day exit test, monitor vendors by tier, manage model changes and vendor incidents, and keep a register that answers governance requests in a day.
Do I need a legal or procurement background to take this course?
No. There are no prerequisites, and concepts are explained in plain language with practical scenarios such as a resume-screening purchase, a 200-person company's census, and two companies facing the same renewal price hike. The contract lessons teach negotiation literacy, not drafting, so you know what to ask for while counsel writes and approves the final words.
How is this different from standard third-party risk management training?
Standard vendor reviews often rely on a long security checklist and an annual questionnaire. AI Vendor Risk & Procurement Compliance focuses on what is specific to AI: training on your data, silent model changes, accuracy and drift, output IP, fine-tuned model ownership, and AI lock-in, with monitoring cadence set by tier instead of once a year.
Is the regulatory content current?
Yes. The regulatory lessons are dated as of August 2026, covering deployer duties under the EU AI Act framework, privacy obligations that flow through vendors, California's automated decision-making rules, and customer flow-down terms. The course notes that dates and thresholds move, teaches the durable structure, and tells you to confirm specifics with counsel before relying on them.
How long is the course?
The course has about an hour of video, just over 63 minutes, across 15 lessons, plus a final exam. Lessons run about four minutes each and are organized into three modules: The Third-Party AI Problem; Due Diligence & Contracts; and Ongoing Vendor Governance. Most learners finish it in one or two sittings.
Is the course self-paced, and how long do I have access?
Yes. The course is 100% online and self-paced, and your access does not expire. You can start, pause, and resume at any time on a computer, tablet, or phone with a modern web browser. There's nothing to install, so you can return to the clause checklists whenever a renewal comes up.
Is there a final exam?
Yes. The course ends with a 30-question multiple-choice final exam covering all three modules. You need a score of 80% or higher, 24 of 30, to pass, and you can retake the exam as many times as you need. Finish all 15 lessons and pass the exam to complete the course and earn your certificate.
Will I get a certificate?
Yes. After you complete all 15 lessons and pass the final exam, you can download a RiseCert certificate of completion from your account. It is a course completion certificate, not a license, professional certification, or continuing education (CE or CPE) certificate.
Does the course qualify for CPE or continuing education credit?
No. AI Vendor Risk & Procurement Compliance is not currently approved for continuing education credit, including CE, CPE, or CEU credit, by any state, licensing body, or accrediting organization. If you need credit toward a license or professional designation, take a course approved by the body that issues it.
Is this course legal advice?
No. The course is educational and is not legal, procurement, or compliance advice. It teaches what to look for and ask for, while counsel drafts and approves contract language. Your organization's policies, its counsel, and applicable law govern what you do with a specific vendor or contract.
Does the course recommend specific AI vendors or tools?
No. The course is vendor-neutral and endorses no product. It teaches a method you can apply to any AI vendor: ask the data and model questions, read answers as evidence, pilot on your own cases, contract for what diligence found, and monitor the relationship. Certifications are mentioned only as types of evidence to request.
How much does the course cost?
The course costs $99 per learner as a one-time purchase, with no subscription or recurring fees. To enroll a procurement team, department, or whole organization, contact RiseCert through the Contact Us page at risecert.org.
What is the refund policy?
All sales are final and no refunds are issued, as stated in the RiseCert Terms of Use. Please review the course description, lesson list, and these FAQs before purchasing, and contact RiseCert through the Contact Us page at risecert.org with any questions first.