Fire/EMS learns a CAD assist vendor added a new model host. What supply-chain review should follow?
Select an answer to reveal the explanation.
Short Explanation
New model host means a new neighbor in your supply chain. Review the subprocessor list—fourth parties can bite just like the prime vendor.
Full Explanation
Fire/EMS learning a CAD assist vendor added a new model host must treat that as a supply-chain change introducing fourth-party exposure. Review the updated subprocessor list for fourth-party model-host risk is correct because a new host can process emergency-adjacent data under different security, residency, and incident postures than the prime vendor. Civic Fire/EMS contracts typically require notice and review of subprocessors; model hosting is squarely in that category for AI-assisted CAD.
Ignore subprocessors because only the logo on the invoice matters fails by concept: invoice branding does not define who actually hosts or processes AI workloads. Approve any new host automatically without notice or review fails by concept: auto-approval skips due diligence required for emergency AI tools. Treat fourth-party hosts as out of scope for emergency AI tools fails by concept: fourth parties that host models are in scope for supply-chain and data-protection review.
Exam caveat: reviewing the subprocessor list is necessary but not always sufficient—follow with security questionnaire deltas, region checks, and contract amendments if the new host is material. Emergency operational urgency does not erase the need for documented review; use expedited review paths if needed.
Operational check: when the CAD assist vendor announces a new model host, obtain the updated subprocessor list; assess fourth-party security/residency/incident terms against Fire/EMS requirements; approve, condition, or reject; update the vendor risk file; and verify monitoring/alerting still covers the new host path before production traffic moves.