Third-Party AI Risk Management and Supply Chain Security

CRAGE · 20 questions

• City procurement drafts due diligence for an AI vendor RFP. Which questionnaire coverage best fits AI-specific risk?
• County legal is hardening contracts for a GenAI case-note summarizer. Which clause set best supports AI vendor governance?
• Transit evaluates reliance on one GenAI API for all rider communications. Which third-party risk should leadership prioritize?
• A housing authority learns its chatbot vendor fine-tunes on customer tickets. Which third-party AI risk category is in play?
• A water utility maps AI supply-chain threats before adopting pretrained components. Which threat set belongs in the review?
• A library requires assurance before buying GenAI for staff research support. What evidence mix best fits?
• Public health reviews a vendor model that may process clinic admin data. Which regulatory-aligned vendor check is most appropriate?
• 311 operations want ongoing insight into an AI vendor after go-live. Which monitoring set best fits continuous vendor oversight?
• Courts IT is preparing to renew a legal-research GenAI contract. What assurance step best fits the vendor lifecycle?
• An elections office ends a GenAI pilot that held civic corpora. Which offboarding actions are most responsible?
• Fire/EMS learns a CAD assist vendor added a new model host. What supply-chain review should follow?
• An assessor’s office decides whether to renew an AI valuation-assist vendor. What decision basis best fits?
• Parks staff propose a free consumer GenAI for official trail guidance. What evaluation outcome best fits civic controls?
• City GRC maps how privacy and AI obligations reach vendors. Which flow-down expectation is most appropriate?
• County GRC shares a case study after a biased vendor screening tool shipped without local fairness testing. What oversight lesson fits?
• A utility negotiates SLAs for a vendor-hosted AI outage predictor. Which commitment best fits change control?
• Public works finds open-source model components in a vendor stack. What supply-chain step should come first?
• 311 updates its incident playbook for AI outages that affect residents. What vendor expectation belongs in the contract?
• Housing legal drafts an AI eligibility-tool contract. How should liability for discriminatory outcomes be addressed?
• A city AI board wants executive visibility into vendor AI risk. Which dashboard content best fits?