AI increases cybersecurity blind spots in third-party risk

Periodic reviews can no longer keep pace with how quickly AI vendors change

Organizations are adopting AI at a rapid pace, but the risks extend beyond the AI systems themselves. Many AI solutions depend on cloud providers, foundation model providers, data providers and specialized software vendors. Yet organizations often continue to assess these third parties through annual reviews and static questionnaires.

“The risk profile of an AI vendor can change significantly within a matter of weeks,” says Giovanni Ferronato, Senior Manager Cybersecurity at IG&H. “A cyber incident, an acquisition, a change in data processing or new AI functionality can fundamentally alter the level of risk.”

IG&H’s annual 2026 CISO Pulse survey, conducted among 27 security leaders, shows that third-party risk is high on the agenda. Half of the CISOs surveyed cite third-party and supply chain exposure as one of their biggest concerns, while 55% are concerned about dependence on a small group of hyperscalers outside the EU.

At the same time, AI is making the challenge more complex. Three in four security leaders surveyed identify AI as one of their biggest concerns, both because it enables attackers to move faster and because of the errors it can cause within organizations. Yet after capacity, AI governance is the area in which CISOs feel least prepared. Measures to ensure compliance with usage policies, restrictions on tools and monitoring are often still “planned” or “under discussion” rather than actually implemented.

That gap is becoming more urgent as new European regulations take effect. The Digital Operational Resilience Act (DORA) requires financial institutions to maintain visibility into their ICT providers and continuously manage third-party risks. The EU AI Act also imposes requirements around governance and accountability. While some obligations are being phased in over the coming years, parts of the legislation are already in effect and can be enforced by regulators.

“In practice, regulators can already request evidence, assess whether transparency obligations are being met and take action against prohibited practices. Governance expectations are already in place, while many organizations are not yet ready. Saying ‘the vendor’s AI made the decision’ does not absolve an organization of its own responsibility,” cautions Davide Bonalumi, Senior Manager Cybersecurity at IG&H.

This is where DORA and the AI Act converge. Both regulations make clear that accountability cannot simply be outsourced to technology vendors. As a result, Third-Party Risk Management (TPRM) is evolving from a periodic control into a continuous process in which organizations need to be able to track changes at their vendors and the associated risks.

The financial stakes are significant. Under the AI Act, fines for prohibited AI practices can reach €35 million or 7% of worldwide annual revenue, while other violations can result in fines of up to €15 million or 3% of revenue. Failed compliance and insufficient auditability are already the most frequently cited concern among CISOs, at 80%. At the same time, 90% say capacity constraints are hampering implementation.

“The organizations that struggle most with DORA and the AI Act are often those that treat them as a compliance exercise,” says Bonalumi. “Compliance should be a byproduct of a well-designed third-party risk management process rather than the objective itself. Regulators increasingly want evidence that risks are being actively managed, rather than proof that a spreadsheet was updated just before an audit.”