Creating Artificial Intelligence Governance and Oversight Programs — 2026 Expanded Edition From John Fisher, J.D., Attorney at Law | Continuous AI Governance
Most AI governance attention focuses on the procurement and contracting phase. Organizations invest substantial time and resources in vendor due diligence, in negotiating contract provisions, and in securing the signed agreement that formally initiates the vendor relationship. Legal, compliance, and technology professionals spend months on the evaluation of vendor AI systems, the review of vendor security certifications, and the negotiation of data use restrictions, indemnification clauses, and termination rights. And then the contract is signed, the system goes live, and governance attention moves on to the next procurement.
Third-party AI risk management addresses what happens next. Continuous AI Governance. The governance obligations that arise the moment an AI vendor relationship goes live are not resolved by the signing of the contract — they are initiated by it. Continuous monitoring, supply chain mapping, incident response coordination, exit planning, and annual audit are governance disciplines that begin on day one of the vendor relationship and do not end until the last byte of organizational data is certified deleted from the vendor’s systems. For most organizations, these post-signature governance obligations are far more demanding than the pre-signature activities that receive the bulk of governance attention.
Available Now! September 2026 Pressing
Creating Artificial Intelligence Governance and Oversight Programs
By Attorney John Fisher
Third-party AI risk is qualitatively different from general vendor risk in ways that governance frameworks must specifically address. First, AI systems are opaque in ways that traditional software is not. An organization can inspect the source code of a custom-developed application; it cannot inspect the weights, architecture, or training data of a commercial AI model. The opacity of AI systems creates accountability gaps without historical precedent in technology vendor management. Second, AI performance can degrade silently without triggering obvious alerts. A credit scoring model that was accurate when deployed may drift as the population it evaluates shifts — and the drift may be invisible to monitoring systems that watch for availability failures rather than accuracy degradation. Third, a small number of dominant AI providers create concentration risk without historical precedent. The failure of a single major foundation model provider could simultaneously affect AI systems across thousands of organizations, with no immediate alternative available. Fourth, regulatory frameworks impose continuing obligations on organizations for their vendors’ AI systems that cannot be delegated away by contract. The organization is accountable to regulators for the behavior of the AI systems it deploys, regardless of who built or operates those systems.
