Glossary
Third-party risk management (TPRM)
How a regulated organization assesses and monitors the vendors it relies on, AI vendors included.
Third-party risk management is the life cycle a bank, insurer, or health system runs for each vendor: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. The US banking agencies set out that life cycle in their June 2023 interagency guidance, and it applies to an AI product the same way it applies to any other service. What a bank's third-party risk review asks an AI vendor walks through it.
For an AI vendor, the review asks which models the product calls, what customer data reaches them, which controls apply, and how the reviewer can check. Meilynx produces an evidence package addressed to that reviewer, with answers keyed to common vendor-risk questions and an audit chain the reviewer can verify offline.