Handbook practice: third party ai risk
Is this legally binding?
Guidance. Voluntary guidance. Best practice, not obligation, until a contract or a regulator cites it.
Uplift practices for managing third-party AI risks (Handbook 2.3, Consideration 4): due diligence, transparency expectations and supply-chain awareness for vendor, cloud and open-source AI; ISO/IEC 42001:2023 disclosure elements referenced. Industry guidance, not a regulatory requirement.
What this connects to
1 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Cites1
- SectionHandbook Section 2: AI risk managementGuidance
Practice within this Handbook section
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.