3rd Party Risk Management , Agentic AI , Artificial Intelligence & Machine Learning

Third-Party Risk Management Needs an Upgrade for AI Agents

Third-party risk management isn't new, but what counts as a third party when an artificial intelligence agent or a community of agents becomes part of the ecosystem? Risk teams must look beyond traditional vendors to every organization they depend on, said Alex Golbin, a technology and data executive focused on enterprise resilience in financial services.

But traditional TPRM relies on annual assessments and what Golbin called "overgrown questionnaires."

"Is an annual questionnaire good enough because it's going to be based on a model that could be drifting, could be changing million times between that time?" he said. "So you have to look at more continuous monitoring."

Golbin's alternative, which he calls all-entity risk management, maps dependencies on data, models and agents as well as contractual suppliers. Organizations need to understand dependencies before an incident, map the potential blast radius and determine whether humans can take over when automated processes or critical providers fail.