AI assistant on by default for all seats
Summaries now run on a different model
New terms: customer content may improve AI features
Use
Approval happens once per product, but the same tool can be low risk in one team and high risk in another.
Supply chain
Your contract is with the vendor. The model provider underneath is one you never assessed.
Ownership
Procurement, security, privacy and legal each own part of the vendor. Nobody owns the AI inside it.
Security
The vendor passes, and nothing on file describes its AI at all.
AI governance
It was approved for drafting copy, and its new job counts as high risk under the EU AI Act.
Privacy
The notice lands in a shared inbox, and no one links it to the teams using the product.
Procurement
The approval is in a procurement thread from two years ago, and its owner has since left.
Why it keeps happening
64% of organizations assess an AI tool’s security before it’s deployed, but only 40% review it periodically.1 In UK financial services, 46% of firms report only a partial understanding of the AI they use, mostly because of third-party models.2 Average scores on the Foundation Model Transparency Index fell from 58 in 2024 to 40 in 2025.3
Vendor to model
Reason: Vendor moved summaries to a new model
Send the new feature through review
Raise a request for just that feature. The earlier approval stays on its record, and the new decision shows in the inventory.
See AI intake and reviewAssess the new use on its own
Each system built on a vendor’s product gets its own assessment, against the EU AI Act or your own policy. Vendor risks show on each connected system.
See AI risk and complianceKeep the chain from vendor to model
Link each vendor to its products, the systems that use them and the models underneath. Replace a model, and the reason, person and date are kept.
See AI discovery and inventoryWhat is third-party AI risk management?
Third-party AI risk management means knowing which AI your vendors supply, which models sit underneath, how your teams use it and what risks follow. One review at purchase can’t cover it, because vendors keep adding features, changing models and rewriting their terms.
Does Enzai replace our TPRM or GRC tools?
No. Keep your questionnaires, contracts and vendor due diligence where they are. Enzai covers the AI detail those reviews rarely reach: which products use AI, the systems and models behind them, and the risks of each way your teams use them. You can export a vendor’s record as PDF or CSV to file with your vendor review.
What happens when a vendor changes its model?
Someone on your team records it. Replace the model on each system that uses it and give a reason. Enzai keeps who made the change and when, with the earlier model in the system’s history. Enzai doesn’t watch vendors’ release notes, terms or sub-processor lists for you, so a person still raises the change.
How do we show an auditor how a vendor’s AI was approved?
Start from the vendor’s record: its products, the systems that use them and their owners, each system’s assessments and model history, and the risks scored on the vendor before and after treatment. Each request keeps its decisions, with names and dates. Whether that meets a standard like ISO 42001 is for your auditor to decide.
