Third-party risk management was built for a world of static software and annual attestations. That world is gone. Suppliers now embed foundation models, retrain continuously, and depend on a network of data and model providers  that most enterprises cannot see. A questionnaire answered in January says nothing about a model retrained in March. Boards, regulators, and customers are asking a question traditional TPRM was never designed to answer: how do you govern a supplier whose risk profile changes every time its model does?

The EU AI Act, ISO 42001, DORA, NIS2, GDPR, and India’s DPDP Act are converging on the same expectation — continuous, evidenced, explainable oversight of AI-enabled suppliers, not point-in-time assurance. Organizations that keep TPRM as an annual, spreadsheet-driven exercise will fail audits, miss emerging risk, and lose ground to competitors who have moved to continuous, AI-native assurance. Following is our view on why AI-driven TPRM is becoming the new baseline, what an AI-powered operating model looks like in practice, and how enterprises can move from static compliance to continuous assurance within a single quarter.

Key Market Challenges

Why traditional TPRM is breaking down

• Annual and questionnaire-driven assessments cannot keep pace with monthly or continuous model retraining
• Spreadsheet-based tracking and fragmented evidence create audit gaps regulators are now actively testing for.
• Point-in-time reviews miss the interval risk — the months between assessments where an AI supplier’s model, data sourcing, or sub-processors can change materially.
• Fourth-party and AI supply-chain visibility (model providers, data providers, sub-processors) are largely absent from current programs, even though AI risk concentrates upstream.

What is compounding the pressure

• Rapid, uncontrolled expansion of GenAI features inside existing SaaS vendors, often without formal notice to the customer.
• Growing enterprise dependency on a small number of foundation model providers, concentrating systemic risk.
• A widening regulatory perimeter — EU AI Act, ISO 42001, DORA, NIS2, GDPR, and DPDP Act — each adding distinct evidentiary and oversight obligations.
• AI-specific risks that legacy TPRM frameworks were not built to assess model opacity, algorithmic bias, model drift, explainability gaps, and data residency and sovereignty exposure

AI-Powered TPRM Vision

The future of TPRM is not a faster version of the same annual process — it is a shift from periodic assurance to continuous, evidenced, explainable oversight, delivered by an AI-native risk intelligence layer that sits across the full supplier lifecycle-extending to the model providers, data providers, and sub processors each supplier and not just the direct supplier alone.

The five pillars of AI-powered TPRM

1. AI-Powered Due Diligence — automated document ingestion, questionnaire generation and validation, and policy/evidence extraction mapped directly to regulatory clauses, extended through an AI bill of materials (AI-BOM) that captures the model providers, data providers, and sub-processors sitting behind each supplier
2. AI-Powered Risk Intelligence — continuous external signal monitoring across cyber posture, financial health, ESG, and adverse media-spanning the direct supplier and the model and data providers as well
3. AI-Powered Risk Assessment — dynamic risk scoring, tiering, and inherent/residual risk calculation that updates as new evidence arrives, not once a year, reflecting changes at the supplier’s model and data provider layer
4. AI-Powered Monitoring — always-on supplier surveillance, control-effectiveness tracking, and early-warning alerting, including alerts when a supplier’s underlying model, data source or sub processor changes
5. AI-Powered Governance — automated regulatory mapping, exception management, and audit-ready evidence traceability across the full AI supply chain (direct supplier, model provider, data provider, sub-processor) with explicit human-in-the-loop approval at every material decision point.

An agentic layer sits across these five pillars — autonomous agents handle first-pass document review, evidence extraction, and gap flagging, while named human roles retain approval authority over risk classification, remediation, and offboarding decisions. Every AI-generated score remains explainable back to the underlying evidence, which is the condition regulators and internal audit will increasingly demand.

Exhibit: Illustrative AI-powered third-party risk assessment architecture — signal ingestion, dual AI engines, and overall risk-score computation feeding continuous insight.

Future-State Operating Model

The capabilities below apply across the full AI supply chain, not just the direct supplier.  Due diligence, monitoring, and risk scoring extend to the model providers, data providers, and sub-processors that are behind each supplier.

Strategic Call to Action

Enterprises do not need a multi-year transformation to start. The recommended path is a 90-day proof of value: select one high-risk supplier tier, one binding regulation (e.g., DORA for a financial-services client, or the EU AI Act for a supplier embedding GenAI features), and stand-up continuous monitoring plus AI-assisted due-diligence for that scope alone. Success is measured across three dimensions — reduction in onboarding cycle time, reduction in manual review hours, and improvement in time-to-detect emerging supplier risk before scaling the model enterprise-wide.

• Leadership to reframe TPRM as a continuous assurance capability, not an annual compliance task.
• A named 90-day pilot scope, with quantified before/after metrics agreed up front.
• A regulation-to-control crosswalk built early, so the pilot demonstrably closes a named compliance gap, not a generic efficiency one.
• Explicit human-in-the-loop design from day one, so the program is audit-ready rather than retrofitted for explainability later.
• An AI-BOM for the pilot’s supplier tier, mapping the model providers, data providers, and sub-processors it depends on, so that fourth-party risk is in scope from day one.

Why AI-Driven TPRM Will Become the New Standard for Governing Suppliers in the Age of AI

Every enterprise risk function is running the same experiment. A questionnaire cannot ask a model how it changed since last quarter. A spreadsheet cannot flag that a vendor’s sub-processor swapped foundation models overnight. And an annual review cannot satisfy a regulator who now expects continuous, evidenced oversight — that is precisely what the EU AI Act, ISO 42001, DORA, and NIS2 are converging on.

The organizations pulling ahead are not the ones with the biggest GRC platforms. They are the ones treating supplier oversight as a live intelligence problem: continuous monitoring in place of periodic review, dynamic risk scores in place of static ratings, and AI agents doing first-pass evidence work so human risk professionals spend their time on judgment, not document chasing. Crucially, leaders are pairing this with disciplined human-in-the-loop governance — the AI recommends, a named accountable owner decides, and every score traces back to its evidence. That pairing is what will separate defensible AI-driven TPRM programs from ones that collapse under their first serious audit.

Fourth-party visibility is the next frontier, and most programs are not there yet. Enterprise risk today stops at the direct supplier; it needs to extend to the model providers, data providers, and sub-processors sitting behind them — an AI bill of materials, not just a vendor list. Regulators are already moving in this direction through the EU AI Act’s provisions for general-purpose AI providers and DORA’s sub-outsourcing requirements

Infosys’ advice to clients is that one should not wait for a mandate to modernize TPRM — the cost of a missed AI-driven supplier failure, whether a data breach, a biased decision embedded in a hiring tool, or a model outage cascading through a critical process, will always exceed the cost of building continuous assurance now. Start narrow, prove the model on one supplier tier and one regulation in ninety days, and let the evidence earn the mandate to scale.

Bottom Line

• Traditional, annual TPRM cannot keep pace with continuously evolving AI suppliers and a converging global regulatory perimeter.
• AI-driven, continuous-assurance TPRM — with explicit human-in-the-loop governance — is moving from advantage to baseline expectation.
• The lowest-risk starting point is a 90-day, single-tier, single-regulation proof of value with quantified before/after metrics.