01
AI Vendor Risk Assessment
Catalog shadow AI, verify vendor data-training and retention terms, consolidate redundant tools, and govern what remains.
Live Earth view centered on Charlotte, North Carolina, with current Sun and Moon positions.
Managing Principal · Cijara Group
Joshua M. Reh
AI Vendor Risk Assessments for growing and regulated businesses — uncovering shadow AI, testing vendor data practices, reducing software sprawl, and building governance your team can sustain.
- Tools governed
- 18k+
- Years in bank risk
- 15+
- Response SLA
- <48h
Regulatory StreamCurated
- EU AI Act2026-08-02
GPAI obligations enter force; codes of practice binding for signatories
- NIST2026-06-14
AI RMF Generative AI Profile v1.1 published
- OCC2026-05-20
Updated model risk guidance clarifies scope for agentic systems
- SEC2026-04-11
Predictive data analytics rule — final compliance date approaching
- FRB2026-03-02
SR 11-7 supplement: third-party AI vendor lineage expectations
- ISO2026-02-18
ISO/IEC 42005 AI impact assessment guidance released
- UK FCA2026-01-30
Consumer Duty guidance extended to AI-driven pricing models
- EU AI Act2026-08-02
GPAI obligations enter force; codes of practice binding for signatories
- NIST2026-06-14
AI RMF Generative AI Profile v1.1 published
- OCC2026-05-20
Updated model risk guidance clarifies scope for agentic systems
- SEC2026-04-11
Predictive data analytics rule — final compliance date approaching
- FRB2026-03-02
SR 11-7 supplement: third-party AI vendor lineage expectations
- ISO2026-02-18
ISO/IEC 42005 AI impact assessment guidance released
- UK FCA2026-01-30
Consumer Duty guidance extended to AI-driven pricing models
Framework SignalsCurated
- NIST AI RMFGOVERN 1.1
Policies for LOD independence in agentic pipelines
- ISO 42001Clause 6.1.4
AI system lifecycle risk treatment plan
- SR 11-7§V
Ongoing monitoring of model performance drift
- EU AI ActArt. 9
Risk management system across full lifecycle
- NIST AI RMFMEASURE 2.7
Adversarial robustness testing cadence
- OWASP LLMLLM06
Sensitive information disclosure controls
- MITRE ATLASTA0043
Reconnaissance TTPs for foundation models
- NIST AI RMFGOVERN 1.1
Policies for LOD independence in agentic pipelines
- ISO 42001Clause 6.1.4
AI system lifecycle risk treatment plan
- SR 11-7§V
Ongoing monitoring of model performance drift
- EU AI ActArt. 9
Risk management system across full lifecycle
- NIST AI RMFMEASURE 2.7
Adversarial robustness testing cadence
- OWASP LLMLLM06
Sensitive information disclosure controls
- MITRE ATLASTA0043
Reconnaissance TTPs for foundation models
Widget · Interactive
AI Governance & Readiness Calculator
1st/2nd/3rd LOD separation for AI systems.
01234
How much authority AI agents hold in production.
01234
Traceability of training and inference data.
01234
Completeness of the enterprise AI system register.
01234
Governance depth on vendor / foundation models.
01234
Risk Surface Map
Score 50
Developing
Material gaps. Prioritize LOD and lineage.
- Lines of Defense50
- Agentic Autonomy50
- Data Lineage Coverage50
- Model Inventory50
- Third-Party Exposure50
Vendor risk first
Catalog · Verify · Consolidate · Govern
02
AI Implementation
Put AI to work from the workflow and regulatory obligation outward, with controls designed in before rollout.
03
AI Governance & Model Risk
Build defensible inventories, risk frameworks, testing evidence, lifecycle controls, and board reporting.
04
Executive Advisory & Training
Translate technical exposure for boards and regulators, then equip executives and practitioners to operate the controls.
About
Bank-grade discipline for the AI tools your teams already use
I help leaders find the AI tools already operating across their business, understand where company and client data flows, and decide what to retain, retire, or govern.
The method is practical: catalog every tool, verify vendor terms and subprocessors, consolidate unnecessary overlap, and leave behind a review process the organization can run. It draws on 15+ years in bank risk and experience governing more than 18,000 tools at scale.
Operates in
- NIST AI RMF 1.0
- ISO/IEC 42001
- EU AI Act
- SR 11-7
- OCC Model Risk
- OWASP LLM Top 10
- MITRE ATLAS
- SEC Reg S-P
Research
Briefing seriesPublished
NIST AI RMF vs ISO 42001: a board-level guide
Compare the two dominant governance frameworks and decide which path fits your enterprise.
Research report
AI governance lifecycle: closing the accountability gap
How to govern AI across its full lifecycle — from approval to continuous monitoring — in banks and other regulated industries.
Draft · Q4 2026
Agentic autonomy: what your board needs to authorize
Subscribe to be notified when the briefing publishes.
Draft · Q4 2026
SR 11-7 in an LLM world: a practitioner's read
Subscribe to be notified when the briefing publishes.