Third-Party component risk

Explanation

Third-Party component risk checks how much of an AI system is built from external, non-in-house components — models, libraries, datasets, APIs — because each third-party part expands the attack surface and the supply-chain risk a bank inherits but does not directly control; the more of a credit-scoring or document-extraction stack that comes from outside vendors, the more diligence, monitoring, and contingency planning it demands. It is measured by the Percentage of Third-Party Components, the share of the system's total components that originate from third parties. No explicit formula is provided, so compute it from a maintained component inventory or SBOM as third-party components divided by total components, and log each component's origin and classification so the percentage is reproducible and auditable. Operate it as a continuous inventory check in the build/deployment pipeline that recalculates the ratio whenever dependencies change. The threshold is set per control objective with an alert on breach, meaning the institution defines a risk-based target appropriate to the system's criticality; when the third-party percentage exceeds that target the control fires, prompting risk review, vendor due-diligence, and mitigation — fitting its Immediate priority.