Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.

Categorize different types of GAI content with associated third-party rights (e.g., copyright, intellectual property, data privacy).

Conduct joint educational activities and events in collaboration with third parties to promote best practices for managing GAI risks.

Develop and validate approaches for measuring the success of content provenance management efforts with third parties (e.g., incidents detected and response times).

Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.

Implement a use-cased based supplier risk assessment framework to evaluate and monitor third-party entities’ performance and adherence to content provenance standards and technologies to detect anomalies and unauthorized changes; services acquisition and value chain risk management; and legal compliance.

Include clauses in contracts which allow an organization to evaluate third-party GAI processes and standards.

Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.

Maintain records of changes to content made by third parties to promote content provenance, including sources, timestamps, metadata.

Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy, security, and other risks. For example, update processes to: Address solutions that may rely on embedded GAI technologies; Address ongoing monitoring, assessments, and alerting, dynamic risk assessments, and real-time reporting tools for monitoring third-party GAI risks; Consider policy adjustments across GAI modeling libraries, tools and APIs, fine-tuned models, and embedded tools; Assess GAI vendors, open-source or proprietary GAI tools, or GAI service providers against incident or vulnerability databases.

Update GAI acceptable use policies to address proprietary and open-source GAI technologies and data, and contractors, consultants, and other third-party personnel.