Definition
A regulatory requirement that companies using AI models built by outside vendors — not just AI they build themselves — must still vet, document, and monitor those vendors' systems for bias, safety, and risk. Insurance regulators are building formal review programs and questionnaires specifically for this, since most companies buy AI capability rather than build it from scratch.
Why it matters
Most organizations' AI risk actually sits with the vendors and models they buy, not the ones they build, so 'we didn't build it' is no longer a legally viable excuse for governance regulators are formalizing.