MAY NOT BE REPRODUCED WITHOUT PERMISSION
Even if you have the proper security in place in your organization, the suppliers you work with — and their vendors — may not. If the proper security controls are not in place throughout your supply chain, you risk data leakage, exposure of sensitive information, misuse, fraud, and other malicious activity.
Third-party, fourth-party, and fifth-party risks are all too real, especially with modern applications that integrate AI. This article will focus on the risks of data sharing with AI integrations and proven strategies for mitigating these risks.
Understanding Third-, Fourth-, and Fifth-Party Risks
What are third-, fourth-, and fifth-party risks with AI? Let’s define each of them.
- Third-party risks: These are risks associated with direct vendors or partners that organizations rely on for AI services or data sharing. For example, an AI service provider processing sensitive data could inadvertently expose it.
- Fourth-party risks: These arise from subcontractors or vendors of third parties. For instance, a third-party AI provider might depend on cloud storage services, creating another layer of risk.
- Fifth-party risks: The extended chain risks from fourth-party relationships. These could involve data being shared further downstream without the organization’s knowledge or consent.
Such supply chain risks are well documented in the network realm. Verizon’s 2024 Data Breach Investigation Report shows that 15% of data breaches are attributed to downstream suppliers. Recent incidents included:
- Microsoft email systems were compromised, allowing Russian state-sponsored actors to download about 60,000 government emails.
- A breach at Infosys exposed as many as six million records, including Bank of America customers.
- A flaw in the MOVEit Transfer file allowed unauthorized access to a variety of organizations including the BBC.
As companies rely more on AI applications and share data, there are additional risks. Breaches to AI tools can expose sensitive information. Reliance on poor-quality training data and a lack of model transparency can also increase risk.
Increasing Risks to AI Systems
The Open Web Application Security Project (OWASP) Top 10 for LLM Applications 2025 security highlights an increasing number of risks to AI systems, including:
- Prompt Injection
- Data Leakage
- Inadequate Sandboxing
- Training Data Poisoning
- Model Theft
- Over-reliance on LLM Outputs
- Insufficient Access Controls
- AI-Driven Social Engineering
- Model Denial of Service (DoS)
- Regulatory Non-Compliance
Attackers are utilizing these strategies and more to penetrate defenses with internal AI systems and downstream supply chains.
AI Data Sharing Challenges and Risks in AI Integrations
In most cases, users have limited insight into downstream parties’ data practices. Once data is shared, you lose control over how it is used, stored, or shared with others. Even with guardrails in place and formal agreements, a breach of an AI system can expose your data.
Another significant challenge when it comes to AI is data sovereignty and jurisdictional conflicts. Different countries have varying data protection laws, which complicates compliance in cross-border organizations or use.
Real-World Examples
Threat actors have been using AI tools to target companies for some time now, but hackers are now turning their attention to the AI tools themselves. Just as infiltrating the network of a managed service provider can enable access to hundreds of companies downstream, attacks on AI engines can expose vast amounts of training data and sensitive information shared with AI platforms.
A 2024 survey showed that an astonishing 77% of businesses have reported a breach due to AI in the last year. Here are two examples:
- Open AI, the folks behind ChatGPT, saw their own networks breached, revealing information from an internal forum on product developments.
- Samsung engineers used Generative AI tools to work on source code, which was subsequently released into the wild.
Data leakage is a significant concern with AI and it goes well beyond your security boundaries. You may not know how third-, fourth-, or fifth-parties are using AI tools with your data. The Dutch Data Protection Authority (DPA) recently put out an alert, cautioning companies about data breaches from AI use, most notably in the field of healthcare.
AI Risk Mitigation Strategies
A key to mitigating risk is due diligence. A thorough assessment of potential AI partners and their data security measures is necessary. In addition, apply these strategies to your data supply chain risks:
Strategies to Mitigate Third-party Risks in AI Integration
Before adopting AI tools, review contractual obligations and establish clear terms for data protection in AI integrations, compliance, and breach notifications. Training employees on proper usage will be critical as well to avoid inadvertent sharing of sensitive or confidential data.
Strategies for Mitigating Fourth-party Data Risks and Fifth-party Data Risks
While more challenging, mapping data supply chains to identify all involved parties that could potentially handle shared data can help mitigate risks. Require any extended parties to adhere to security standards and certifications such as ISO 27001 for managing and protecting data security to enhance fourth-party or fifth-party risk management.
AI-specific Considerations
Ensuring transparency in AI models and data handling practices requires more than a cursory review. Organizations need to understand how data is stored and processed as well as how decisions are made. AI explainability (XAI) can provide confidence in AI tools and ensure regulatory compliance.
AI across your entire supply chain should use encryption and anonymization, and limit access to sensitive data.
Best Practices for Managing AI Integration Risks
A robust AI governance framework is essential for managing the complexities of AI integration. This framework should establish clear policies and procedures for AI usage, focusing on:
- Ethical standards
- Regulatory compliance
- Risk management
Assigning specific roles for oversight ensures accountability, while periodic reviews help adapt to emerging risks and advancements in AI technology.
AI third-party governance frameworks should also include protocols for data lifecycle management — from acquisition to deletion — to maintain security and compliance.
Developing Data-Sharing Agreements
Data-sharing agreements are key for mitigating third-, fourth-, and fifth-party risks. These agreements should outline the responsibilities of all parties in handling data securely and transparently. Key elements include:
- Extending accountability to all downstream entities by requiring them to adhere to the same security standards as primary vendors
- Specifying how data should be managed, retained, and deleted after its intended use.
- Ensuring agreements include timely breach notification requirements to enable swift mitigation
- Exempting sensitive information from being used in training data
Monitoring of AI Applications and Their Partners
Risk management does not end once a contract is executed. Continuous monitoring of AI systems and associated networks should be ongoing to detect vulnerabilities and maintain compliance. Strategies include:
- Employing tools to monitor performance, audit access logs, and verify adherence to data-sharing agreements
- Conducting regular penetration testing and risk assessments helps ensure that AI systems remain resilient to evolving threats
- Deploying real-time anomaly detection system to alert organizations to unauthorized data access or unusual behaviors in AI integrations
Tools and Frameworks for Risk Management
Tools like risk assessment software and vulnerability scanners can provide insights into potential weaknesses in AI systems and data-sharing practices. For example, ZenData’s privacy mapper helps you discover, classify, and defend sensitive and personally identifiable information (PII) across your organization.
Specialized AI risk platforms can evaluate third-party vendors and analyze how data is shared across the supply chain. These tools may also facilitate scenario analysis, allowing you to assess the potential impact of breaches or compliance failures.
Monitoring and Auditing Third-Party and Downstream Partners
There are also specialized tools for monitoring the security posture of downstream partners. These platforms can identify anomalies, such as unauthorized data access or outdated security practices, ensuring that your supply chain partners comply with industry standards and contractual obligations.
Auditing tools also help verify compliance.
Risk Frameworks for AI Compliance
Ensuring downstream AI conforms with industry-standard frameworks for risk management can also help secure data. For example:
- NIST Cybersecurity Framework: Provides a flexible, high-level approach to managing cybersecurity risks, including those associated with AI. Its five core functions—Identify, Protect, Detect, Respond, and Recover—can be applied to AI-specific scenarios.
- ISO 27701: A privacy-focused extension to ISO 27001, which outlines best practices for managing personal data within information security systems. It is especially relevant for organizations using AI in data-intensive applications.
- SOC 2: Focuses on trust service criteria like security, availability, processing integrity, confidentiality, and privacy.
It is critical for AI vendors handling sensitive data to demonstrate adherence to these principles. While suppliers should have robust security frameworks in place, managing AI vendor risks is a shared responsibility.
Case Studies of Risk Management Success
Several organizations have effectively leveraged these tools and frameworks to navigate the complexities of AI risk management.
One example is a major healthcare provider that successfully mapped all of its PII and sensitive data, making it easier to manage in a unified manner. Implementing ISO 27701 and achieving SOC-2 certification for AI-driven patient data systems significantly reduced their exposure.
Another success story involves a financial services firm that deployed continuous monitoring to detect vulnerabilities in their AI vendor’s cloud infrastructure to prevent potential breaches.
Safeguard Your Sensitive Data
Effectively managing third-, fourth-, and fifth-party risks in AI integrations is critical for safeguarding sensitive data and maintaining compliance.
By adopting proactive risk mitigation strategies, leveraging recognized frameworks, and fostering transparency in AI applications, you can confidently navigate the complexities of data sharing in AI across their supply chains.