Quantifying the Procurement Risk Left Open by Spreadsheet AI Vendor Reviews

Spreadsheet AI vendor reviews leave three measurable kinds of procurement risk open, namely temporal gaps, scope blind spots, and AI-specific attack surfaces. An AI vendor risk assessment mapped to AI security and risk management frameworks needs both a completed questionnaire and up-to-date evidence about the system itself. Organizations can identify and bound these gaps before they become compliance or continuity failures, but closing them requires continuous visibility into vendors and their dependencies.

Why AI vendor risk does not behave like classical third-party risk

The vendor controls behavior the deployer is accountable for. That is the central difference from classical third-party risk management, which asks whether a supplier is secure, reliable, and solvent. AI procurement adds a distinct question about whether the system operates within legally permissible boundaries and whether the deployer can prove effective oversight. The EU AI Act formalizes that split through Article 26, which establishes obligations for deployers of high-risk AI systems. Those duties cannot simply be outsourced to the provider.

The underlying behavior can also change after approval. An AI vendor can change model weights, system prompts, safety filters, and training data without a versioned release or notice to the customer. Non-deterministic behavior further weakens the assumption that an output validated in testing represents what customers will encounter months later. The procurement decision therefore concerns a changing system supplied by an established supplier.

This problem extends beyond foundation model providers. AI-native SaaS, embedded AI in existing enterprise software, and data labelling partners put different parts of the same accountability chain at risk. Model opacity can limit what a deployer understands, while training data provenance raises questions about how the system was built. Performance drift and bias amplification bring risks that arise as the system is used. A conventional supplier assessment can be sound on its own terms and still leave these questions unanswered.

How the spreadsheet review process works and what it structurally records

The standard review begins with a security questionnaire emailed to the vendor. Responses enter a spreadsheet, a SOC 2 report and ISO 27001 certificate join the file, and the assessment closes. This produces a legible record of questions, answers, and supporting documents. Its explainability is a genuine strength. Executives and auditors can inspect the stated basis for approval.

But what does that record actually establish? A questionnaire captures what the vendor said at a particular time, while assurance reports address only the systems and controls within their scope. External monitoring adds a view of part of the public technology footprint. None of these sources, taken alone, reveals every AI tool the vendor later adopts. Completion records the assessment, leaving the continuing validity of its conclusions to be established.

The work also consumes time before that record exists. Teams spend hours chasing responses, transferring findings, and assembling reports from disconnected sources. During that interval, the vendor’s technology or subprocessors may change. Procurement records, security assessments, privacy reviews, and contract files are often separate, making a complete reconstruction difficult when something goes wrong. The limitation is therefore not careless spreadsheet use but the boundary of what the process records.

The first gap category: temporal drift between assessment and reality

An annual or biannual review leaves an interval during which behavior, subprocessors, and data-handling terms can change without a governance response. Continuous learning, federated training, or periodic fine-tuning can change how a model behaves without a versioned release. Data shift on its own can cause statistically significant behavioral drift by mid-year. The approval remains on file throughout that interval. Its underlying evidence may no longer describe the system in use.

LiteLLM’s official security update states that an attacker bypassed official CI/CD workflows and uploaded malicious packages directly to PyPI. A prior assessment of a vendor cannot establish the safety of dependency packages published afterward. Where a supplier depends on LiteLLM, a clean primary-vendor file does not close that downstream exposure. The organization needs to establish what changed after assessment and when it became aware of it.

A software vendor can add an AI model through an update while its contract and supplier record appear unchanged. There is no standard SLA framework for notifying customers of behavioral changes, so agreements need a definition of “material AI change” tied to notification requirements. M&A can widen the gap through changed contractual terms at renewal. When customers have both notification and termination-for-convenience rights, they have a chance to negotiate that notice on its own does not give them.

The second gap category: scope blind spots in what the review actually covers

Even a perfectly timed review can ask the wrong questions. These concern the system’s role, obligations, and evidence of oversight.

Without an explicit contractual opt-out, prompts and documents submitted to a vendor are potentially training data for future model versions. Marketing copy does not settle that question. The clause needs to name the covered data categories and be verifiable. Otherwise, an organization may approve a workflow without establishing whether the supplier can reuse the information that makes the workflow sensitive.

ISO 42001 establishes that the vendor has an AI management system meeting the standard, while the particular system’s required risk classification, Article 12 logging implementation, and deployer contract terms remain to be established. Substantive diligence spans nine areas, including training data provenance, model transparency, security, privacy, certifications, incident response, model change management, subprocessors, and exit planning. The scope extends through the end of use. A written deprecation policy with notice periods and migration support addresses the possibility that a paid-for capability disappears while the contract and billing continue.

The third gap category: AI-specific attack surfaces that standard security reviews do not assess

CVE-2025-32711, with a CVSS score of 9.3, demonstrated a zero-click prompt injection vulnerability in Microsoft 365 Copilot. Malicious prompts embedded in emails allowed attackers to silently exfiltrate data from SharePoint, OneDrive, and Teams without user interaction. The exploit targeted how the assistant interpreted input. A conventional security questionnaire that never asks about prompt injection does not assess that failure mode, regardless of how thoroughly its other fields are completed.

The same holds for training data poisoning, sensitive information disclosure, and AI supply-chain compromise. Procurement guidance calls for the vendor’s threat model document to cover adversarial inputs, prompt injection, model extraction, and data poisoning. A verbal assurance is not an equivalent substitute. Mapping does not itself demonstrate that a threat has been assessed.

Xsolis shows how accountability can reach across vendors. A phishing attack on the AI-powered utilization management provider exposed records of over a million patients across eight or more major hospital systems, including Mayo Clinic. Rochester Regional Health had ended its relationship with Xsolis in 2021, yet its patient data remained in scope. It showed why AI-specific diligence must go hand in hand with the usual checks on security and data-retention.

Dependencies also connect security exposure to service continuity. A handful of foundation model providers sit beneath thousands of AI features, allowing outages, policy changes, pricing changes, and geographic restrictions to propagate into products and customer journeys.

How shadow AI procurement multiplies all three gap categories simultaneously

The spreadsheet process assumes that a vendor is reviewed before its technology goes into production. Shadow AI breaks that assumption even when nothing new is bought. An existing software supplier can add an assistant, a service provider can summarize support tickets with a large language model, or an adviser can use AI to review documents. Each can introduce a new data flow. Each can happen without procurement, a contract change, or a conventional vendor assessment.

These uses inherit all three gaps without an assessment baseline. These uses may have no recorded starting point for tracking behavioral drift, no agreement on what to check about training rights or logging, and no AI-specific threat model. Risk teams cannot revisit an approval for an AI use they do not know exists. If teams close gaps only for AI tools they buy as such, embedded and outsourced uses stay outside the process.

Procurement itself can contribute to that hidden population. Sensitive supplier pricing, contract terms, and negotiation data can enter AI tools without enforced rules about permissible sharing. In regulated workflows, supplier involvement does not remove accountability for the outcome. Mortgage servicers, for example, cannot shift responsibility to an AI vendor when a tool gets an account decision wrong. A sensitivity-based review framework loses its protective function when adoption bypasses the review altogether.

How can organizations assess and size AI supplier risk before a gap becomes a failure?

The practical response begins by separating missing evidence from demonstrated failure. A questionnaire gap analysis can show which areas have no coverage, including training data provenance, model transparency, AI-specific security, human oversight, change cadence, Article 73 incident notification, subprocessor visibility, operational resilience, and deprecation policy. This makes incompleteness visible before an incident occurs. It does not turn missing answers into a defensible probability of failure. The initial measure is the extent of unsupported exposure.

Temporal exposure can be bounded by comparing the last assessment with known changes and the contract’s notification requirements. Scope exposure can be examined against data sensitivity and workflow impact. Customer or employee data, restrictions on third-party processing, unclear retention, poorly disclosed subprocessors, and missing logging or admin controls are reasons to escalate diligence. Externally facing or high-impact workflows warrant closer scrutiny too. These criteria distinguish an unanswered question in a low-risk use from the same question in a consequential one.

Before signing, procurement teams can check training opt-out terms for each data category and require the vendor to provide its threat model in writing. To address fourth-party exposure, monitoring needs to extend from the contracted supplier to model providers and subprocessors. Approval need not be binary. A pilot with restrictions or approval only for low-risk use can be more defensible than unrestricted approval while evidence remains incomplete.

These actions also need usable evidence and staff capacity. Monitoring that creates unexplained scores or an unmanageable workload does not resolve either constraint. The bounded objective is to identify where evidence is absent, which uses are exposed, and what restrictions or further diligence are justified before compliance or continuity fails.

Why continuous monitoring, not a better spreadsheet, is the structural answer

A more thorough questionnaire can improve coverage at assessment time. Observing subsequent behavioral changes or automatically exposing an unrecorded model dependency requires more than a more thorough questionnaire. Better questions do not change the cadence or visibility of a point-in-time process.

The operational objection remains substantial because the existing process already consumes hours of coordination and manual reporting. Adding behavioral monitoring without changing that workflow can increase the burden. A longer spreadsheet does so without closing the temporal gap. The credible alternative combines evidence collection with continuous monitoring so that teams can evaluate changes in the context of the original procurement decision. Its purpose is current visibility into important suppliers, AI uses, and whether their risks remain controlled.

That alternative must also be explainable. An opaque scoring engine that cannot cite its evidence leaves the organization unable to substantiate its oversight. Framework coverage alone does not establish those capabilities. The monitoring supplier must face the same scrutiny of training rights, dependencies, and supporting evidence as any other AI vendor.

The architectural gaps require a response built on continuous, dedicated AI risk intelligence.