EU AI Act Article 26: What Third-Party Risk Management Programs Miss About AI Vendors

The EU AI Act Article 26 introduces responsibilities for organisations to monitor high-risk AI tools, particularly highlighting gaps in traditional Third-Party Risk Management (TPRM) processes which fail to detect AI tools that enter organisations without vendor review, known as 'shadow AI'. Article 26's monitoring duties have been delayed to December 2027, but immediate disclosure requirements remain, creating new compliance demands on companies using AI that interacts with customers.

This Wire brief sits within Fusion42's coverage of Enterprise Software.