Third-Party Risk Management: The 2027 Guide

The 2026 vendor-risk rubric was already stretched by three incidents that reshaped what "critical" means in a vendor portfolio — Change Healthcare, MOVEit, and the 2024 Snowflake customer-credential chain. The 2027 rubric adds a dimension none of those incidents forced onto the register: the vendor is now shipping AI features you did not evaluate when you signed the contract. Every SaaS in your top-20 has model calls somewhere in its stack by the time you renew, and most of them shipped that capability between the last DPA revision and this one. If the vendor register still tiers on the 2025 dimensions — financial health, security posture, business continuity — the 2027 audit finds you first.

Teams reading this already have a register. The one-week starter for vendors who have never run TPRM lives in Third-Party Risk Management for Growing Companies. Everything below assumes the register exists and now needs the AI overlay bolted on before the next annual review.

What was already true in 2026

Vendor risk is a portfolio-management problem, not a checkbox program. The three 2026 incidents established that a Tier 3 vendor can become a Tier 1 event when the vendor sits between a higher-tier vendor and your data. Change Healthcare taught the industry that concentration is a portfolio property, not a per-vendor one. MOVEit taught that subprocessor exposure is not visible in a vendor's SOC 2 letter. The Snowflake customer-credential incidents taught that some controls sit on the customer side of a vendor relationship and cannot be enforced by the vendor no matter how many attestations it produces.

Those three lessons produced three columns every high- and critical-tier row on the register needed by year-end 2026: subprocessor exposure, concentration overlap with other portfolio vendors, and customer-side control obligations the vendor cannot enforce for you. Registers still missing those columns need to add them before touching the AI overlay below, not after.

What changed in 2026 that the 2027 rubric has to absorb

Three shifts, in the order they force adjustments to the register.

1. AI shipped into every top-20 vendor without a DPA amendment

Between January 2026 and September 2026, the median SaaS in a mid-market vendor register added at least one model-backed capability — a copilot, a natural-language search, an auto-tagging feature, a generative report writer. Almost none of those releases triggered a DPA amendment. The vendor's argument was that the model calls stayed inside the existing sub-processor set. That argument is defensible for hosted-model deployments where the model sits inside the vendor's cloud tenant, but it is not defensible for foundation-model API calls that route to a new provider the customer never approved. Almost every vendor doing the latter is one incident away from a customer-side records-request that surfaces the routing choice.

Practical consequence: every high- and critical-tier row on the register needs a fourth new column — AI-usage attestation as of last contract review. Yes/no is not the answer. The answer is a named list: which vendor features use models, which models, hosted where, retention on prompts and responses, whether the customer's data is used for the provider's own model improvement. The evaluating AI in vendor products guide walks through the specific questions to ask; the register is where the answers live.

2. The concentration question moved from cloud to model provider

The 2026 concentration question was cloud-provider: how many of your top-20 vendors run on AWS versus GCP versus Azure. In 2027 the concentration question adds a layer: how many of your top-20 vendors call the same foundation-model provider (OpenAI, Anthropic, Google, Cohere, Mistral) for their AI features. A provider outage or a provider-side policy change no longer takes down one vendor. It takes down the AI features of ten vendors simultaneously. Concentration is now a capability question, not just an infrastructure one.

This shows up on the register as a Model Provider column alongside the Cloud Provider column. Same rubric — flag any provider carrying 5+ of your top-20 as a concentration event that requires a fallback story on the vendor's side or a mitigation plan on yours.

3. Vendor-side notification windows compressed against the SEC clock

SEC 8-K Item 1.05's four-business-day materiality clock is now in its third full reporting year. The downstream effect on TPRM is that customer MSAs are increasingly writing 72-hour vendor notification requirements into new contracts, because a public company customer needs to make a materiality determination inside its own four-day window and cannot do that without the vendor's forensics being roughly current. Every high- and critical-tier row on the register that predates 2025 has an MSA clause on incident notification that no longer aligns with the customer-side compliance obligation. Those clauses either get renegotiated at the next renewal or the customer's own 8-K clock is running against a vendor timeline it cannot control.

The 2027 rubric — five dimensions, not three

The 2025-era vendor scoring model had three dimensions: financial health, security posture, business continuity. The 2026 additions modified those dimensions but did not add new ones. The 2027 rubric formally adds two:

Scoring both new dimensions requires vendor cooperation and a small amount of standing infrastructure on your side. Vendors that respond cleanly to the AI-usage questionnaire in one week are running mature governance. Vendors that respond in six weeks with hedged answers are running immature governance and need to be tiered accordingly at the next annual review.

The vendor-tiering discipline that survives 2027

Four tiers stay the same — critical, high, medium, low — but with a specific negative definition on low: no data access AND no authentication into any internal system AND no sub-processor role for a higher-tier vendor AND no credential-harvesting adjacency AND no AI-generated output flowing into your systems. Any vendor that violates one of the five conditions is promoted immediately, not at the next annual review. The AI-generated-output condition is the new one for 2027 and is the condition most likely to catch a vendor previously tiered low.

• Rebuild the register columns before you rescore: Add the AI usage attestation column, the model provider column, and the AI-generated content column to the register schema first. Do not try to rescore vendors against a schema you have not finalized. This is a two-hour exercise for a security team with a spreadsheet-shaped register and a two-week exercise for a team with a tool-based one.
• Ask the seven AI-in-vendor questions: For every high- and critical-tier vendor: which features use models, which models, where hosted, what data goes in, what comes out, what retention on prompts and responses, whether customer data is used for the provider's model improvement. The specific questions and the follow-ups are covered in the AI-in-vendor evaluation guide linked above.
• Score both new dimensions before the annual review: Same 0-100 scale, same portfolio-management framing. A vendor scoring below 60 on either new dimension needs a mitigation plan attached to its file before the next contract review, not after.
• Renegotiate the notification-window clauses that predate SEC 8-K Item 1.05: Any MSA older than January 2024 has a notification window that does not fit inside your 8-K materiality determination clock. Flag those contracts for the next renewal cycle and price the renegotiation into the security budget accordingly.
• Add the sixty-minute triage runbook to every high-tier row: The vendor incident triage that used to be a security-team exercise is now an operational one because the SEC clock does not care that the security team is asleep. The runbook that names who is called, what evidence is pulled, and how the materiality question is answered inside sixty minutes lives at the vendor level on the register.

What "good" looks like on a real 2027 vendor register

A critical-tier vendor row on a well-run 2027 register carries fourteen fields, not seven. The old seven: vendor name, tier, category, security posture score, business continuity score, financial health score, contract renewal date. The seven that get added by 2027:

• Subprocessor exposure — the named third parties this vendor uses to deliver service to you.
• Concentration overlap — the other top-20 vendors that share a cloud, a sub-processor, or a model provider with this vendor.
• Customer-side control obligations — the controls this vendor cannot enforce for you (MFA hygiene, SSO configuration, API key rotation) that live on your side of the shared-responsibility line.
• AI usage attestation as of last review — the named list of the vendor's own AI features, models, hosting, and data flows.
• Model provider — the named foundation-model providers this vendor calls, if any.
• AI-generated content flowing to you — the named vendor outputs that are model-produced and land in your systems, with retention on reasoning trace.
• Notification-window alignment — whether the MSA's incident-notification clause fits inside your SEC 8-K materiality window.

Fourteen fields is not a burden. It is what a portfolio-management register looks like when the portfolio contains fifty vendors carrying regulated data, model-generated output, and shared sub-processors. Vendors that cannot populate the seven new fields at renewal are the vendors most likely to force a stay-versus-exit decision inside twelve months.

Where vCISO Lite sits in this

We built the platform for this specific shape of the problem. Vendor Risk Management ships all fourteen fields on the register out of the box, with transparent 0-100 scoring across the five dimensions, AI-driven questionnaire response grounded in your policy library, continuous vendor monitoring on a tier-tuned reassessment cadence, and category-first vendor-incident action ranking tuned to the business functions the vendor touches. Same evidence graph as the compliance product, which means an incident on a critical-tier vendor triggers the sixty-minute triage runbook, the stay-exit-mitigate decision framework, and the customer-notification workflow off a single register row. The specific rubric this article names is not aspirational for us — it is the schema the product ships with.

The vendor-risk cluster has companion pieces for adjacent moments. Incident-time discipline lives in the sixty-minute vendor incident triage and the stay-exit-mitigate decision framework. Concentration analysis is in vendor concentration risk. M&A carve-outs and bolt-ons are in third-party risk during a portfolio restructure.