Reviews
How Often Should AI Vendors Be Reviewed?
Guidance on monthly, quarterly, semiannual, and annual review cadences based on risk level, data sensitivity, and vendor change velocity.
Editorially reviewed: 2026-07-10
Risk-based cadence
High-risk vendors handling PHI should be reviewed monthly or quarterly. Moderate-risk vendors semiannually. Low-risk, non-PHI vendors annually. Vendors with frequent model or terms changes warrant shorter cycles.
Trigger-based reviews
Beyond scheduled reviews, material changes (model updates, acquisitions, breaches, policy changes, subprocessor additions) should trigger an immediate reassessment regardless of cadence.
Review scope
Each recurring review should reassess security posture, privacy posture, compliance status, AI transparency, performance, incident history, and material changes since the last review.
Frequently Asked Questions
What happens if a review is overdue?
Overdue reviews escalate risk and should be prioritized in the governance action queue. Conditional approvals may be suspended until the review completes.
Can review frequency change over time?
Yes. A stable, low-incident vendor may move from quarterly to semiannual, while a vendor with incidents or changes should move to a shorter cycle.
Recommended Next Steps