Your AI Vendor Is Your Subrecipient

In grants, when we passed funds to a partner organization — a subrecipient — one rule never changed: we were still responsible. Their mistakes were our findings. So we monitored them. We reviewed their reports, checked their systems, and made sure they understood the rules before the money moved.

Your AI vendors are your subrecipients.

When a vendor's model makes a biased decision, leaks your data, or goes down at the worst moment, your customers won't call the vendor. They'll call you. Regulators, too. Outsourcing the work never outsourced the responsibility — in grants or in AI.

So do what grants taught: monitor your subrecipients. Ask vendors how their models are tested and how often. Ask what happens to your data. Ask who to call when something breaks. Get the answers in writing, and check in on them more than once.

You can delegate the task. You can't delegate the accountability.

I explain frameworks; I don't give legal counsel.