Which of the following is MOST important when defining responsible roles for integrating third-party AI services into an organization's supply chain?

Third-party AI service integration introduces distributed accountability challenges. When external

services are incorporated into organizational supply chains, clearly designated ownership of AI

governance and risk is essential to ensure responsibilities do not fall into gaps between internal and

external parties.

Why A is Correct: According to ISACA AAIR third-party risk principles, designating AI governance and

risk ownership is the foundational requirement for supply chain integration. Without clear internal

ownership, third-party AI risks cannot be effectively monitored, escalated, or managed. The

designated owner ensures vendor performance is assessed against risk criteria, contractual

obligations are enforced, and emerging risks are addressed.

Why B is Wrong: Standardizing data transfer protocols is a technical integration concern. While

important for security and operations, it does not address who is responsible for managing the

ongoing governance and risk of the integrated service.

Why C is Wrong: Training third-party staff on internal AI policies is a vendor management activity

that may be contractually required but does not substitute for internal governance ownership. Third-

party training does not remove the organization's responsibility for oversight.

Why D is Wrong: Security policy alignment is important for consistent security posture but represents

one dimension of third-party risk management. Governance and risk ownership encompasses

security policy alignment as well as broader risk management responsibilities.