What you remain accountable for when the model is somebody else’s. Regulators and customers hold the organisation using the system responsible for the outcome, regardless of who built it. Outsourcing the technology does not outsource the obligation.
Technical view
Requires an inventory of AI components including embedded features in existing software, risk classification by use rather than by vendor, contractual flow-down of obligations, ongoing monitoring rather than one-off assessment, and contingency planning for provider failure or deprecation. Concentration risk is a genuine systemic concern where many organisations depend on a small number of foundation model providers, and it is increasingly raised by financial regulators.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.