AI Third-Party Vendor：合同与退出架构
一句话:
AI Third-Party Vendor Contract / Exit Architecture 解读
面向对象: AI Platform PM / Vendor Risk Lead / Enterprise Architect / Procurement Product Lead / Senior BA。 核心问题: AI vendor risk 不是采购打分表。模型供应商、RAG 平台、agent 工具、数据处理商和评测工具都会影响数据、模型行为、可观测性、审计、事故响应、成本和退出能力。合同条款必须被架构化。 学习目标: 将第三方风险管理、合同控制、架构抽象、证据交换、变更通知和 exit strategy 连接成 AI vendor architecture capability。
Source Anchors
| Source | Link | 用途 |
|---|---|---|
| Interagency Guidance on Third-Party Relationships | https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html | 参考银行第三方关系风险管理生命周期 |
| Federal Reserve Third-Party Risk Management | https://www.federalreserve.gov/supervisionreg/topics/third-party-risk-management.htm | 参考银行监管中的第三方风险管理主题 |
| NIST AI RMF | https://www.nist.gov/itl/ai-risk-management-framework | 将供应商风险映射到 AI govern/map/measure/manage |
| ISO/IEC 42001 | https://www.iso.org/standard/81230.html | 将供应商和外部提供方纳入 AI management system |
| NIST Cybersecurity Framework | https://www.nist.gov/cyberframework | 参考第三方安全、监控和事件响应 |
一句话:
AI vendor architecture 是用 contract、control、interface、telemetry、evidence 和 exit plan 管理供应商能力, 而不是把供应商当黑盒。
1. AI Vendor Risk Is Architectural
AI vendor risk 影响:
| Area | Risk |
|---|---|
| Data | training use, retention, cross-border transfer, prompt logging |
| Model | behavior change, deprecation, benchmark mismatch |
| Security | prompt/tool attack surface, access control |
| Observability | missing trace, no raw logs, weak incident data |
| Compliance | no audit rights, no evidence handoff |
| Cost | token/GPU pricing volatility, hidden usage |
| Availability | region outage, model route failure |
| Exit | no portable prompts/evals/embeddings/logs |
如果 vendor decision 没有 architecture abstraction, 未来退出会非常昂贵。
2. Contract Clauses That Matter for AI
| Clause | Architecture implication |
|---|---|
| Data use | no training / retention limits / processing purpose |
| Logging | what is logged, retained, accessible |
| Audit rights | evidence and independent assessment |
| Model change notice | revalidation trigger |
| Security incident notice | incident runbook integration |
| Subprocessor disclosure | supply chain visibility |
| Evaluation access | ability to run regression and red-team |
| SLA/SLO | latency, availability, support response |
| Explainability/documentation | model/system cards, limitations |
| IP/output ownership | product and legal boundary |
| Termination assistance | migration support |
| Data deletion/return | verifiable deletion evidence |
| Price change | FinOps and budget guardrail |
3. Vendor Abstraction Patterns
| Pattern | Use |
|---|---|
| Model gateway | route, fallback, logging, policy, cost |
| Prompt registry | avoid vendor-specific prompt sprawl |
| Eval harness | compare vendors and catch regressions |
| Tool gateway | avoid direct vendor-agent action |
| Data boundary proxy | redact, classify, route |
| Evidence adapter | normalize logs, trace, usage, incidents |
| Contract metadata registry | track clauses, dates, obligations |
目标不是把所有供应商完全替换, 而是保留 architecture optionality。
4. Exit Architecture
Exit plan should exist before scale.
| Exit object | Need |
|---|---|
| Prompts | exportable versions and tests |
| Eval sets | vendor-independent regression |
| Embeddings | migration plan or dual-index strategy |
| Fine-tunes/adapters | ownership and portability |
| Logs/traces | evidence retention |
| Knowledge indexes | rebuildable ingestion pipeline |
| Tool contracts | not vendor-native only |
| User data | return/delete certification |
| Cost model | replacement cost estimate |
Exit trigger examples:
- material price increase。
- model deprecation。
- policy change on data usage。
- repeated SLO failure。
- regulatory concern。
- concentration risk threshold breached。
- better internal/platform capability available。
5. Financial Retail Case: LLM Provider for Customer Service RAG
| Concern | Contract/control |
|---|---|
| customer data | no training, retention limit, region restriction |
| model updates | advance notice and regression window |
| trace evidence | request metadata, route, model version, latency, cost |
| incident | notification SLA and cooperation |
| eval | right to run red-team and benchmark |
| audit | documentation and evidence access |
| exit | prompt/eval/export, deletion certificate |
Architecture:
Customer service app
-> model gateway
-> data boundary proxy
-> vendor model
-> observability/evidence adapter
No product team calls the vendor directly.
6. Templates
Vendor Architecture Review
| Question | Evidence |
|---|---|
| What data is sent | data flow diagram |
| Is data used for training | contract clause |
| How are model changes handled | notice clause + revalidation |
| Can we run evals | eval access |
| Can we audit | audit rights |
| How do we exit | exit plan |
| What is abstracted | gateway/adapter design |
Contract-Control Matrix
| Contract clause | Control | Evidence | Owner |
|---|---|---|---|
| no training | data usage attestation | vendor report | procurement/risk |
| change notice | model update review | change log | platform |
| deletion | deletion certificate | evidence binder | privacy |
| incident notice | incident runbook | incident record | security |
7. Common Failure Modes
| Failure mode | Fix |
|---|---|
| Vendor direct integration | model/tool gateway |
| Contract not linked to controls | contract-control matrix |
| No model change notice | clause + revalidation trigger |
| No exit plan | exit architecture before scale |
| No evidence access | audit/logging clause |
| Cost surprise | FinOps clause and usage telemetry |
8. 面试表达
30 秒版本:
AI vendor risk 不是采购评分, 是架构问题。我会通过 model gateway、prompt/eval registry、data boundary proxy、telemetry adapter 和 contract-control matrix 管理供应商。合同必须覆盖数据使用、日志、审计、模型变更、incident、eval access、SLO、退出和删除证明。
2 分钟版本:
以 customer service RAG 选 LLM provider 为例, 我不会让应用直接调用供应商。所有请求走 model gateway 和 data boundary proxy, 记录 model version、prompt version、latency、cost 和 policy decision。合同要求不训练客户数据、变更提前通知、允许红队和回归评测、提供 incident 协作和审计证据。退出计划包括 prompt/eval export、index rebuild、logs retention、data deletion certificate 和 replacement cost estimate。