Partly. Most of the evidence work in a third-party risk assessment suits an AI agent: chasing questionnaires, reading assurance reports, checking contract clauses and screening for adverse news. It should not decide how critical the supplier is, set the final risk rating, accept residual risk or approve the relationship. Those calls stay with people.
What does a third-party assessment involve?
A firm taking on a supplier, or reviewing an existing one, needs to understand what could go wrong and whether it can live with it. That usually covers the supplier's security, resilience, financial health, data handling, subcontractors, regulatory standing and exit options, weighted by how important the service is.
Most of that is reading. Questionnaire answers, assurance reports, policies, financial statements and contracts arrive in volume, and someone has to check them against requirements. That is where an agent helps.
What may the agent do, and what stays with people?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Questionnaire | Sends, chases, checks completeness | 3 | Agreeing exceptions to required answers |
| Assurance reports | Reads reports, notes scope, period, exceptions and opinion | 1 | Judging whether exceptions matter |
| Contract review | Checks clauses against the firm's required terms | 2 | Negotiating and accepting deviations |
| Screening | Runs sanctions and adverse media checks on the supplier and owners | 1 to 2 | Deciding what a hit means |
| Financial health | Summarises published accounts and flags warning signs | 1 | Judging viability |
| Criticality | Proposes a tier with reasons | 2 | Deciding the tier |
| Risk rating | Drafts the assessment and a proposed rating | 2 | Setting the rating and accepting residual risk |
| Approval | Assembles the pack | 2 | Approving the relationship |
| Ongoing monitoring | Watches for expiring reports, news and incidents | 3 | Deciding on action |
Where do agents go wrong in this work?
Trusting supplier-supplied evidence too much. A supplier's answers are its own claims. A signed assurance report from an independent auditor is stronger. A policy document the supplier emails is weaker. The agent should record which is which, and say when a key answer rests only on the supplier's word.
Missing the scope of an assurance report. A SOC 2 report may cover one data centre but not the one your data sits in, or a period that ended a year ago. The agent should check scope and period every time, not just note that a report exists.
Treating a template as the risk. Questionnaires cover common risks. A supplier that will process your customers' payments carries risks a generic questionnaire does not ask about. The person setting criticality should add questions.
What do the rules expect?
In the EU, DORA makes ICT third-party risk part of financial entities' operational resilience duties, with expectations on assessment, contracts, registers and exit; whether agent providers fall in scope is covered in whether AI agent vendors are ICT third-party providers under DORA. In the US, banking regulators including the OCC expect banks to manage third-party relationships through their life cycle; see OCC third-party risk and AI agent vendors. The NIST AI RMF also addresses third-party AI risk, covered in NIST AI RMF third-party risk for AI agent platforms. None of these permits the decision itself to be delegated to software.
An illustrative example
Take an insurer onboarding a supplier to handle claims document scanning. The agent sends the questionnaire, chases two missing sections, and reads the supplier's assurance report. It notes the report covers the supplier's main site, but the questionnaire says overflow work goes to a subcontractor at another site not in scope. It checks the draft contract and flags that the audit rights clause is narrower than the insurer requires. Adverse media screening finds nothing on the supplier and one old news item about a former director, which it attaches.
It proposes a "high" criticality tier because the supplier will handle claimants' medical documents, and drafts the assessment. The third-party risk manager agrees the tier, asks for evidence on the subcontractor, and sends the contract point to legal. The chief operating officer approves the relationship once both are resolved.
How does this connect to wider compliance work?
Supplier reviews often surface regulatory questions, such as a new rule that changes what contracts must contain. The agent can help assess those too; see how to assess the impact of regulatory change with an AI agent. If a review reveals that a supplier has already caused a breach, it should be logged and assessed through the breach process, covered in how to log and assess regulatory breaches with an AI agent. The principle throughout is in AI compliance agents: second line, never the last word.
Where Pryme fits
The Pryme Context Protocol stamps each fact with where it came from, so an assessment shows which findings rest on an independent auditor's signed report, which on the supplier's own declaration, and which arrived from outside. That makes weak evidence visible before someone relies on it.
Questions people ask
Can the agent re-assess suppliers automatically each year?
It can run the evidence refresh on schedule and flag changes. A person should still review and confirm the rating.
Should the agent contact suppliers directly?
For routine chasing within agreed templates, yes. Anything that negotiates, accepts or waives should come from a person.
Can the agent assess the firm's own AI agent providers?
Yes, in the same way, though a person independent of the team that uses those agents should review the result.