The priority control in AI vendor due diligence is ensuring explicit disclosure of data handling: data flows, purpose limitation, retention/deletion, training vs. inference use, isolation controls, access paths, subcontractors, and storage/transfer boundaries. This disclosure is then tied to contractual commitments and measurable controls. A public policy (Option A) may be incomplete; a pre-procurement external audit (Option C) can be valuable but is not always feasible or targeted to your data use; legal discussions (Option D) are necessary for terms but must be grounded in clear, detailed data-use disclosures to be effective.
References:
AAISM Body of Knowledge: Third-Party AI Risk Management; Data Governance and Usage Controls; Contractual and Technical Safeguards for Vendor AI.
AAISM Study Guide: AI Procurement Due Diligence; Data-Use Transparency (Training vs. Fine-tuning vs.
Inference); Retention, Purpose Limitation, and Cross-Border Controls.

AAISM stresses that AI systems and their supporting infrastructure must be explicitly included in disaster recovery and continuity planning, since disruptions to models, feature stores, or pipelines can halt critical business functions.
Explainability (A) and retraining (B) are operational improvements, not continuity mechanisms. Multi-zone redundancy (D) improves availability but does not represent complete BCP integration.
References: AAISM Study Guide - AI Business Continuity and Resilience Requirements.

AAISM prescribes building and maintaining an AI Threat-Control Matrix to ensure consistent, repeatable risk treatment. The matrix traces each material threat (e.g., prompt injection, poisoning, exfiltration) to named controls, test/evidence procedures, and assurance owners across the lifecycle. Baselines and vendor attestations can support assurance but are insufficient alone; deferring control selection until after deployment conflicts with AAISM's proactive treatment principle.
References: AI Security Management (AAISM) Body of Knowledge - AI Risk Treatment Planning; Threat-Control Traceability; Assurance & Evidence Management for AI Systems.

When an AI system experiences an attack after being in production for an extended period, the most effective mitigation strategy is to update the deployed training data with new adversarial data. This process strengthens the model's resilience by retraining it to recognize and resist attack vectors that were previously unknown or unaccounted for. According to the AI Security ManagementTM (AAISM) framework, risk mitigation for AI systems must address model robustness through adversarial retraining, data quality improvement, and model lifecycle hardening rather than relying solely on reactive measures.

Identifying influential training instances helps reveal which data points most affect the model's decisions, providing direct insight into how outputs are generated and improving explainability.