The platform For third-party and AI risk teams
Third-party AI vendor risk management, on the same record as your models.
Every AI supplier from due diligence to exit plan, the models inside what you buy, every model and agent that depends on each supplier, and one incident that reaches all of them.
01 What B‑10 asks, and what the platform does
The numbers are OSFI’s own sections of Guideline B‑10. The guideline itself is explained in our third-party AI vendor risk guide, and the buying steps in our AI procurement guide.
| What B‑10 asks | What MINERVA does |
|---|---|
| Know every AI supplier, by risk and criticality (B‑10 2.2.1) | Each supplier is a sheet with its owner, risk band, the dates it was assessed and is next owed, its standing and the B‑10 fields still owed; the room lists the worst first. |
| Due diligence before contract, at renewal and after a material change (2.2.2) | Each supplier moves through stations read from the B‑10 pack: identified, diligenced, contracted, carried, monitored and exit planned. Each supplier stands at the station its recorded evidence reaches. |
| Know the AI inside the software you buy | The models inside a supplier's product are declared on the supplier's sheet, so vendor models sit in the E‑23 inventory beside your own. |
| See what depends on each supplier | Every model and AI agent that uses or depends on a supplier is shown hop by hop, with the mitigations beside it. |
| Monitor, individually and in aggregate (2.4.1) | Reassessment is owed on a cadence set by the supplier's band; overdue suppliers rise to the top of the room. |
| Manage incidents (2.4.2) | A supplier incident is declared once and reaches every dependant: an incident on each dependent agent and a proposal to isolate each dependent model in production, each decided by a person. Someone other than the declarer closes it. |
| Control the agents a vendor supplies | A vendor's passport declares the tools its agents may use; anything undeclared is refused for every agent that depends on that vendor. |
| Keep the record (2.3.1, 2.3.3) | Contracts and assessments are filed against the supplier as hashed files, and the trail exports to an examiner. |
02 Four things an AI supplier adds, and the line each needs
- The model changes under you
- Record the model version and the change-notice terms on the supplier's sheet; a change is a reason to reassess.
- Your data may train it
- Record what the contract allows the supplier to do with your data, and keep the clause on file.
- Its suppliers are your suppliers
- Declare the supplier's own model and cloud providers, so a failure upstream shows its reach.
- Its agents act for you
- Put a passport on the vendor so its agents can only use the tools it declared.
03 What it does not do
MINERVA does not rate or assess your suppliers for you, negotiate contracts or make an institution compliant. It keeps the record your team decides on. Pricing is on our OSFI E‑23 platform page: suppliers sit on the same record and subscription as the models and agents.
04 Questions people ask
What is third-party AI vendor risk management software?
Software that keeps every AI supplier an institution uses in one place: its risk and criticality, due diligence, contract, monitoring and exit plan, the AI models inside its products, and the internal models and agents that depend on it. For Canadian federally regulated institutions it reads against OSFI Guideline B-10, and against E-23 for the vendor models.
Does OSFI B-10 apply to AI vendors?
B-10 applies to third-party arrangements generally, and AI suppliers are third parties. OSFI's July 2026 bulletin on generative and agentic AI adds that institutions extend third-party risk management to vendors' AI use and require vendors to disclose it. Models a vendor supplies are also inside E-23's scope from 1 May 2027.
How is an AI vendor different from other suppliers?
Its model can change without a new contract, your data may be used to train it, it depends on its own model and cloud providers, and its agents may act on your systems. Each of these needs a line on the supplier's file.
What happens when an AI vendor has an incident?
It is declared once on the supplier and reaches every dependant: an incident on each dependent AI agent and a proposal to isolate each dependent model in production. A person decides each one, and someone other than the declarer closes the incident.
Does MINERVA assess vendors for us?
No. Your team assesses and decides; MINERVA keeps the stations, the evidence and the dates, and shows what depends on each supplier.
Can we use our own due-diligence questionnaire?
Yes. Your questionnaire and the answers are filed against the supplier as evidence. A free AI vendor due-diligence checklist under B-10 is at minerva.studio/templates.
Also: Third-party AI procurement, step by step · AI vendor risk under B‑10, explained · Agentic AI governance platform · OSFI E‑23 software.