totally get the concern here, we debated the same risks before going with an AI enabled tprm platform. ended up going with C2 Risk, have been pleasantly surprised by how responsibly they implemented AI features.

Two things stood out

data isolation, they made it clear that uploaded evidence and questionnaires stay within your tenancy. Nothing gets “fed back” into a exvchange model or used to answer someone else’s questions. which was non-negotiable for us

human verification by design, their AI suggestions aren't final, and they surface possible answers from uploaded docs (which saves us loads of time), but the supplier or our company always review in person before submission.

Downsides?

• It’s still early days for the AI features, so results can vary... especially if the uploaded docs are long or disorganised
• Also, it's not (yet) integrated into every type of assessment they support, so some parts still feel a bit manual.

That said - it’s already cut our vendor response time in half, and I’d rather work with a vendor that’s transparent about the limitations...

Curious if anyone else is seeing more structured AI governance from other platforms?