CISOs urged to document AI risks and vendor agreements

CISOs looking to mitigate AI liability are being urged to embed rigorous documentation and clear vendor negotiations at the contract stage. Cyber legal expert David Garrie, CEO of Law and Forensics, outlined three practical frameworks at ISC2 Strategic Congress 2026 that help quantify AI risk and create an evidentiary trail should a deployment go wrong.

He notes the discussion is timely in the era of agentic AI, with historic groundwork dating back to JAMS AI Rules in 2024 to guide technical evidence handling, but stresses that liability determination will hinge on what the organisation can prove it did to manage risk and respond to incidents.

Framework 1 is Garrie’s five-factor AI Deployment Risk Score, which rates tools across potential harm, data and rights, autonomy, evidence gap, and vendor dependence. The resulting score places deployments into standard review, conditional approval, restricted pilot, or hold release, signalling the level of risk accepted. Framework 2 focuses on recording the Board’s decision with granular details on scope, timeframe, exposure, conditions, human approval, and accountable parties to sustain a defensible paper trail.

Framework 3 is an AI Incident Response Checklist designed to preserve system state and gather comprehensive evidence beyond logs, including interaction records, data access, governance notes, and chain-of-custody data. Garrie urged CISOs to involve legal teams early and to ensure contracts enable timely access to model snapshots, logs, and preservation requests.

Over the next 30 days, his guidance is to test these frameworks on one deployment, improve one board report, and run an AI tabletop exercise to align vendor-evidence preservation and notification practices.