Most small businesses, nonprofits, and local government agencies don't have the legal bandwidth to deeply scrutinize every AI vendor agreement. But that doesn't mean you're powerless. It means you need the right questions before you sign. Third-party vendor risk is one of the most underexamined areas in AI governance for small organizations. Don’t allow your vendor's AI practices become your organization's liability.