The AI Vendor List Your CFO Asked For (And How to Build It) - 2026

Per IDC's 2025 Worldwide AI Spending Guide, enterprise AI software spend will pass USD 232 billion in 2026, with most of that flowing through SaaS line items rather than dedicated AI budgets. CFOs are now asking finance, procurement, and the CISO for a single AI vendor list that explains who has AI exposure, where the spend lives, what data leaves the perimeter, and which contracts give the company an exit. This guide is the practical build. Source: IDC Worldwide AI Spending Guide, March 2025. Updated 2026-05-20.

The AI vendor inventory question moved from CISO desks to CFO desks during 2025. Three forces converged: AI line items started materially affecting renewal economics (every major SaaS vendor added an AI tier or AI SKU), audit committees began asking how AI risk was reflected in 10-K filings, and AI-driven incidents started producing real losses that interrupted forecasted savings. By the start of 2026, most public-company CFOs have either received an audit committee question on AI vendor exposure or are anticipating one in the next 90 days.

The pattern we see is consistent: finance can list every vendor invoiced over USD 10,000, security can list every approved SaaS tenant, procurement holds the signed contracts, but no one can answer the actual question - which of those vendors process company or customer data through AI models, and what are the controls. The list the CFO needs sits across all three of these systems and is owned by none of them.

The strategic takeaway is that the AI vendor list is now a CFO-grade artefact, not a security spreadsheet. It must satisfy three audiences simultaneously: the CFO and audit committee (who care about disclosure, spend, and contract risk), the CISO and risk owner (who care about data flow and incident exposure), and the procurement and legal teams (who care about commercial terms and termination rights). A list built only for one audience fails the other two on first questioning. The Areebi platform inventory and compliance hubs are built around this multi-audience model.

The first reason most AI vendor lists fail is incorrect scope. Teams instinctively list the obvious frontier-model providers (OpenAI, Anthropic, Google) and stop. That captures perhaps 20 percent of true AI exposure in a typical mid-market enterprise. The correct scope question is: any vendor whose product touches company or customer data and uses AI for compute, classification, generation, prediction, or automation. That definition covers four distinct vendor classes that must each appear on the list.

A vendor list without classification is a phone book - useful for nothing the CFO is asking. The classification scheme that holds up across audit, finance, security, and procurement reviews is four-by-four: four vendor classes (above) crossed with four risk tiers. Every vendor on the list lands in exactly one cell, and the cell determines the controls, the documentation depth, and the review cadence.

Per NIST SP 800-161 Revision 1 (May 2022), supply-chain risk management requires tiered classification with documented criteria. Areebi's model supply chain security guide covers the technical control mapping; the schema below is the finance- and audit-ready overlay.

The trap to avoid is letting business units self-classify. Self-classification consistently produces tier creep downward (everything becomes Tier 3 because it makes the paperwork lighter). The CISO or AI governance committee must own the classification decision, with the business unit providing input only on the use case and data flow.

The CFO question that exposes most AI vendor lists is: "What did we spend on AI in the last 12 months?" Three patterns produce a defensible answer.

Pattern 1: Tag the contracts, not the invoices. Attempting to extract AI spend from invoices is hopeless because most AI line items are embedded in master SaaS subscriptions. Instead, tag each vendor on the list with an AI spend share (often expressed as a percentage of the master subscription or a flat add-on amount where the AI SKU is line-itemed). Sum the tagged contracts quarterly. This is the number that should appear in board materials. Per Gartner's 2025 IT Key Metrics, AI-specific spend grew at 3.4x the rate of overall IT spend in 2024-2025, which means the line item is large enough to merit its own roll-up.

Pattern 2: Force AI SKUs to a separate cost centre. Where the vendor offers a separately invoiced AI add-on (Microsoft 365 Copilot, Salesforce Einstein Copilot, GitHub Copilot Enterprise), require procurement to allocate the AI SKU to a dedicated AI cost centre. This gives the CFO a clean monthly burn number without rebuilding finance systems. It also enables ROI conversations at the SKU level, which is where the next wave of CFO scrutiny is going.

Pattern 3: Surface model usage costs from cloud consumption. For frontier-model spend that flows through cloud accounts (Bedrock, Azure OpenAI, Vertex AI), enable native cost tags at the workload level. Most enterprises discover that 60 to 80 percent of their frontier-model spend was previously buried in a generic "AI/ML services" cloud cost line that nobody could attribute. Per Flexera's 2025 State of the Cloud Report, AI consumption surprises are now the most common reason for unbudgeted cloud overages, accounting for 27 percent of incidents.

For each vendor on the list, the contract file must include named clauses that survive specific audit questions. The minimum set is four documents and four clauses.

Document 1: Data Processing Addendum (DPA). Required for any vendor processing personal data. Must specify the lawful basis, the data categories, the retention period, the sub-processor list, the data transfer mechanism (SCCs, adequacy decision), and the rights of the data subject. AI-specific addendum language must address whether inputs are used for model training and on what basis. Per IAPP's 2025 DPA Best Practice Guide, AI-specific DPA addenda are now expected for any vendor whose product offers AI features, regardless of whether AI is the primary use case.

Document 2: Business Associate Agreement (BAA). Required wherever the vendor will process protected health information (PHI) covered by HIPAA. Frontier model providers offer BAAs but typically only under specific contract tiers (OpenAI Enterprise, Anthropic Enterprise, Azure OpenAI Service with HIPAA-eligible terms, Google Cloud with HIPAA BAA). A BAA must be executed before any PHI is exposed to the AI surface; a retroactive BAA does not cure prior exposure. Healthcare CISOs - see our healthcare AI governance guide for the full BAA matrix.

Document 3: Subprocessor list with notice and objection rights. AI vendors typically rely on multiple cloud and inference subprocessors. The contract must list subprocessors at the time of signing, give advance notice of changes, and grant an objection right (typically 30 days). The audit committee will increasingly ask whether the company exercised any subprocessor objection - track this even when the answer is no.

Document 4: Executed exit plan with data deletion SLA. Termination clauses that promise "deletion of customer data" without timeline, format, or attestation are not exit plans. The clause must specify a deletion deadline (typically 30 to 90 days), a format for any data returned, and a certificate of deletion that names which systems were purged. Tier 1 and Tier 2 vendors must have an exit plan rehearsed at least once during the contract term.

Clause set: indemnification, IP, output ownership, and liability cap. Areebi's standard contract review checks four clauses for every Tier 1 and Tier 2 AI vendor: (1) indemnification for IP infringement from model outputs, (2) clear customer ownership of inputs and outputs, (3) liability cap calibrated to a multiple of annual contract value rather than a fixed sub-USD-100,000 cap (which is the 2022-era default and is now considered inadequate for AI vendors processing regulated data), and (4) AI-specific incident notification (48 to 72 hours typical) layered on top of the standard data breach notification clause. At Areebi, we publish the redlines we use against our own vendors so customers can adopt them - they live in the resources library.

A vendor list that is built once and not refreshed is a finance and audit liability rather than an asset. The operating cadence that we observe holds up across mid-market and enterprise programmes has three layers.

Monthly: continuous discovery. Automated discovery from network telemetry, SSO logs, expense reimbursements, browser extension data, and DLP signals feeds new candidate vendors into the list. Tier 4 candidates are auto-classified and confirmed by a procurement reviewer; Tier 3 and above require a CISO sign-off before becoming a permanent inventory entry.

Quarterly: tiered reviews. Each tier follows its review cadence. The CFO and CISO jointly receive a quarterly AI vendor report covering: new additions, tier changes, deletions, contract renewals due in the next 90 days, expiring DPAs or BAAs, and the AI spend roll-up. Audit committees are now expecting this report - per Deloitte's 2025 CFO Signals survey, 62 percent of large-cap audit committees have requested an AI vendor inventory briefing at least once in the past 12 months.

Annual: full revalidation. Each Tier 1 and Tier 2 vendor undergoes a full revalidation: refreshed risk assessment, refreshed DPA and BAA where applicable, refreshed model card, refreshed sub-processor list, refreshed control attestation. Tier 1 vendors must demonstrate that they remain aligned with NIST AI RMF, ISO/IEC 42001, or an equivalent recognised framework. The output feeds the company's 10-K AI risk disclosure where applicable.

Three patterns of failure show up repeatedly when CFOs receive their first AI vendor list.

Mistake 1: One list, multiple owners, no source of truth. Finance maintains an AI vendor spreadsheet, security maintains an approved SaaS list, procurement maintains a contract repository, and the three never reconcile. The CFO asks one question and receives three different vendor counts. Avoid this by designating a single AI vendor inventory owner (typically the CISO with finance as co-owner), one canonical system, and a documented exception process when other systems must override.

Mistake 2: Tier 1 classification without enforcement. The list correctly classifies a frontier model provider as Tier 1, but the controls (DLP, audit logging, model card review) are not in place. The classification creates audit liability without delivering control benefit. Avoid this by tying tier assignment to an enforcement checklist that must be green before the vendor can move to production. The Areebi policy engine and audit log are designed to ship this evidence as a byproduct of normal operation.

Mistake 3: Contract renewal as a procurement-only event. AI vendor contracts come up for renewal and procurement extends on existing terms because no one provides an updated risk view. Avoid this by routing every Tier 1 and Tier 2 AI vendor renewal through the AI Governance Committee at least 60 days before the renewal date, with a refreshed risk memo as the input.

The list is a one-week build once you have the data sources. The sequence that works:

• Week 1 - Extract candidate vendors from finance (all SaaS over USD 10,000 ARR), procurement (active contracts), security (approved SSO tenants), and DLP (unsanctioned AI traffic).
• Week 2 - Classify each candidate against the four-by-four schema. Send a written AI exposure questionnaire to any vendor not clearly Tier 4.
• Week 3 - Reconcile contracts: locate DPA, BAA, sub-processor list, exit plan, indemnification clause for each Tier 1 and Tier 2 vendor. Identify gaps and assign remediation owners.
• Week 4 - Brief the CFO and CISO. Publish the operating cadence and the quarterly report template. Charter the discovery telemetry that keeps the list current.

The Areebi AI Governance Assessment generates the first version of this list as part of its standard output, drawing on the inventory and DLP telemetry inside the platform. The build an AI governance programme guide explains how this list fits into a broader operating model, and the build vs buy guide covers the make-or-purchase decision for the underlying inventory system.

• NIST SP 800-161 Revision 1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, May 2022. csrc.nist.gov/pubs/sp/800/161/r1/final
• IDC Worldwide AI Spending Guide - March 2025 release projecting USD 232 billion in 2026 enterprise AI software and services spend. idc.com
• IAPP Privacy and AI Governance Report 2025 - International Association of Privacy Professionals, annual benchmark on AI-specific DPA practice. iapp.org/resources
• Gartner Magic Quadrant for Third-Party Risk Management 2025 - Coverage of AI-specific vendor questionnaire adoption. gartner.com
• Deloitte CFO Signals 2025 Q3 - Quarterly survey of large-cap CFOs covering audit committee AI vendor inquiries. deloitte.com/us/cfo-signals
• Flexera 2025 State of the Cloud Report - Annual benchmark on cloud cost surprises including AI consumption. flexera.com