Your AI suppliers are heading to Congress

The companies that supply your AI are about to spend a lot of time in front of Congress. If your firm runs its daily work on their models, that is the part of the US midterms worth watching. It changes AI vendor risk long before it changes any law.

The first piece in this series looked at the rules: hearings first, statutes later and the states carrying on regardless. This one looks at the tools you already use. What does a Congress in Democratic hands mean for the suppliers behind them, and for your AI vendor risk?

Your AI vendors are about to be questioned

From January, the new majorities control the committees. PYMNTS sums up the shift in one line: “Lawmakers will have more power to demand records, question executives and challenge agency decisions.” It expects AI developers to face more hearings and records requests. They will also be pressed to explain their safety decisions and the economic effects of their expansion, from jobs to electricity prices.

Some members want more than questions. According to TechTarget, some Democrats want AI leaders to testify under oath. A group of populists has called for a pause in AI development. Abdul El-Sayed, the new senator from Michigan, has called for a “full-on pause”. Those calls are not policy. They do show how far the debate has moved.

For a customer, hearings have a practical side effect. Testimony and subpoenaed documents can reveal how a vendor tests its models. They can show what it knew about their limits and how it handles incidents. No security questionnaire would ever get you that. It says more about AI vendor risk than any sales deck.

Why AI vendor risk shifts after the midterms

The obvious fear is that a supplier disappears or a product is banned. Neither looks likely. Michael Bennett of the University of Illinois Chicago told TechTarget that “it’s hard to imagine that any of the frontier companies are going anywhere.”

The subtler risk is timing. Bennett also suggested that congressional investigations could lead to policy changes. Extended third-party or government review could slow model releases. Does your roadmap assume next year’s model by a certain quarter? Then that assumption carries more uncertainty than it did last week.

The other change is geography. Kashyap Kompella of RPA2AI Research describes “a wild west of AI regulation, with federal, state and local governments moving in different directions.” TechTarget notes that an AI tool allowed in one state could face extra disclosure, auditing or oversight rules in another. A vendor that serves every state meets those differences first. Some of the cost and the paperwork will reach its customers, which makes it part of your AI vendor risk too.

More oversight is not more certainty

Dallas Dolen leads technology, media and telecom at PwC. She put the paradox neatly in Fox Business: “more oversight doesn’t necessarily mean more certainty.” She added that companies “can’t put major AI investments on hold while the rules take shape.”

That is the position of an AI lead in Europe, too. Waiting for Washington to settle is not a plan for AI vendor risk. Building on what you can control is.

The jobs question will reach your organisation

AI’s effect on work is now firmly part of the US political debate. Dolen lists labour among the areas she expects lawmakers to scrutinise. Safety, bias, copyright and transparency are on her list too. Kompella expects “greater scrutiny of AI companies, particularly around safety, jobs and society.”

Voters cared as well. PYMNTS cites an NBC News exit poll in which 56% of voters called AI and data centres a crucial or major factor in their congressional vote.

European employees read the same headlines. When AI becomes a political subject, staff and works councils ask sharper questions about their roles. Some firms can explain plainly where they use AI, what it automates and what it does not. They will have an easier conversation than firms that improvise.

Managing AI vendor risk from Europe

None of this calls for a new framework. It calls for a few questions you can answer in an afternoon.

• Which models and suppliers does your daily work depend on, and what happens if a release slips by six months?
• Do your contracts require notice when a vendor changes or replaces the model underneath your product?
• Who in your organisation reads the hearings and decides whether anything that comes out of them matters to you?
• Can you explain, in plain words, what AI does to jobs in your firm today?

The first two questions are classic AI vendor risk: dependence and change. The third is about attention. Somebody has to notice when testimony in Washington touches a supplier you rely on, and decide whether it changes your own assessment of AI vendor risk. The last question has nothing to do with Congress and everything to do with trust. It will come up regardless.

Why a governance baseline beats a forecast

Dolen urges US companies to build “a strong governance baseline”. That way they can keep investing while the rules move. Kompella similarly recommends treating AI governance as a core business practice, with regular audits, risk assessments and accountability mechanisms.

The same holds for a mid-market firm in Europe. Keep a clear register of the AI you use, the suppliers behind it and the decisions it touches. That register makes AI vendor risk visible. Whatever emerges from Washington, you can then see quickly where it lands.

This is the second of three pieces on the midterms and AI. The third looks at data centres and what the backlash means for dependence on US technology.

To check where your own governance baseline stands, the free AI Governance Readiness Assessment shows the weakest areas to address first.