MSSPs are getting more questions about AI risk as clients bring new AI tools into their environments. The problem is that existing AI standards don’t line up, and most assessments overlap or contradict each other.
Black Kite’s new Global Adaptive AI Assessment Framework (BK-GA³) is meant to give MSSPs one clear structure they can use when evaluating vendor AI risks.
A single framework built from many standards
Black Kite created BK-GA³ by pulling together requirements from more than 50 global frameworks. The idea is simple: instead of forcing teams to compare ISO, NIST, and regional laws one by one, the new framework merges the common pieces into one usable standard.
Bob Maley, CSO at Black Kite, explained it to MSSP Alert: “The BK-GA³ framework acts as a harmonization layer, distilling commonalities across ISO/IEC 42001, NIST AI RMF, and regional laws like the EU AI Act and CETS 225.”
He said the framework helps close gaps that appear when each standard uses different terms or structures. “It bridges terminological and structural gaps by using a flexible taxonomy and control framework aligned to lifecycle risk assessment and maturity modeling, making it adaptable across sectors.”
Maley expects regulated industries to pick it up quickly because most AI-specific rules are still early and inconsistent. “Regulated industries are likely to adopt it as a bolt-on to existing TPRM and compliance programs, especially where AI-specific standards remain fragmented or immature.”
Fits into existing TPRM and SIG workflows
BK-GA³ isn’t meant to replace current processes. Instead, it slots into the workflows that teams already use. Maley said it was designed to work with tools like the Shared Assessments SIG so teams don’t have to rebuild everything. “BK-GA³ complements and extends the Shared Assessments SIG framework by providing another focused lens on AI-specific risks.”
He added that the framework works as an overlay rather than a standalone system. “In general, BK-GA³ is designed to serve as an overlay to existing third-party risk workflows, including SIG, align with emerging global standards, and introduce AI-specific risk domains such as model provenance, prompt misuse, and alignment drift.” For MSSPs, this means they can use the same processes they already rely on, but with clearer guidance on AI-specific issues.
Designed to scale across large vendor lists
MSSPs often have to assess dozens or hundreds of vendors across multiple clients. Maley said the framework was built to make that work easier. “BK-GA³ delivers standardized, tiered control sets that MSSPs and TPRM providers can map to vendor maturity levels, enabling scalable and repeatable AI risk assessments.”
He pointed out that the goal is to help teams make decisions faster and more consistently. “Combined with other intelligence items and dynamic risk scoring, it supports consistent, data-driven decisions at scale. By using a single, unified standard for assessing AI risk, providers can reduce duplicative effort across overlapping questionnaires and minimize operational overhead from industry-specific question sets.”
BK-GA³ is available publicly and inside the Black Kite platform. Public access gives teams a shared reference point, while platform users can automate assessments. For MSSPs, the takeaway is simple: this gives them a clearer, more manageable way to talk about AI risk with clients who are moving fast into AI-driven tools.
