A general model like ChatGPT can help draft questionnaires or summarize a policy, but it is not built to run a governed, auditable vendor risk assessment on its own. It has no access to your control framework, no verified evidence trail, and it can produce confident but wrong answers. Purpose-built platforms use AI within guardrails and keep an audit trail, which is what compliance and audit teams need.
