What the Orchestrator Caught, Meridian, a Vendor, and a Contract Nobody Reopened

Third-party AI risks can change long after a vendor contract is signed. Using the Meridian case study, this paper shows how the runtime orchestrator connected changes in vendor behavior, model retraining, subprocessors, and cross-border data transfers to a contract that no longer reflected the relationship. It demonstrates how continuous oversight can identify risk that periodic vendor reviews may miss.