Checklists organize findings. Auditors, underwriters and litigators ultimately have to reason about how those findings interact. That interaction is the toxic combination — individually-acceptable findings composing into something exploitable. AI running inside an HR platform. An incomplete assessment, with no documented impact analysis. Colorado employees, whose hiring decisions the statute covers. An unowned vendor relationship, where nobody has written down whether responsibility sits with the developer or the deployer. Each is a Low on its own. Together they are one toxic combination — and the artifact’s job is to show somebody recognized that. The designation is three or more findings, each individually Low or Medium, composing into something exploitable; three is the floor, not a magic number. Four green checkboxes do not survive deposition. A dated risk record showing what was connected, why it mattered, who owned it and what happened next has a fighting chance.
This stopped being hypothetical in September 2026. On 14 September, plaintiffs in Mobley v. Workday (N.D. Cal., 3:23-cv-00770-RFL) moved to certify four subclasses in a case alleging that AI-assisted hiring tools disadvantaged applicants by race, sex, age and disability. Workday disputes the allegations, none of them has been proven, and the certification hearing is set for 9 March 2027. What makes the case worth watching here is not its outcome. It is the question the court has been asked to work through: when an automated employment system allegedly produces discriminatory effects, how is responsibility divided between the vendor that built the technology and the organizations that deployed it? That question is answered by the relationship among facts, not by any one of them.
Colorado is making the same division explicit in statute. SB 26-189, the Automated Decision-Making Technology Act, takes effect 1 January 2027 and covers consequential decisions in employment among other domains, assigning different obligations to developers and to deployers. The implementing rules are still being written: the Colorado Department of Law filed proposed rules on 11 August 2026 and the comment window runs to 26 October 2026. A vendor inventory tells you what exists. An ownership map tells you who is responsible for what it does. You need both.
Standardized questionnaires such as Shared Assessments’ Standard Information Gathering (SIG) questionnaire — the one most third-party risk programs run on — are good at what they were built for: collecting comparable evidence about individual controls. (The longer argument about where that surface runs out is in Beyond SIG Lite.) They can be scoped, weighted, scored and mapped to frameworks. But scoring individual responses is not the same job as reasoning across the relationships among them. A questionnaire can ask a hundred questions or a thousand; each answer still arrives as its own row. Automating the questionnaire makes collection faster without changing its shape — collection and synthesis are different jobs, and the second is the one that produces evidence somebody recognized the pattern.
Cloud security learned this first. Wiz popularized the term “toxic combination” because an exposed workload, an excessive permission and sensitive data are not well understood as three independent alerts — their relationship is the attack path. Wiz applies compositional reasoning to attack paths; we apply the same reasoning pattern to governance evidence, where vendor dependency, decision context, affected population, missing ownership and regulatory obligation compose exactly as those cloud conditions do. The broader evaluation field is drifting in this direction too. NIST’s Assessing Risks and Impacts of AI (ARIA) Evaluation Planning Manual (NIST AI 200-3, September 2026) describes “conducting a holistic AI evaluation” in which trustworthiness is assessed “by combining data from three types of testing: Model Testing, Red Teaming, and User Testing.” The clause that matters for a governance program is where NIST places it: ARIA-style evaluations are “one technique which serves the Measure function in the NIST AI Risk Management Framework.” So the framework you are likely already mapped to treats measurement as something you compose from several kinds of evidence. NIST says nothing about toxic combinations; what it shares is the premise that system-level risk does not reduce to a single isolated measurement.
What to do. Use a severity model that names combinations explicitly, and make the reasoning reviewable. SanctumShield’s Executive Risk Report (severity taxonomy adopted from Wiz’s seven-category model) renders an explicit TOXIC_COMBINATION finding that answers four questions: what composes the risk, why the combination matters, who owns it, and what happens next — with a dated 90-day action plan. The multi-model synthesis layer helps surface the relationship; the artifact is what makes that reasoning something a third party can review. The goal is not a smarter checklist. It is to leave evidence that the organization understood the system around the checklist. Next step: see the TOXIC_COMBINATION callouts rendered in the Acme Health Executive Risk Report on the sample outputs page.