Third-party dependencies have become a structural feature of contemporary supply chain operations, creating exposures that extend beyond the boundaries of any single organization. Prevailing assessment practice remains anchored in periodic, questionnaire-based methods that produce ordinal risk ratings. Such ratings cannot express uncertainty, cannot be aggregated across organizational entities, and decay between review cycles. Artificial intelligence offers analytical capabilities that address these constraints, yet the literature reviewed here treats those capabilities largely in isolation from the governance structures that determine whether their outputs acquire organizational force. This paper develops a governance-anchored framework for AI-enabled third-party risk quantification through design science research, positioning the contribution as an exaptation of quantification approaches established in credit risk to a domain characterized by sparse outcome data. The framework comprises four layers: data ingestion and signal extraction, quantification logic, governance architecture, and aggregation and escalation. Governance controls are specified within it as constitutive components rather than as subsequent additions, and its quantification layer is scoped to relative exposure ordering with explicit uncertainty rather than to calibrated absolute failure probabilities, a scoping decision that follows from the rare-event data conditions characteristic of vendor populations. Evaluation proceeds against external referents comprising named regulatory expectations and documented failure cases, following an established design science evaluation framework. Of six design requirements, four are assessed as adequately addressed, one as partially addressed, and one as conditionally addressed pending specification beyond the framework's present scope. The study contributes to supply chain risk management, enterprise risk governance, and applied artificial intelligence scholarship. As a conceptual artifact evaluated analytically rather than empirically, its propositions await implementation testing.