AI Vendor Due Diligence for Community Banks and Credit Unions

What Examiners Are Actually Looking For

The 2023 interagency guidance, issued by the Federal Reserve as SR 23-4 (Interagency Guidance on Third-Party Relationships: Risk Management), by the OCC as OCC Bulletin 2023-17, and by the FDIC as FDIC FIL-29-2023, refreshed the principles that have governed third-party risk for more than a decade. It did not single out AI, but examiners are applying it directly to AI vendor decisions. When they review an institution's AI vendor file, they are looking for evidence of three things:

1. The institution understood the vendor and the system before signing.
2. The institution structured the relationship to retain oversight, audit rights, and exit options.
3. The institution is monitoring the relationship in an ongoing way, not just at onboarding.

‍

Every section of an AI vendor due-diligence file should be readable through this three-part lens.

The Risk Profile of an AI Vendor

AI vendors introduce a specific blend of risks that traditional technology vendors do not always carry:

• Decision-support risk. AI outputs influence underwriting, onboarding, monitoring, and compliance decisions. Errors propagate quickly.
• Model risk. The system itself is a model that requires validation under SR 11-7 (Supervisory Guidance on Model Risk Management) and equivalent guidance, including OCC Bulletin 2011-12 and FDIC FIL-22-2017. Note that the agencies issued revised, principles-based interagency model risk management guidance in April 2026, published by the Federal Reserve as SR 26-2, which extends these foundational expectations to modern AI systems.
• Data risk. Customer evidence, PII, and beneficial ownership information may be processed by the vendor.
• Explainability risk. If the vendor's outputs cannot be explained, the institution cannot defend its decisions.
• Concentration risk. Many institutions use the same handful of AI vendors. A vendor incident can affect peer institutions simultaneously.

‍

A thorough due-diligence package addresses each of these explicitly. The NIST AI Risk Management Framework provides useful vocabulary for structuring the AI-specific portions of the assessment.

A Practical Due-Diligence Questionnaire

The following is a starting questionnaire for AI vendor evaluation. It can be adapted to fit existing third-party risk templates.

Section 1. System architecture and behavior

• Describe the system architecture, including where AI processing occurs.
• Is the system deterministic or probabilistic? If probabilistic, how is variability documented and managed?
• What data does the AI model see at the inference layer? Provide the minimum data dictionary.
• Is the system used to make decisions, or to support decisions made by humans?
• Are there any autonomous decisioning paths? If so, document scope, controls, and human override.

‍

Section 2. Data handling

• Where is customer data stored? In what jurisdictions?
• Is the deployment single tenant or multi tenant?
• Is customer data used for model training, fine tuning, or product improvement?
• What PII redaction or tokenization is applied, and at what point in the pipeline?
• What retention controls and deletion controls are available?

‍

Section 3. Model risk and explainability

• Provide model documentation aligned to SR 11-7 expectations.
• Describe the validation methodology and the most recent validation results.
• How are outputs explained? Provide sample outputs and the rationale structure.
• What change management controls govern model updates?
• How is performance monitored over time?

‍

Section 4. Governance, security, and compliance

• Provide the most recent SOC 1, SOC 2, and any relevant third-party audits.
• Document incident response procedures and notification timelines.
• Describe subcontractor relationships and any fourth-party exposure.
• Provide contractual terms covering audit rights, data use, retention, breach notification, and material-change notification.
• Describe access controls, role-based permissions, and least-privilege enforcement.

‍

Section 5. Operational dependence and exit

• Document the institution's level of operational dependence on the system.
• Provide contingency plans for vendor failure, performance degradation, or termination.
• Define an exit plan including data return, deletion, and transition support.

‍

The Documentation File the Examiner Will Want

For each AI vendor relationship, maintain a single file that contains:

• The completed due-diligence questionnaire.
• The vendor's responses, including supporting documentation.
• The institution's risk assessment and rating.
• Board or committee approvals.
• The executed contract with key terms summarized.
• The model documentation provided by the vendor.
• The most recent monitoring reports and any issues identified.
• A change log capturing version updates, material changes, and the institution's response.

‍

The file should be reviewable in a single sitting. If it requires excavation across three different drives, the examiner will note it.

Common Findings to Avoid

Based on observed supervisory experience and peer institution feedback, the following findings are common in AI vendor reviews:

1. No formal risk rating. The institution signed the contract without documenting the risk classification.
2. Missing model documentation. The vendor's responses describe the product but not the model.
3. No audit rights. The contract does not give the institution the right to review controls or pull artifacts.
4. No material-change notification clause. The vendor can update the model without telling the institution.
5. Ongoing monitoring on paper only. The annual review is signed but no substantive monitoring occurred.
6. No exit plan. Termination would create operational disruption with no documented mitigation.

‍

Each of these is preventable with a disciplined due-diligence process.

Ongoing Monitoring, Not One-Time Diligence

The most important change in the 2023 guidance is the emphasis on continuous monitoring rather than periodic assessment. For AI vendors, this means:

• A regular cadence (typically monthly or quarterly) of performance review.
• A formal review trigger when the vendor announces material changes to the model.
• Annual deep reviews that revisit the original due-diligence questions.
• Documented escalation paths when issues are identified.

‍

Ongoing monitoring is the discipline that separates institutions that are managing their AI vendors from institutions that have simply signed a contract with one. The same continuous-discipline principle applies to customer relationships. For vendors whose systems screen or monitor for BSA/AML purposes, SR 21-8 (Interagency Statement on Model Risk Management for BSA/AML Systems) is directly relevant.

How StandardC AI Approaches This

StandardC AI provides a complete vendor due-diligence package designed to map directly to the 2023 interagency guidance. The package includes architecture documentation, deterministic processing evidence, model documentation aligned to SR 11-7 expectations, the minimum data dictionary the inference layer sees, SOC reporting, incident response procedures, subcontractor transparency, and contractual terms covering audit rights, data-use restrictions, retention limits, breach notification, and material-change notification. Ongoing monitoring artifacts, change logs, and version-controlled execution specifications are produced as part of the normal operating cadence, not generated on demand for an examination.

Frequently Asked Questions

We already have a third-party risk management program. Do we need a separate one for AI?

No. AI vendor diligence belongs inside the existing program, with sharper questions in the model-risk and explainability sections.

How should we risk rate an AI vendor?

Use the same risk-rating framework you use for other vendors, with explicit consideration of decision-support risk, model risk, and explainability risk. Most AI vendors supporting risk and compliance workflows will rate at moderate or higher.

How often should we monitor an AI vendor?

Continuous monitoring is the expectation. At minimum, a quarterly performance review, an annual deep review, and event-driven reviews triggered by material changes.

Does StandardC AI sign onto our standard vendor terms?

Most institutions' standard third-party agreements are compatible with StandardC AI's contracting posture. The audit rights, data-use restrictions, and material-change notification language are explicitly designed to align.

Authoritative Sources

• Interagency Guidance on Third-Party Relationships: Risk Management (Fed SR 23-4)
• OCC Bulletin 2023-17 (Third-Party Relationships)
• FDIC FIL-29-2023 (Interagency Guidance on Third-Party Relationships)
• SR 11-7 (Supervisory Guidance on Model Risk Management)
• OCC Bulletin 2011-12 (Sound Practices for Model Risk Management)
• FDIC FIL-22-2017 (Adoption of Supervisory Guidance on Model Risk Management)
• SR 26-2 (Revised Interagency Guidance on Model Risk Management)
• SR 21-8 (Interagency Statement on Model Risk Management for BSA/AML Systems)
• NIST AI Risk Management Framework

‍