Buying AI from a vendor: due diligence that holds up in an exam

Most community institutions will not build AI. They will buy it, or they will receive it as a feature inside software they already pay for. That makes vendor management the main control point, and it is where examiners tend to look first.

The Federal Reserve, the FDIC and the OCC issued final interagency guidance on managing third-party relationships in June 2023. It replaced the separate guidance each agency had before, and it is organized around the life of the relationship: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Credit unions should confirm how NCUA applies its own third-party guidance, but the lifecycle is a sound way to organize the work either way.

Scale the effort to how critical the relationship is

The guidance is explicit that risk management should match the risk and complexity of the relationship. An AI tool that drafts internal meeting notes does not need the same scrutiny as one that touches loan decisions or member funds. Tier your vendors, and save the deep work for the ones that matter.

Questions worth asking

When the product uses AI, add these to your normal due diligence questionnaire.

• Where is our data processed and stored, and who can see it?
• Is our data used to train or improve models for anyone else? Can we opt out in writing?
• Which subcontractors are involved, including whoever supplies the underlying model? These are your fourth parties.
• How do models change, and how and when are we told about material changes?
• What testing evidence supports the accuracy claims, and on what kind of data?
• How do we review, override and correct outputs, and are those actions logged?
• What are your incident response and notification timelines?
• What independent assurance can you share, such as a SOC 2 report, and what does it cover?
• What happens to our data if we leave, and how is deletion confirmed?

Red flags

Be cautious when a vendor will not explain in plain terms how the product works, when accuracy figures come only from demo data, when there is no notice of model changes, when the contract gives the vendor broad rights to use your data, or when there are no references from other regulated institutions. A confident sales process is not evidence of a controlled product.

Contract points to protect

Good contracts for AI services usually include limits on how your data may be used, rights to information and audit proportionate to the risk, disclosure of subcontractors, service levels, support for regulatory examinations, assistance at termination, and liability terms that reflect the potential cost of a data incident. Involve counsel early. The time to negotiate an exit is before you sign.

Keep watching after you sign

Due diligence is a starting point. Schedule a regular review of performance against the thresholds you set, read the vendor's assurance reports when they are issued, track incidents and complaints, and re-check the tiering when the vendor adds features. A tool that was low risk at signing can become more important to your operations a year later.

Make it repeatable

Write a standard AI addendum to your vendor questionnaire, about twenty questions long, and use it every time. It turns each new tool from a custom project into a routine check, and it gives your examiner a consistent record. Pair it with the inventory described in our model risk piece.

A practical first step

List every vendor and software product that now includes AI features, including the ones that added them quietly through updates. Tier them. Then ask your three most critical vendors the questions above and file the answers. That is a small effort that closes a large gap.