Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Banks should contract with AI vendors through a risk-based third-party oversight program—not by attaching a generic “AI addendum.” The agreement should define the service and responsibilities, restrict data use, require appropriate security and information rights, establish measurable performance and issue-remediation duties, and provide a workable transition or exit. The bank remains accountable for safe, sound, and legally compliant operations even when an AI activity is outsourced.
This guide is written for U.S. federally supervised banking organizations. The 2023 Federal Reserve, FDIC, and OCC Interagency Guidance on Third-Party Relationships: Risk Management is the central final guidance for negotiating and managing these relationships. It calls for tailoring controls to the service’s risk and complexity; it is supervisory guidance, not a universal mandatory clause checklist. Institution-specific language should receive legal, compliance, information-security, model-risk, procurement, and business-owner review.
Begin with the bank’s risk assessment, not a template
Before drafting terms, document what the AI service does, what could go wrong, and how the bank will detect and respond to those problems. Classify the relationship by considering at least:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Data sensitivity: whether the service handles customer information, confidential bank information, payment data, credentials, or regulated records.
- System access: whether the vendor only returns an analysis or can write to core systems, approve transactions, contact customers, or trigger automated actions.
- Business criticality: the customer, safety, liquidity, compliance, and operational impact of an outage or erroneous output.
- Dependency and concentration: reliance on the vendor, its cloud provider, model provider, and subcontractors, including whether a replacement is realistically available.
- Transparency: the quality and timeliness of information the vendor will provide for validation, monitoring, examinations, and incident response.
- Exit feasibility: how quickly the bank can retrieve data, move workflows, and operate safely if the service ends.
Record the resulting inherent and residual risk. A vendor’s refusal to disclose information is not resolved by calling the model a “black box”; it is a limitation that requires compensating controls or an explicit decision that the remaining risk is unacceptable.
Define scope, roles, dependencies, and change control
The contract should make the service understandable to someone who was not in the sales process. Describe the AI function, intended and prohibited uses, covered products and geographies, deliverables, support hours, maintenance, interfaces, and expected customer-service obligations.
Assign operational responsibilities
State which party supplies data, configures prompts or rules, approves releases, reviews outputs, handles complaints, investigates alerts, and makes final decisions. Specify the bank’s responsibilities for access management, data quality, human review, and business continuity. If the vendor’s output is advisory rather than determinative, say so and identify the required human control.
Identify the full dependency chain
List material subcontractors, hosting providers, model providers, data suppliers, and other arrangements that could introduce risk. Require advance notice—and, for material changes, bank approval or a documented objection process—when a party, location, model, processing purpose, or critical component changes. Require the vendor to remain responsible for subcontracted work and to flow down equivalent confidentiality, security, audit, incident, and transition duties.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Control configuration and model changes
Define what counts as a material change, who may make it, the notice period, testing evidence, rollback method, and emergency-change process. The reviewed guidance does not prescribe one universal AI change-notice clause; the bank should set the threshold that matches the service’s use and risk.
Control data use, confidentiality, and intellectual property
Write a data schedule that identifies every category the vendor may receive or derive. Cover bank data, customer information, prompts, uploaded documents, telemetry, logs, embeddings, generated outputs, and data supplied by subcontractors.
Limit purpose, retention, and disclosure
Permit processing only to deliver the contracted service and comply with specifically identified legal obligations. Prohibit training, product improvement, advertising, resale, or disclosure to other customers unless the bank has expressly approved the purpose and assessed its consequences. Set retention periods for input data, outputs, logs, backups, and support records; define secure deletion, deletion verification, and legally required holds.
Rank #2
Protect ownership and licensing
State who owns bank-provided content, generated outputs, fine-tuning data, prompts, configurations, and custom code. Grant only the licenses needed to operate, support, secure, and transition the service. Address whether the vendor may use the bank’s name, marks, examples, or derived materials. Do not assume standard online terms answer these issues; attach negotiated terms in an order of precedence that prevents conflicting click-through language from silently overriding them.
Handle location and cross-border processing
Specify approved processing and support locations, transfers, remote-access countries, and records that must remain in a particular jurisdiction. Require notice before a location change and cooperation with the bank’s obligations for customer and regulated information.
Set security and privacy obligations that match access
Security language should be tied to the bank’s information-security risk assessment rather than a generic certification list. The Federal Reserve’s Interagency Guidelines Establishing Information Security Standards state that institutions must require relevant service providers by contract to implement appropriate measures and, where indicated by risk assessment, monitor them.
Specify control expectations
Address identity and privileged-access management, encryption in transit and at rest, key management, network isolation, secure development, vulnerability and patch management, malware protection, logging, backup, recovery, physical safeguards, personnel screening, and secure disposal. Require the vendor to maintain a current inventory of systems and subprocessors that handle bank information.
Make incidents actionable
Define a security- or privacy-incident trigger, notification deadline, required content, communication channel, and update cadence. Require preservation of evidence, forensic cooperation, containment, customer and regulator support, root-cause analysis, and corrective action. Allocate responsibility for notification costs and for legal, audit, examination, and response expenses where appropriate.
Verify rather than accept assertions
Require current independent reports or assessments, security-test summaries, remediation status, and answers to bank questionnaires. Permit targeted testing when the risk warrants it. A certification can inform diligence but should not replace the bank’s continuing monitoring.
Rank #3
Make performance and outcomes measurable
Define service levels that let the bank evaluate whether the AI is fit for its actual use. Include availability, latency, capacity, support response, error handling, data-quality expectations, and reporting frequency where those measures matter.
Measure the right thing
Do not reward speed, volume, or automation rate if doing so encourages inaccurate, unfair, noncompliant, or harmful outcomes. Depending on the use case, negotiate reporting on accuracy, false-positive and false-negative rates, drift, override rates, complaints, disparate outcomes, policy exceptions, and human-review completion. The sources do not establish a universal AI metric set; metrics must be justified by the service and its risks.
Define thresholds and remedies
Set notice thresholds, investigation timelines, corrective-action plans, service credits where useful, suspension rights, and termination triggers. Require the vendor to explain material degradation and to support retesting after a fix. Contractual remedies should not be the only control where an error could harm customers or compromise compliance.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Secure information, audit, and regulatory access
The bank needs timely, accurate, and sufficiently comprehensive information to monitor risk, performance, and compliance. Include a right to obtain records and materials relevant to the service, subject to narrowly tailored protections for genuine proprietary information.
Cover the records that matter
Identify access to policies, control reports, system and data-flow descriptions, model or service documentation, change records, incident files, test results, performance reports, subcontractor information, and retention/deletion evidence. Require records in a usable format and for a period that supports the bank’s obligations.
Preserve examination rights
State that the bank, its internal and external auditors, and appropriate federal or state regulators may obtain information, conduct reviews, and communicate with responsible vendor personnel as needed for oversight. Address secure examination logistics, confidentiality, and response times before signing.
Deal with proprietary limits explicitly
If the vendor will not provide source code, detailed training data, parameter values, or other requested material, document exactly what is withheld, why it matters, and what substitute evidence or control is available. Treat any remaining inability to evaluate the service as residual risk requiring approval at the bank’s established authority level.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAllocate compliance, issue management, liability, and insurance
Compliance responsibilities
Map applicable laws, regulations, contractual duties, consumer-protection requirements, records obligations, and the bank’s policies to specific parties. Require cooperation with examinations, complaints, investigations, and regulatory requests. The vendor should promptly disclose control deficiencies, legal changes, and events that could impair compliance.
Escalation and remediation
Create severity levels, notification deadlines, named contacts, escalation paths, corrective-action plans, validation of closure, and management reporting. Reserve the bank’s right to restrict use, require additional review, suspend a feature, or terminate when a material issue cannot be remediated acceptably.
Fees, indemnities, limits, and insurance
Make recurring fees, usage charges, change requests, data-extraction costs, and special support rates clear. Assess whether liability caps and exclusions are proportionate to possible losses, including confidentiality breaches, security incidents, intellectual-property claims, regulatory costs, and customer harm. Specify indemnities and insurance types and amounts according to the risk; the interagency guidance does not prescribe standard caps or policy limits.
Build continuity, termination, and transition into the initial deal
Exit rights are not useful if the bank cannot operate during the handoff. Plan for outage, insolvency, ownership change, repeated performance failure, security or compliance failure, contract expiration, and regulator-directed termination.
Set workable notice and assistance terms
Choose notice periods that reflect the service’s criticality and replacement time. Require continued service during an orderly transition, knowledgeable personnel, migration support, documentation, testing environments, and cooperation with a successor provider. Allocate transition labor, data-conversion, and other costs in advance.
Return or destroy data safely
Specify export format, completeness, delivery deadlines, metadata and audit-log inclusion, encryption, chain of custody, backup treatment, and deletion certification. Require the vendor to return or destroy bank resources and to identify any information retained under legal hold.
Preserve access to essential materials
Where justified, provide continued access to software, configurations, documentation, or source materials under defined events such as vendor failure or termination for cause. Test the exit plan periodically; an untested right may not be operationally credible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use AI and model-risk controls carefully
The April 17, 2026 revised model-risk guidance from the OCC, Federal Reserve, and FDIC is risk-based and non-prescriptive. It discusses vendor products—including data, parameters, and complete models—and says sound practice includes understanding conceptual soundness, design, development data, and performance. Monitoring and outcome analysis can test whether a product remains accurate, fit for purpose, and reliable. For customized vendor models, document and evaluate customizations as part of validation.
That guidance expressly excludes generative AI and agentic AI because they are novel and rapidly evolving. It therefore does not tell banks which clauses those systems must contain, and it does not create an enforceable universal requirement. For generative or agentic services, banks should nevertheless consider risk-based terms for information rights, testing cooperation, prompt and output handling, human approval, material-change notice, monitoring, incident response, and orderly exit. Label these as negotiated controls selected for the use case, not as mandates imposed by the model-risk bulletin.
Ask what the vendor can actually evidence
For any model or AI service, request documentation of intended use, limitations, data provenance, testing, known failure modes, performance by relevant population or scenario, and controls against unauthorized use. Require notice when the underlying model, training data, safety controls, or hosting arrangement changes materially. If evidence is unavailable, narrow the use, add independent testing or human review, or decline the arrangement.
Follow a disciplined negotiation and approval workflow
- Describe the use case: document decisions, users, data flows, integrations, automation level, and customer impact.
- Classify risk and criticality: apply the bank’s third-party, information-security, privacy, compliance, and model-risk frameworks.
- Perform diligence: review ownership and financial condition, expertise, controls, subcontractors, legal history, resilience, testing evidence, and concentration risk.
- Convert gaps into terms: turn each material risk into an obligation, information right, threshold, remedy, or compensating control.
- Resolve proprietary restrictions: decide whether available evidence is sufficient and obtain approval for residual risk.
- Review the contract: involve qualified counsel and the relevant risk owners; confirm precedence over vendor click-through terms.
- Approve and implement: complete access controls, data minimization, human-review procedures, monitoring dashboards, incident contacts, and an exit plan before production.
- Monitor throughout the relationship: review reports, changes, incidents, outcomes, subcontractors, and contract protections at a frequency proportional to risk.
Compare competing AI arrangements on risk, not marketing claims
| Comparison area | Questions for the bank | Evidence or contract protection |
|---|---|---|
| Data and access | What information enters the service, and can it change bank records or decisions? | Data schedule, purpose limits, access controls, deletion evidence |
| Criticality | What is the customer and compliance impact of an outage or wrong output? | Recovery objectives, human fallback, performance thresholds |
| Dependency | Which vendor, model, cloud, or subcontractor creates concentration? | Dependency inventory, notice rights, continuity and exit support |
| Transparency | Can the bank obtain timely information for validation and examination? | Documentation, audit rights, regulator access, usable reports |
| Security and compliance | Are controls tested, incidents reported, and deficiencies remediated? | Independent assessments, notification terms, corrective-action duties |
| Outcomes | Which measures show the service is accurate, reliable, and fair enough for its use? | Use-specific metrics, drift monitoring, testing and suspension rights |
| Exit | Can the bank retrieve data and move safely within the available time? | Export specifications, transition assistance, cost allocation, tested plan |
These comparison axes synthesize the agencies’ risk, information, performance, subcontractor, and termination considerations. They are not a regulatory scoring formula.
Keep the regulatory status straight in 2026
The 2023 interagency third-party guidance remains the central final guidance identified for this contract work and covers planning, diligence, negotiation, monitoring, and termination. On September 11, 2026, the agencies proposed replacing existing third-party risk guidance. The proposal emphasizes tailoring to assessed relationship risk and to the bank’s size, complexity, and risk profile, but it was still proposed as of October 13, 2026; the OCC listed comments due November 16, 2026. Do not describe proposed language as a current requirement.
Outsourcing does not reduce the bank’s responsibility. The agencies state in their 2023 guidance: “A banking organization’s use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house.” The exact legal duties for a particular bank, data category, state, or cross-border arrangement depend on the facts and applicable regulatory regime.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
