AI in banking: how a bank uses AI under the rules it answers to / Checklist

Checklist

AI vendor question list for banks: 22 questions to ask before you sign

This printable list gives 22 questions a bank can put to an AI vendor before it signs, grouped by data, suppliers and audits, exit, the model, security, and records. Each question names the rule or guidance that makes it relevant: the 2023 US Interagency Guidance on Third-Party Relationships, the 2026 model risk guidance, the information security guidelines, Regulation P, Regulation B, the EU's DORA or the EU AI Act. The 2023 guidance has a proposed replacement, and the list still applies, because the proposal keeps due diligence, contracts, monitoring and termination. Statuses are as of 26 October 2026.

Published October 26, 2026. Editorial.

Key takeaways

Ask every AI vendor whether the bank's data will train any model, how long it is kept, and where it is processed and stored, and put the answers in the contract.
Ask which model makers and cloud services the product depends on, and require notice before the vendor changes the model the bank uses.
For credit decisions in the United States, ask whether the product can give the principal reasons that actually drove each decision, as Regulation B requires.
For EU credit scoring, ask for the instructions and information the bank needs for its AI Act duties, which apply from 2 December 2027.
When a vendor will not answer, record the gap and how the bank will manage it, as the 2023 US guidance asks.

This list is for a bank's procurement, risk and technology teams to use with an AI vendor before signing. Print it or save it as a PDF, and send it with the request for proposal. It is part of the guide on AI in banking, and the reasoning behind the questions is on the page AI vendor risk for banks.

Each question names its basis: the rule or guidance that makes it relevant. Items marked US apply to US banks. Items marked EU apply to firms under the EU's Digital Operational Resilience Act (DORA) or the AI Act. Use it alongside the bank's own policy, and confirm with the bank's counsel and examiners which rules apply.

The Interagency Guidance on Third-Party Relationships of 9 June 2023 is the main US basis for this list [1]. On 15 September 2026 the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (the Fed), the Federal Deposit Insurance Corporation (FDIC) and the National Credit Union Administration (NCUA) proposed to replace it, with comments due 16 November 2026 [2]. The questions stay useful either way, because the proposal keeps due diligence, contract negotiation, ongoing monitoring and termination as steps [2].

The 22 questions at a glance

#	Question	Basis
1	Will our data train any model?	US information security guidelines [5]; Regulation P [6]
2	What do you keep, for how long, and can we have zero retention?	2023 guidance, contract factor on retaining information [1]
3	Where is our data processed and stored?	DORA Article 30(2)(b) [3]
4	Who owns the data and outputs you generate for us?	2023 guidance, contract factor on ownership [1]
5	Which suppliers does your service depend on?	2023 guidance [1]; DORA [3]; Treasury [11]
6	What audit reports will you give us, and can we audit you?	2023 guidance [1]; DORA Article 30(3)(e) [3]
7	Will you cooperate with our regulators?	DORA [3]; 2023 guidance [1]
8	Will you help us in an incident, at a cost set in advance?	DORA [3]; 2023 guidance [1]
9	What happens when we leave?	DORA Article 30(3)(f) [3]; 2023 guidance [1]
10	Can you give us what we need to validate the model?	2026 model risk guidance [4]
11	What performance data will you give us?	2026 model risk guidance [4]
12	Will you tell us before you change the model?	DORA [3]; 2026 model risk guidance [4]
13	Can the product give the principal reasons for each credit denial?	Regulation B [7][8]
14	Will you give us what we need for our AI Act duties?	AI Act Articles 26 and 27 [9]; amended Article 25(4) [10]
15	What explanation methods do you support, and are they validated?	AI Act Article 86 [9]
16	What security program do you run, and what tests can we see?	US information security guidelines [5]; 2023 guidance [1]
17	How do you keep the service running?	2023 guidance [1]; DORA [3]
18	Can you show financial statements and insurance?	2023 guidance [1]
19	Who owns you, and do any sanctions apply?	2023 guidance [1]
20	Will you give us what our DORA register needs?	DORA Article 28(3) [3]
21	How do you test for bias, and on what data?	AI Act Article 4a [10]; Regulation B [7]
22	What will you not share?	2023 guidance [1]

Data

1. Training use. Will our prompts, outputs or files be used to train or improve your models or anyone else's? Get the answer in the contract. The US information security guidelines require a bank to bind its service providers "by contract to implement appropriate measures designed to meet the objectives of these Guidelines" [5]. Regulation P's service provider exception requires a contract that "prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information" [6]. Large vendors state their defaults on their own pages, compared on customer data privacy and AI in banking.

2. Retention. What do you store, for how long, and can we have zero retention, meaning nothing is kept after the answer is returned? The 2023 guidance lists "Responsibilities for Providing, Receiving, and Retaining Information" among its contract factors [1].

3. Location (EU). In which regions or countries is our data processed and stored, and will you tell us before that changes? DORA requires contracts to state "the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location" [3]. ICT means information and communication technology.

4. Data ownership. Who owns the data and outputs you generate for us, including logs? The 2023 guidance says "Provisions that indicate whether any data generated by the third party become the banking organization's property help avert misunderstandings" [1].

Suppliers, audits and incidents

5. Subcontractors and fourth parties. Which other providers, such as model makers and cloud services, does your service depend on, and may you add more? The 2023 guidance has a due diligence factor on "Reliance on Subcontractors" and a contract factor on "Subcontracting" [1]. The US Treasury reported in March 2024 that firms said some capabilities they use "are supplied by a fourth-party provider or product" [11]. A fourth party is a vendor's own supplier.

6. Audit rights. What audit reports will you give us, and can we or our regulator audit you? The 2023 guidance says a contract generally "includes provisions for periodic, independent audits of the third party and its relevant subcontractors" [1]. For critical or important functions, DORA requires "unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority" [3].

7. Cooperation with supervisors. Will you cooperate fully with our regulators? DORA requires it in contracts, and the 2023 guidance has a contract factor on "Regulatory Supervision" [1][3].

8. Incident help. Will you help us at no extra cost, or at a cost set in advance, when an incident affects your service? DORA requires this in contracts, and the 2023 guidance has a due diligence factor on "Incident Reporting and Management Processes" [1][3].

Exit

9. Exit. What is the transition period if we leave, and how do we get our data back in a format we can use? For critical or important functions, DORA requires "exit strategies, in particular the establishment of a mandatory adequate transition period" [3]. The 2023 guidance has a contract factor on "Default and Termination" [1].

The model

10. Model understanding. Can you give us enough about the model's design, the data it was built on and its performance for us to validate it? The 2026 model risk guidance says sound practice includes understanding the "vendor model, including its conceptual soundness, design, development data, and performance" [4], and that validation of vendor products, "either by internal or outside parties", is important [4].

11. Monitoring data. What performance data and outcome reports will you provide, so we can monitor the model and compare its outputs with real results? The 2026 guidance describes outcomes analysis, which "compares model outputs to corresponding real-world outcomes" [4].

12. Change notice. Will you tell us before you change or retire the model version we use? The 2026 guidance says "Using a model beyond its intended purpose introduces additional uncertainty and risk" [4], and a changed model is a model the bank has not tested. For critical or important functions, DORA also requires contracts to include notice of any development that might have a material effect on the vendor's ability to provide the service [3].

13. Adverse action reasons (US credit). If your model is used for credit decisions, can it produce the principal reasons that actually drove each decision? Regulation B says reasons "must be specific and indicate the principal reason(s) for the adverse action" [7], and its official interpretation says they must "accurately describe the factors actually considered or scored" [8]. Adverse action means a denial or another unfavourable decision on a credit application.

14. EU high-risk documentation (EU credit). For credit scoring or life and health insurance pricing in the EU, will you supply the instructions for use and the information we need for our impact assessments and human oversight? The AI Act requires deployers to use high-risk systems "in accordance with the instructions for use" [9], and to use the provider's information for their data protection impact assessment [9]. The amended Article 25(4) requires component suppliers and providers to agree "by written agreement" on the information and access the provider needs [10]. These duties apply from 2 December 2027 [10].

15. Explainability. What explanation methods does the product support, and have you checked that the explanations match what the model did? Under the AI Act, a person affected by a decision based on an Annex III high-risk system has a right to "clear and meaningful explanations of the role of the AI system in the decision-making procedure" [9].

Security, resilience and standing

16. Security. What information security program do you run, and what tests and results can we review? The US guidelines say a bank "should review audits, summaries of test results, or other equivalent evaluations of its service providers" where risk calls for it [5]. The 2023 guidance has a due diligence factor on "Information Security" [1].

17. Operational resilience. How do you keep the service running, and do you test your business continuity plans? The 2023 guidance has a factor on "Operational Resilience" [1]. For critical or important functions, DORA requires the vendor to implement and test business contingency plans [3].

18. Financial condition and insurance. Can you show financial statements and insurance coverage? These are the 2023 guidance's due diligence factors "Financial Condition" and "Insurance Coverage" [1].

19. Legal and sanctions checks. Who owns you, and do any sanctions apply to you or your owners? This falls under the 2023 guidance's factor "Legal and Regulatory Compliance" [1].

Records

20. Register details (EU). Will you provide what we need for our DORA register of information? DORA requires "a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers" [3].

21. Bias testing. How do you test for bias, and on what data? Under the amended AI Act, providers of high-risk systems "may exceptionally process special categories of personal data" to detect and correct bias, under conditions [10]. In the United States, a Consumer Financial Protection Bureau (CFPB) rule effective 21 July 2026 removed the effects test from Regulation B and is being challenged in court, so a bank should ask its counsel how to state the US position [7]. The page AI in credit decisions and fair lending explains it.

22. Information you cannot share. If you will not share something, say what, so we can record the limit and plan around it. The 2023 guidance says "it is important for the banking organization to identify and document any limitations of its due diligence" [1].

The 2023 guidance's factors, for reference

By this guide's count of the lettered headings, the 2023 guidance lists 14 due diligence factors: strategies and goals; legal and regulatory compliance; financial condition; business experience; qualifications and backgrounds of key personnel and other human resources; risk management; information security; management of information systems; operational resilience; incident reporting and management processes; physical security; reliance on subcontractors; insurance coverage; and contractual arrangements with other parties [1].

It lists 17 contract factors: nature and scope of arrangement; performance measures or benchmarks; responsibilities for providing, receiving and retaining information; the right to audit and require remediation; responsibility for compliance with applicable laws and regulations; costs and compensation; ownership and license; confidentiality and integrity; operational resilience and business continuity; indemnification and limits on liability; insurance; dispute resolution; customer complaints; subcontracting; foreign-based third parties; default and termination; and regulatory supervision [1].

A question to add: can the bank run its own evals?

Reveneau's view is that one question belongs on every list: may the bank run its own evals on the product, before signing and after every model change? An eval is a written, repeatable test of an AI system's answers against cases the bank chooses. A vendor that agrees gives the bank evidence of performance that does not depend on the vendor's own report. The posts how to evaluate a vendor's eval suite and asking an AI vendor for time to production cover these checks.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. A bank can send this list to Reveneau as to any vendor. To discuss a project, see Reveneau's services or contact Reveneau.

Common questions

What should a bank ask an AI vendor about training on its data?

A bank should ask an AI vendor whether its prompts, outputs or files will be used to train or improve the vendor's models or anyone else's, and put the answer in the contract. The US information security guidelines require contracts that protect customer information, and Regulation P's service provider exception requires a contract limiting the vendor's use to the bank's purpose.

Who owns the outputs an AI vendor generates for a bank?

The contract decides who owns the outputs an AI vendor generates for a bank. The 2023 Interagency Guidance on Third-Party Relationships lists ownership and license as a contract factor, and says provisions on whether data generated by the third party become the bank's property help avoid misunderstandings. A bank should name model outputs and logs in that clause.

Can a bank audit its AI vendor?

A bank can audit its AI vendor if the contract gives it the right. The 2023 interagency guidance says a contract generally provides for periodic, independent audits of the third party and its relevant subcontractors. Under DORA, contracts for critical or important functions must give the firm, an appointed third party and the supervisor unrestricted rights of access, inspection and audit.

What should a bank ask about leaving an AI vendor?

A bank should ask an AI vendor what the transition period is if the bank leaves, and how it gets its data back in a format it can use. DORA requires exit strategies with a mandatory adequate transition period for critical or important functions, and the 2023 US guidance lists default and termination as a contract factor.

What model information should a bank get from an AI vendor?

A bank should get enough information about a vendor's model to understand its conceptual soundness, design, development data and performance, the four items the 2026 US model risk guidance names as sound practice. The guidance accepts that a vendor may not share its code, data or method, and still expects validation of vendor products by internal or outside parties.

Should an AI vendor notify a bank before changing its model?

An AI vendor should notify a bank before changing or retiring the model version the bank uses, and the bank should require it in the contract. The 2026 US model risk guidance says using a model beyond its intended purpose adds uncertainty and risk, and a changed model is one the bank has not tested. For critical or important functions, DORA also requires notice of developments with a material effect.

What should a bank ask a vendor whose model makes credit decisions?

A bank should ask a vendor whose model makes credit decisions whether the product can produce the principal reasons that actually drove each decision. Regulation B at 12 CFR 1002.9 requires specific principal reasons for adverse action, and its official interpretation says they must accurately describe the factors actually considered or scored, whatever model is used.

What should an EU bank ask a credit scoring AI vendor?

An EU bank should ask a credit scoring AI vendor for the instructions for use and the information it needs for its fundamental rights and data protection impact assessments and for human oversight. The AI Act's high-risk duties for credit scoring apply from 2 December 2027, after Regulation (EU) 2026/1744 moved the date, and the amended Article 25(4) requires written agreements with component suppliers.

What should a bank do when an AI vendor refuses to answer a question?

A bank should record what the AI vendor would not share and how the bank will manage the gap. The 2023 Interagency Guidance on Third-Party Relationships says it is important for a bank to identify and document any limitations of its due diligence. The record shows examiners that the bank saw the gap and made a decision about it.

How many due diligence factors are in the 2023 third-party guidance?

The 2023 Interagency Guidance on Third-Party Relationships lists 14 due diligence factors and 17 contract factors, by this guide's count of its lettered headings. The due diligence factors run from strategies and goals to contractual arrangements with other parties. The contract factors run from nature and scope of the arrangement to regulatory supervision.

Does the AI vendor question list still apply if the 2023 guidance is replaced?

The AI vendor question list still applies if the 2023 guidance is replaced. The proposal of 15 September 2026 keeps due diligence, contract negotiation, ongoing monitoring and termination as steps under its risk oversight heading. Comments are due on 16 November 2026, and the 2023 guidance applies until a final version replaces it. Each question also cites other rules.