AI vendor risk for banks: the 2023 guidance, the 2026 proposal and DORA

In the Bank of England and Financial Conduct Authority survey published on 21 November 2024, "A third of all AI use cases are third-party implementations" [9], meaning AI that a vendor builds or supplies. The providers are concentrated: "The top three third-party providers account for 73%, 44%, and 33% of all reported cloud, model, and data providers respectively" [9]. The top three model providers' share was 18% in 2022 [9]. And 46% of firms said they had only partial understanding of the AI they use [9].

For a bank, buying AI is a vendor decision under rules written for all vendors. This page covers those rules in the United States and the EU, as of 26 October 2026, and what they mean for an AI product. It is part of the guide on AI in banking. The US documents below are guidance, and the EU regulation is law. A bank should confirm with its own counsel and examiners which apply to it.

The 2023 US guidance: responsibility stays with the bank

The Board of Governors of the Federal Reserve System (the Fed), the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC) published the Interagency Guidance on Third-Party Relationships: Risk Management on 9 June 2023 [1]. Its starting point: "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house" [1]. If an AI vendor's model gives customers wrong answers, the bank still has to meet its legal duties to those customers.

The guidance describes a life cycle: "Effective third-party risk management generally follows a continuous life cycle for third-party relationships" [1]. The stages are planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination [1]. Due diligence means the checks a bank makes before it signs.

By this guide's count of its lettered headings, the guidance lists 14 due diligence factors and 17 contract factors [1]. Three points from it apply to AI:

• Check each new product. "Relying solely on experience with or prior knowledge of a third party is not an adequate proxy for performing appropriate due diligence" [1]. A bank that already uses a vendor's core banking system, the system that runs its accounts, still has to check that vendor's new AI product.
• Record what the vendor will not share. "it is important for the banking organization to identify and document any limitations of its due diligence" [1]. When an AI vendor keeps its model details private, this is the step that records the gap.
• Settle data ownership in the contract. "Provisions that indicate whether any data generated by the third party become the banking organization's property help avert misunderstandings" [1]. For AI, that covers model outputs and logs. Contracts also generally include "provisions for periodic, independent audits of the third party and its relevant subcontractors" [1].

The AI vendor question list for banks turns the factors into 22 questions.

The 2026 proposal to replace it

On 15 September 2026 the OCC, the Fed, the FDIC and the National Credit Union Administration (NCUA) published proposed third-party risk management guidance. They wrote: "The agencies plan to rescind and replace existing guidance on third-party risk management" [2]. "Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources" [2], which include the community bank guide. TPRM stands for third-party risk management.

The agencies give their reason: "the agencies believe the 2023 Guidance frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles" [2]. The proposal would also cover insured credit unions [2]. It is organised under four headings: risk identification and assessment; risk oversight, which holds due diligence, contract negotiation, ongoing monitoring and termination; "Residual Risk Acceptance"; and governance [2]. Residual risk is the risk left after controls.

Document	Date	Status as of 26 October 2026	Kind
Interagency Guidance on Third-Party Relationships, 88 FR 37920	9 June 2023	In effect; proposed for replacement [1][2]	Guidance
Third-Party Relationships: A Guide for Community Banks (OCC Bulletin 2024-11)	3 May 2024	In effect; voluntary; would be replaced if the proposal is finalised [3][2]	Guidance
Proposed Third-Party Risk Management Guidance, 91 FR 58536	15 September 2026	Comments due 16 November 2026 [2]	Proposed guidance
SR 26-7, Joint Statement on Community Banks' Engagement with Core Service Providers	5 October 2026	Issued [4]	Guidance
Digital Operational Resilience Act, Regulation (EU) 2022/2554	Applies from 17 January 2025	In force; no amending act found [6]	EU law
European Banking Authority (EBA) Guidelines on outsourcing arrangements (2019)	2019	Still apply; to be repealed when the new guidelines apply [7]	EU guidelines
EBA final report on third-party risk guidelines (non-technology services)	18 September 2026	Application date not yet set [7][8]	EU guidelines

The community bank guide of 3 May 2024 says "Use of the guide is voluntary" [3]. On 5 October 2026 the Fed also circulated a "Joint Statement on Community Banks' Engagement with Core Service Providers" as SR 26-7, a supervision and regulation letter [4]. A core service provider runs a bank's main account and transaction systems.

A proposal can change before it is final. A bank should keep following the 2023 guidance, and can comment on the proposal until 16 November 2026.

Vendor models under the 2026 model risk guidance

The revised model risk guidance of 17 April 2026 has its own section on vendor products. It accepts a limit: banks "may not receive from the vendor the underlying code, data, or methodology that they would have if a model were developed internally. Nevertheless, the principles of model risk management remain applicable" [5]. It adds that "An important element of model risk management is the validation of vendor products, either by internal or outside parties" [5], and that sound practice includes developing an understanding of the "vendor model, including its conceptual soundness, design, development data, and performance" [5]. Conceptual soundness means the model's design and logic fit its purpose.

The guidance excludes generative and agentic AI from its scope [5]. A vendor's chatbot or writing assistant is therefore outside it, and the bank's own governance decides the controls. The page model risk rules and AI explains the split.

The US information security guidelines add a contract duty for any vendor with access to customer information: a bank must "Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines" [11]. The page customer data privacy and AI in banking covers those guidelines.

The vendor's own vendors

An AI product can be built on other companies' models and cloud services. The US Treasury reported in March 2024 that firms "noted that some of the capabilities they use are supplied by a fourth-party provider or product" [10]. A fourth party is a vendor's own supplier. The Treasury also expects data integrity and data provenance, which means knowing where data came from and whether it was changed, to become important concerns in third-party risk management [10].

For a bank, that means asking each AI vendor which model maker and which cloud service the product uses, and whether the vendor may change them. A change of model inside a product can change its answers, so the contract should require notice before such a change.

The EU: DORA and the EBA guidelines

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, says "It shall apply from 17 January 2025" [6]. It covers information and communication technology (ICT) services, which in this guide's reading include AI services bought from a technology vendor. Its main vendor rules:

• The firm "shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation" [6].
• It must keep "a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers" [6], and "report at least yearly to the competent authorities on the number of new arrangements" [6].
• Contracts must state "the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location", and must require the vendor to tell the firm in advance if it plans to change those locations [6].
• For critical or important functions, contracts must give "unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority" [6], and set out "exit strategies, in particular the establishment of a mandatory adequate transition period" [6].

This guide found no act amending DORA in the EU's metadata on 26 October 2026.

The European Banking Authority (EBA) covers vendors that DORA does not. Its page says: "The Guidelines on the sound management of third-party risk related to non-ICT services, once applicable, will repeal the Guidelines on outsourcing arrangements" [7]. The final report was published on 18 September 2026, and its application date is still blank [7]. The EBA says "A two-year transitional period will support a smooth and proportionate implementation" [8]. ICT services stay under DORA.

What to ask an AI vendor for

Reveneau's view is that the most useful item to ask an AI vendor for is its test record. An eval is a written, repeatable test of an AI system's answers against chosen cases. Ask for the vendor's eval results on the tasks the bank will use the product for, and for the right to run the bank's own evals on the product before signing and after each change to the underlying model. That gives the bank the "performance" part of the understanding the model risk guidance asks for [5], even when the vendor keeps its code private. The post how to evaluate a vendor's eval suite covers how to judge one.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release. A bank should put the questions on this page to Reveneau as to any vendor. To discuss a project, see Reveneau's services or contact Reveneau.