Do we need a separate due diligence process for AI vendors?

No. Add AI-specific questions to the third-party risk process you already run. The 2023 interagency guidance on third-party relationships is risk-based and covers AI vendors the same way it covers any other service provider; what changes is the questions you ask. Federal agencies proposed replacement guidance in September 2026, and it is also risk-based.

What should an AI vendor contract include?

At minimum: whether your data may be used to train the vendor's models, data retention and deletion terms, notice before material changes to the AI or its underlying model, audit and testing rights, incident notification, and where your data is processed. Many community institutions have limited negotiating power, so prioritize the data-use and change-notice terms.

Does this apply to credit unions?

The 2023 interagency guidance was issued by the Federal Reserve, FDIC, and OCC, so credit unions currently follow NCUA's own third-party expectations. NCUA joined the September 2026 proposal to replace that guidance, so this may change if the proposal is finalized. The questions in this guide apply either way. GAO has also reported that NCUA lacks authority to examine technology service providers, which puts more of the diligence burden on the credit union itself.

What if an existing vendor turns on an AI feature?

Treat it as a change to the relationship. Ask the vendor the same core questions, record the feature in your AI use case inventory, and decide whether it changes the risk rating of the relationship.

Guide · Vendor Control · Vendor management, IT, and compliance

AI vendor due diligence: the questions to ask before you sign

The questions a community bank or credit union should put to any vendor selling AI, mapped to the third-party risk life cycle you already run.

At many community banks and credit unions, AI does not arrive as a project. It arrives in a vendor's release notes, inside a renewal, or attached to a demo that looks very good. Which makes vendor due diligence the place where most of your AI risk is actually decided.

You do not need a new process. The Interagency TPRM Guidance from the Federal Reserve, FDIC, and OCC (June 2023) organizes third-party risk management around a five-stage life cycle — planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination — and expects oversight to be commensurate with your size, complexity, and the risk of the relationship.

In September 2026 those agencies and NCUA proposed guidance that would rescind and replace it, with comments due November 16, 2026. The proposal keeps due diligence, contract negotiation, ongoing monitoring, and termination, and puts more weight on tailoring oversight to each relationship's risk and on deciding when residual risk is acceptable. The questions below work under either version. AI vendors fit that structure. What they need is better questions.

Planning: decide what you are buying

Before the demo, write down in one paragraph what the AI will do, what data it will touch, and whether it informs a person or acts on its own. That paragraph sets the risk tier and becomes the entry in your AI use case inventory. If no one can write it, you are not ready to evaluate a vendor.

Due diligence: the core questions

Send these in writing and keep the answers.

What the AI does

Which features in the product use AI or machine learning, and what does each one do?
Is the AI built by you, or does it rely on a third-party model provider? Which one?
Does the AI make or recommend decisions about customers or members?

Your data

What of our data does the AI process, and where is it processed and stored?
Is our data, or data derived from it, used to train or improve your models or anyone else's? Can we opt out in the contract?
How long are inputs and outputs retained, and how are they deleted?
Who at your company, or at your model provider, can see our data?

Accuracy, testing, and change

How do you test the AI's accuracy and reliability, and how often?
What known limitations or failure modes should our staff know about?
How will you notify us before changing the AI or its underlying model?
If the AI is used in credit decisions, how do you support the specific reasons required for adverse action notices and fair lending testing?

Oversight and incidents

Can we see output logs and audit trails for our use?
Can a person review or override every AI output before it takes effect?
How do you notify us of an incident involving the AI or our data?
What independent assessments — SOC reports, penetration tests, model validations — can you share?

Contract negotiation: the terms that matter most

The 2023 guidance recognizes that a banking organization may have limited negotiating power, and the September 2026 proposal goes further, discussing when residual risk can be accepted if terms cannot be negotiated. Spend the leverage you have where it counts:

No training on your data without your written consent.
Advance notice of material changes to AI functionality or the underlying model.
Retention and deletion terms for inputs, outputs, and logs.
Audit and testing rights, or at least the right to receive the vendor's own testing results.
Incident notification that explicitly covers AI-related failures.

Ongoing monitoring

Assign a business owner who reads release notes and tracks complaints and errors tied to the AI. A reasonable default is to review high-risk AI vendors at least annually, and whenever the vendor changes the model or adds a feature. Each change gets a line in the inventory.

Termination

Know before you sign how you get your data back, how the vendor deletes it — including from any model provider it used — and how you would run the process without the AI if you had to.

A note for credit unions

The 2023 interagency guidance applies to banks; credit unions follow NCUA's third-party expectations, though NCUA joined the 2026 proposal. The questions above work under either. One difference raises the stakes: GAO reported in 2025 that NCUA lacks the authority to examine technology service providers. Because NCUA cannot examine the vendor directly, your own diligence file carries more of the weight.

Common questions

Do we need a separate due diligence process for AI vendors?: No. Add AI-specific questions to the third-party risk process you already run. The 2023 interagency guidance on third-party relationships is risk-based and covers AI vendors the same way it covers any other service provider; what changes is the questions you ask. Federal agencies proposed replacement guidance in September 2026, and it is also risk-based.
What should an AI vendor contract include?: At minimum: whether your data may be used to train the vendor's models, data retention and deletion terms, notice before material changes to the AI or its underlying model, audit and testing rights, incident notification, and where your data is processed. Many community institutions have limited negotiating power, so prioritize the data-use and change-notice terms.
Does this apply to credit unions?: The 2023 interagency guidance was issued by the Federal Reserve, FDIC, and OCC, so credit unions currently follow NCUA's own third-party expectations. NCUA joined the September 2026 proposal to replace that guidance, so this may change if the proposal is finalized. The questions in this guide apply either way. GAO has also reported that NCUA lacks authority to examine technology service providers, which puts more of the diligence burden on the credit union itself.
What if an existing vendor turns on an AI feature?: Treat it as a change to the relationship. Ask the vendor the same core questions, record the feature in your AI use case inventory, and decide whether it changes the risk rating of the relationship.