Curated Insights is our knowledge hub for community banks and financial institutions. Here, we break down complex cybersecurity issues into clear, actionable guidance you can use.
Simplifying Your Cybersecurity Journey
Simplifying Your Cybersecurity Journey
Artificial intelligence is not a future consideration for community bank vendor programs. It is a present one.
Vendors that banks already rely on for core processing, fraud detection, customer service, and compliance support are incorporating AI into their products. In many cases, they have been doing so for years. The question is not whether AI is present in the vendor ecosystem. The question is whether the bank understands where it is, what it does, and what oversight is appropriate.
Regulators are asking those questions now.
Traditional third-party risk management focuses on data access, financial stability, operational resilience, and regulatory compliance. Those concerns still apply to AI-enabled vendors. But AI introduces additional considerations that standard due diligence frameworks were not designed to address.
AI systems make decisions. In some cases, those decisions affect customers directly, determining creditworthiness, flagging suspicious transactions, routing service inquiries, or generating communications. When a vendor’s AI system makes an error or behaves in an unexpected way, the bank may bear regulatory and reputational accountability for that outcome even if it had no direct control over the model.
This creates a category of third-party risk that is qualitatively different from traditional technology risk. The risk is not simply that the system goes down. The risk is that the system functions and produces outcomes the bank cannot explain or defend.
FFIEC guidance and interagency statements on AI have signaled consistent themes. Regulators expect banks to understand the AI tools in use within their vendor relationships. They expect documented assessment of model risk, explainability, and bias. They expect oversight to be proportional to the criticality of AI-driven decisions.
Community banks cannot disclaim responsibility for AI outputs on the grounds that the model belongs to a vendor. If a vendor’s AI is used to assist in credit decisions, fraud detection, or customer communication, the bank is expected to understand how it works, what its limitations are, and how it is monitored.
Examiners are beginning to probe vendor due diligence for AI-specific considerations. Banks that cannot produce documentation demonstrating awareness and proportional oversight are likely to face questions.
Most community banks have not updated their vendor due diligence frameworks to account for AI. The standard questionnaire asks about data handling, security controls, and business continuity. It does not ask how AI is used within the vendor’s product, how the vendor tests its models for accuracy and fairness, or what transparency is available to the bank regarding AI-driven outputs.
That gap leaves banks in a difficult position. They are using AI-enabled services without having formally assessed the AI risk those services carry.
Closing that gap requires updating intake processes and ongoing oversight frameworks to include AI-specific questions. It requires establishing what the bank needs to know about AI components before approvals are granted. And it requires documenting that process in a way that satisfies examiner expectations.
AI systems frequently rely on third-party data sources, training datasets, and infrastructure providers. A vendor’s AI model may be built on a foundation layer that introduces its own dependencies and vulnerabilities. This fourth-party dimension of AI risk is significant and largely undisclosed in standard vendor relationships.
Banks assessing AI risk need to ask vendors not only about their own practices but about the components underlying their AI systems. What data is the model trained on. Who provides the infrastructure. What controls exist if a dependency fails or is compromised.
These questions are difficult to answer. They are nonetheless appropriate to ask. Documented inquiry, even when answers are incomplete, demonstrates due diligence.
The pace of AI adoption in vendor products is faster than most vendor management frameworks have evolved to address. Static annual reviews are unlikely to capture material changes in how vendors are using AI within their product offerings.
Curated Cyber helps community banks build vendor oversight that accounts for AI-specific risk within the broader structure of a managed third-party risk program. Through Vendor Lifecycle Assurance, vendor assessments incorporate emerging risk categories alongside traditional due diligence criteria. Quarterly program audits and FFIEC compliance validation ensure that oversight evolves as the regulatory landscape evolves.
Community banks that are proactive about AI risk in their vendor programs do not need to be AI experts. They need to demonstrate awareness and proportional governance. That is an achievable standard, and it is the right one.
Regulatory attention to AI in banking is accelerating. Examiners who have been observing how institutions are responding to earlier guidance are moving toward more direct assessment of AI governance, including in third-party programs.
Community banks that address AI vendor risk now are building examination readiness rather than reacting to findings. The window to establish that posture proactively is open. It will not stay open indefinitely.
Third-party AI risk is not a technology problem. It is a governance problem. And governance is solvable
