Recommended Free Tools
Assess an external AI service for the specific job it will do, not by vendor reputation or a generic security score. Map its data, users, decisions, dependencies and failure impact; scale diligence to that risk; secure oversight and exit rights in the contract; and monitor the service throughout the relationship. A financial institution remains responsible for its own safe and sound operations and compliance when it uses a third party.
How do I assess third-party AI risk?
Use a lifecycle assessment: planning, due diligence, contracting, ongoing monitoring, and termination or transition. Begin before selecting a provider, and revisit the assessment when the use, service, provider chain or risk changes. The US interagency guidance frames third-party oversight this way and says a banking organization’s use of a third party does not diminish its responsibility to meet applicable requirements as if the work were performed in-house. Federal Reserve Board, FDIC and OCC interagency guidance
As an Amazon Associate I earn from qualifying purchases.
There is no universal score or certification that establishes that an AI service is safe for every financial institution or use. Set the depth of review using your institution’s criteria, the service’s role, the data and people affected, and the consequences of failure.
1. Define the use and map the service
Document the proposed use before reviewing vendor materials. Identify the business owner, the process the AI supports, whether it interacts with customers or influences regulated decisions, what data it receives and generates, and which internal systems it can access. Record who operates each part of the service and where human review or other controls sit in the workflow.
#1 Best Overall
Map material subcontractors and dependencies, including relevant cloud, data and model providers. Estimate what would happen if the service were wrong, unavailable, degraded or compromised: consider operational disruption, compliance exposure, customer harm and financial loss. Include whether the activity is critical and how easily it could be substituted or brought in-house.
2. Tier the risk and set the review depth
Apply the institution’s own impact and risk criteria rather than assigning an unexamined label such as “low risk” because a vendor offers a standard product. Factors that can warrant deeper diligence, senior oversight, testing and monitoring include:
- Business criticality, scale and transaction volume.
- Access to sensitive or confidential information, and the data’s location or reuse.
- Customer interaction, potential consumer harm, or influence over decisions.
- Limited substitutability, concentration in a provider or infrastructure, and complex subcontracting or cross-border arrangements.
- The institution’s ability to detect, challenge and contain erroneous or unavailable outputs.
The Financial Stability Board’s toolkit is designed as flexible, risk-based support for identifying critical third-party services and managing relationships across their lifecycle; it complements rather than replaces local standards. FSB third-party risk toolkit
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Author: Orrin Woodward.
- Pages: 123
- Publication Date: 2021
- Edition: 3rd
- Binding: Hardcover
What should a bank ask an AI vendor?
Ask for evidence about the service and configuration the institution actually intends to use. A security questionnaire is only one part of diligence. The interagency guidance’s broader factors include strategy, legal and regulatory compliance, financial condition, experience, personnel, governance, information security and systems, and operational resilience.
- Legal standing and compliance: Who owns and controls the provider? What legal authority or licenses are relevant to the service? How does it address sanctions exposure, applicable compliance obligations and regulatory issues?
- Financial and delivery capacity: Can the provider sustain the service? Ask about financial condition, relevant delivery experience, staffing, key-person dependencies, service capacity and continuity arrangements.
- Governance and assurance: Who is accountable for controls, risk decisions, escalation and remediation? Request relevant audit or independent testing evidence, and check whether a SOC report or certification actually covers the service, locations, systems and controls under review.
- Security and data handling: How are confidentiality, integrity and availability protected? Ask about access controls, encryption, development practices, vulnerability management, incident response, data retention and deletion, and the systems and infrastructure used to deliver the service.
- AI behavior and limitations: What evidence describes the service’s intended use, limitations, testing, monitoring and material changes? Ask how the provider identifies and communicates behavior that could affect the institution’s use. Marketing claims or a general certification do not establish suitability for a particular application.
- Resilience and dependency: What recovery arrangements exist, and when were they tested? Which subcontractors and service locations are material? What alternatives are feasible if the provider or an underlying dependency fails?
For evidence supplied by a consortium or an outside assessor, determine whether its scope and conclusions fit the institution’s service, configuration and risk. The interagency guidance says supplemental diligence does not remove the institution’s own responsibility to assess relevance to its circumstances.
How should the contract preserve oversight and control?
Negotiate provisions that reflect the assessed risk and applicable jurisdiction; a contract should make oversight practical, not merely promise good intentions. Cover service and performance obligations, accountable contacts and escalation routes, and access to relevant records, audit evidence and information needed for oversight.
- Set notification expectations for incidents, material service changes and changes to subcontractors or dependencies.
- Specify data handling and security responsibilities, subcontractor transparency and appropriate controls over subcontracting.
- Address continuity, recovery, complaints where the provider interacts with customers, and cooperation with applicable regulatory access or information needs.
- Define remediation responsibilities and how unresolved control or performance issues are escalated.
- Make transition and exit assistance workable. Plan for migration to another provider, bringing the activity in-house, or discontinuing it, including data return or deletion and continuity during transition.
Contract terms cannot substitute for operating controls. Before signing, identify who inside the institution will use access rights, review evidence and enforce escalation or termination provisions.
How do you monitor an AI vendor after onboarding?
Assign an internal owner, a review cadence proportionate to risk, measurable thresholds, escalation routes and remediation deadlines. Monitoring should reflect changes over time, not simply repeat onboarding checks once a year. For higher-risk activities, consider more frequent or continuous monitoring and direct testing where warranted.
Track the signals relevant to the service, including performance against service and control obligations, audit findings, financial deterioration, security events, data loss, outages, compliance issues, personnel or subcontractor changes, resilience test results, emerging threats, customer complaints and material service changes. Establish in advance which conditions require a corrective plan, tighter controls, suspension or exit.
Test whether the institution can detect and manage the consequences of faulty or unavailable outputs in its own workflow. Reassess when the AI’s role expands, data or system access changes, a provider updates the service materially, or a dependency becomes more concentrated. Keep records of findings, decisions, exceptions and remediation so that owners and senior oversight can see whether residual risk remains acceptable.
How to compare vendors, internal systems and hybrid options
When credible alternatives exist, compare them against the same use-specific criteria rather than treating vendor size, a certification or a single model-performance claim as decisive.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Comparison area | What to compare |
|---|---|
| Use and impact | Business criticality, interruption impact, customer interaction and potential harm. |
| Data and access | Sensitivity, access scope, location and reuse of data. |
| Evidence and controls | Validation and monitoring evidence for the actual application, plus security, resilience and incident response. |
| Provider chain | Visibility into subcontracting, concentration and dependencies. |
| Continuity and exit | Performance against service and control obligations, portability, substitutability and practical exit cost. |
Apply the same criteria to external, internal and hybrid delivery. An internal build may change the dependency profile, but it does not remove the need to evaluate the service’s data, controls, operational impact and ability to recover.
Best Value
Which regulatory guidance applies?
Requirements depend on institution type, activity and jurisdiction. Use official guidance to frame the assessment, then confirm the obligations that apply to the institution and the particular arrangement.
- United States—third-party relationships: The Federal Reserve Board, FDIC and OCC interagency guidance sets out risk-based principles for planning, due diligence, contracting, monitoring and termination. Its applicability depends on institution type and supervisory context. Read the interagency guidance.
- United States—model risk: OCC Bulletin 2026-13 describes revised interagency model-risk principles, including validation and consideration of vendor or other third-party products. It expressly excludes generative and agentic AI models from scope and says the guidance is not prescriptive or an enforceable standard. It is expected to be most useful for banks with more than $30 billion in assets, though smaller banks with significant model-risk exposure may also find it relevant; it should not be treated as a rule for every AI system or financial institution. OCC Bulletin 2026-13.
- International third-party risk: The FSB’s December 2023 toolkit supports risk-based identification of critical services, lifecycle relationship management and monitoring systemic dependencies. It complements, rather than supersedes, relevant local standards and guidance. FSB toolkit.
- AI governance: The FSB published a consultation report in June 2026 proposing 12 sound practices for organization-wide AI governance and lifecycle management, with board and senior-management considerations. The consultation deadline for comments was 22 July 2026. Treat the practices as proposals in that consultation, not binding requirements, and check for subsequent official developments. FSB AI consultation report.
- European Union—third-party risk: On 18 September 2026, the EBA announced final guidelines focused on arrangements supporting critical or important functions and covering the relationship lifecycle. At the time of the EBA announcement, the guidelines were awaiting translation and were not yet applicable, with a two-year transition period. Check the current official status and the institution’s applicable DORA and sectoral obligations before treating the guidelines as operative. EBA announcement.
These sources describe frameworks and guidance, not a single approval test for AI vendors. A sound assessment connects the institution’s actual use to evidence, enforceable oversight and a credible response if the service or its dependencies fail.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
