AI VENDOR AND THIRD PARTY REVIEW

One vendor, six questions, and the file the answers belong in.

One AI vendor, six questions in writing, a signed decision record. The smallest engagement here to approve, and a natural first purchase for third party risk.

Request an AI Vendor Review The six questions

At a glance

Unit: One AI vendor, or a standing intake
Fee and duration: In writing, before you sign

Use it when

A vendor in your file switched on an AI feature.
An AI product is at contract stage, and your questionnaire skips models, training data and model changes.
A counterparty or supervisor asked how you oversee vendor AI.

Six questions, answered in writing

The six vendor questions
Question	Why it matters	A good answer names
Which model, run by whom?	Often another firm's model, never contracted by you	Model, provider, hosting
Input data: kept? Trained on?	Separate settings	Retention, training off by default or by contract, what deletion deletes
Where, and which subprocessors?	Your fourth parties; lists change without a renewal	Current list, regions, change notice
Commitment on change?	Models swap overnight	Advance notice, lead time, prior version kept
Accuracy, monitoring, failure, in writing?	A demonstration is not a commitment	Measures, response, notice when wrong rather than down
What can you turn off, how fast?	The control that still works	The setting, its holder, what breaks

Asked identically every time, so answers compare.

The record's seven fields: the six questions; the vendor's written answers; evidence, or its absence; the rating and its basis; accept, limit or replace; the named decision maker; the review date.

What each answer satisfies

By buyer type
The answer	A bank	An insurance licensee	A nonbank mortgage company
Model and operator	Due diligence	Third party oversight	Service provider selection, 314.4(f)
Input data and training	Due diligence and contracting	Written information security program	Contractual safeguards, 314.4(f)
Geography and subprocessors	Due diligence and ongoing monitoring	Third party AI systems and data	Periodic assessment, 314.4(f)
Commitment on change	Contracting and ongoing monitoring	Board overseen AI systems program	Periodic assessment, 314.4(f)
Accuracy, monitoring and failure	Ongoing monitoring	Governance and controls	Contractual safeguards, 314.4(f)
What you can turn off	Termination	Incident response plan	Written security program

Reach of each instrument
Instrument	Why it matters here	Who it reaches, and who it does not
Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920	Its life cycle, and the FFIEC acquisition booklet of August 2024.	Reaches Every bank the OCC, Federal Reserve and FDIC supervise, no asset size threshold. Status Guidance, not a rule. Not Credit unions; NCUA is not a party.
NCUA 12 CFR Part 748, Appendix A	A credit union's vendor duty runs here instead.	Reaches Every federally insured credit union, no asset size exemption. Vendors Appendix A, III.D, with 07-CU-13 and Supervisory Letter 07-01. Not Banks.
NAIC Insurance Data Security Model Law, Model #668	Vendor oversight sits inside the written program.	Reaches Licensees, only where a state enacted it; the enacted text governs. Clock 72 hours to the commissioner from determining a cybersecurity event occurred, where the state is domicile or home state, or 250 or more of its consumers are involved and a further notice or harm test is met. Exempt Under 10 employees, contractors included, among others, from the written program only. Not Licensees in a state that has not enacted it.
NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers	It names third party AI systems.	Reaches Insurers in a state whose department adopted it, with that state's variations. Status Guidance, not statute. Not Insurers in a state that has not adopted it. Whether it reaches producers, managing general agents or third party administrators is a state question.
FTC Safeguards Rule, 16 CFR 314.4(f)	Applies regardless of consumer count.	Requires Service provider selection, contracts and periodic assessment, 314.4(f), at any consumer count; 314.6 does not remove them. Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions.
Freddie Mac Guide Section 1302.8 and Fannie Mae LL-2026-04	Both govern vendor AI.	Requires Freddie Mac Guide 1302.8, from 3 March 2026, and Fannie Mae LL-2026-04, from 6 August 2026, require a Seller/Servicer using AI or machine learning in origination or servicing to hold a written governance framework for it. Reaches Any size, through the contract. Not Anyone outside either contract.

This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.

A vendor that will not answer in writing has answered.

A decline or a marketing page is recorded beside the questions: the date, who was asked, what came back.

An unanswered question and an unasked question look identical in a file a year later, unless somebody wrote down which it was.

Reading a SOC 2

SOC 2

Read four things first:

Scope: Often excludes the system the AI feature runs on.
User entity controls: Hand named duties back to you.
Testing exceptions: Where the risk sits.
Bridge letter: Not an opinion.

An attestation report by an independent CPA firm on a service organization's own selected controls, against the AICPA Trust Services Criteria (2017 criteria, 2022 points of focus). Not a certification, and not a regulatory requirement.

Required by nobody, and voluntary throughout; counterparties demand it by contract. Its presence in a vendor file does not by itself discharge a bank's duty under the interagency guidance, an insurance licensee's third party oversight duty, or a mortgage company's obligation at 16 CFR 314.4(f). Whether we hold one: Trust and Assurance.

Read the AICPA page that defines it

Terms to pursue at renewal

A finding without a contract change leaves the risk in place.

Notice of material model change, on a stated period and a shared definition
Written data terms: training, retention, deletion
Subprocessor disclosure and a right to object
Evidence rights sized to the tier: usually current evidence, not auditors
A response time for your examiner
Deletion and return at exit, derived data included
Incident notice inside your own clock
Portability, fallback, continuity and exit terms

Five steps, one vendor at a time

Name the vendor, feature, data and decision; the fee in writing.
Questions go out in writing, dated, to a named person.
We rate the answers against your obligations, noting missing evidence.
You decide, with terms to pursue and a review date.
The file. The record goes where your vendor records already go, reviewed and signed off.

We need the contract, file evidence, a vendor contact, your relationship owner and decider.

Where we stop

Red Stick Solutions does not negotiate your vendor agreements and does not advise on their legal effect. Your contracting people decide what to pursue.

Approval of a vendor is a decision about the evidence on the day; it does not guarantee future performance, and the record says when it is next reviewed.

Before you sign

Before you sign
Question	Answer
Proof of compliance	No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant.
Something urgent	We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began.
If it stops	You keep everything produced to that point, in the form it is in that day.
Which vendors go first?	Those touching a customer decision or holding nonpublic information.

The list itself: the AI Governance Assessment. Every quarter after: the AI Governance Program.

Name the first vendor and we will start there.

Tell us the vendor, what it reaches, and what sets the date.

Unit: One AI vendor, or a standing intake drawn against a block of hours
Fee: Fixed against this scope, in writing, in the first conversation, before you sign or grant access.
Duration: Elapsed time and your team's hours, in writing, with the fee.
A changed scope: Requoted, showing which change moved the number.
A number that proves wrong: You hear the day we know.

The commitment in full is on Trust and Assurance.

Request an AI Vendor Review