Third-party AI and vendor risk: due diligence, contracts and exit plans
Manage third-party AI like any material outsourcing, plus three AI-specific checks: understand the vendor model's design, data and limitations; monitor its outputs because code is rarely available; and track concentration, since many processes may depend on one foundation model. Contracts should ban training on your data, require notice of model changes, and give audit and exit rights.
SR 26-2 is explicit that vendor models remain subject to model risk management, and MAS expects institutions to limit, suspend or replace third-party AI when risk cannot be brought within appetite.
What should AI vendor due diligence ask?
- What model or models power the product, and which provider hosts them?
- What data was the model trained on, and will our data be used for training?
- What testing evidence, limitations and known failure modes can you share?
- How will you notify us of model or version changes, and how far ahead?
- Where is our data processed and stored, and for how long?
- What happens to our data and service if we exit?
Which contract clauses matter most?
| Clause | Purpose |
|---|---|
| No training on customer data | Protects confidentiality and privacy |
| Change and deprecation notice | Prevents silent output changes |
| Information and audit rights | Supports validation and oversight |
| Incident notification | Speeds response to AI failures and breaches |
| Data location, retention and deletion | Privacy and regulatory compliance |
| Exit assistance and data return | Makes substitution realistic |
How do we measure AI concentration risk?
Map every material use case to its model provider and cloud platform, then report how many depend on each. MAS lists the number of material AI use cases dependent on a single provider as an example risk appetite measure.
Primary sources (reviewed 17 Oct 2026)
- Federal Reserve, FDIC and OCC: SR 23-4, Interagency Guidance on Third-Party Relationships: Risk Management (June 2023)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Regulation (EU) 2022/2554, Digital Operational Resilience Act (DORA)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
Does using a vendor model transfer model risk?
No. Under SR 26-2 and the MAS guidelines, the institution remains responsible and should validate and monitor vendor models.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.