Third-Party Risk Management for AI Model Providers

Regulatory references verified as of October 31, 2026.

Every AI model a bank rents is a third-party relationship. An API to a frontier model provider and a model inside a licensed SaaS tool both belong in its third-party risk management program, the first directly and the second through the SaaS vendor, scaled to what the model touches. The provider's attestations describe the provider. The institution's own records show which model handled a given request, under which policy, and who approved the action.

The framework is also in motion. In September 2026, the OCC, the Federal Reserve, the FDIC and the NCUA proposed guidance that would replace the 2023 interagency guidance on third-party relationships. Comments close November 16, 2026. The proposal does not mention artificial intelligence. In April, revised model risk guidance, SR 26-2, placed generative and agentic AI outside its own scope. For the generative and agentic AI a bank rents, third-party risk management is the remaining framework, and the proposal reaches AI only by inference.

Why a rented model is a third-party relationship

The 2023 interagency guidance covers "any business arrangement" between a banking organization and another entity, "by contract or otherwise." It adds: "A third-party relationship may exist despite a lack of a contract or remuneration." A free-tier assistant, a browser extension, or an AI feature a vendor switched on inside a tool the bank already licenses can all qualify. The shadow AI guide covers how those arrive. The hybrid AI estate guide maps the rest of the estate.

AI reaches a bank three ways:

• Direct. The bank contracts with a model provider and calls its API.
• Embedded. A SaaS vendor builds a model into its product. The model provider is the vendor's subcontractor.
• Orchestrated. An agent platform calls several models and tools on the bank's behalf, often choosing among them per request. The AI agent governance guide covers agents.

The embedded case is the hardest of the three to see. The 2026 proposal says "the use of subcontractors alone does not typically create an independent third-party relationship." It describes oversight through the contract with the direct vendor, or through a review of that vendor's own third-party program. That works when the subcontractor chain is fixed at signing. AI services often route each request among several model providers by cost, availability or content, and the route can change without a contract amendment. Due diligence done at onboarding describes the relationship on the day it was signed.

The lifecycle, applied to an AI model provider

The 2023 guidance organizes third-party risk management into five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. The 2026 proposal regroups them. The work starts with identifying third-party relationships and assessing their risk. Due diligence, contract negotiation, ongoing monitoring and termination sit under risk oversight. Residual risk acceptance and governance follow. The questions for an AI model provider are the same under either structure.

Risk tiering decides how much of this each relationship needs. A model summarizing public filings is a lower-risk relationship than one that reads customer records or initiates payments. The OCC's bulletin on the proposal describes prioritizing "based on the magnitude and likelihood of potential harm," and "avoiding overly process-driven strategies that treat all third-party relationships as inherently higher-risk." Approval can run as a per-team list of permitted models and data classes, checked on every call; the model allowlist entry shows the pattern.

Five questions to ask an AI model provider

1. Which model and version will answer our requests, and how will we know when that changes? Providers update models on their own schedule. A version change can shift behavior on a workload the bank already validated. The model drift entry separates provider drift from data drift.
2. Where is our data processed and stored, how long is it kept, and is it used for training? The answers set which data classes the model may receive.
3. Which subcontractors and other model providers sit behind the service, and can routing change without notice? Ask every SaaS vendor that embeds a model, along with every provider the bank contracts with directly.
4. What records do we receive for our own requests? Ask for the model, version, timestamps, policy decisions and incidents tied to the bank's traffic, and the format they arrive in.
5. What happens at deprecation or termination? Ask for the notice period, the export path for data and configuration, and the support offered during the transition.

Concentration risk and exit plans

A footnote in the proposal notes that a banking organization can be exposed to concentration risk from a third party. For termination, the proposal says a banking organization "may benefit from advanced planning." Its section on operational resilience names "the existence of alternative back-up providers" as one consideration. The 2023 guidance lists "options for an effective transition of services, such as potential alternate third parties to perform the activity," alongside the time frame for a transition and the handling of data retention and destruction.

Two events from this year show why model providers belong in that analysis:

• On June 3, 2026, OpenAI notified developers that Agent Builder is being deprecated, with shutdown scheduled for November 30, 2026. Its deprecations page states that at shutdown, "the model or endpoint will no longer be accessible." The same page lists the August 2025 snapshot of GPT-5 for shutdown on December 11, 2026.
• On June 12, 2026, Anthropic said the U.S. government, citing national security authorities, had issued an export control directive to suspend all access to two frontier models, Fable 5 and Mythos 5, by any foreign national, and that it was disabling both models for all customers to comply. Anthropic said access would begin returning on July 1, after the Department of Commerce removed its export controls.

Neither event was the customer's decision. An exit plan for a rented model names an approved alternative for each workload, tests it before it is needed, and keeps the institution's records with the institution. A later guide in this series covers concentration and exit in depth.

Keep the evidence inside your walls

The proposal lets ongoing monitoring draw on "audits conducted by the third party (or an independent entity hired by the third party)," on "a periodic or continuous basis." Audit reports and attestations describe the counterparty: its controls, its certifications, its incident history. They cannot show which of the bank's requests reached which model, what data went with them, or who approved what came back.

A record that answers an examiner's questions about an AI-assisted decision carries these fields:

• The person or agent that made the request, and the person whose authority an agent was using
• The model, version and provider that answered, and where it ran
• The policy applied, and what it allowed, redacted or stopped
• The data classes in the request and in the response
• Any tool calls the model triggered
• The named human who approved a high-risk action, with a timestamp

That record has to live in the institution's own log, under its own retention rules. A provider's console shows the provider's view of its traffic, and access to it ends with the contract. Whether full prompts are also retained depends on the institution's own recordkeeping obligations. The supervision evidence checklist and the examination readiness page show how those records map to what examiners ask for.

Where model risk guidance fits

SR 26-2, issued April 17, 2026 by the Federal Reserve, the OCC and the FDIC, superseded SR 11-7 and SR 21-8. Section VII, "Vendor and Other Third-Party Products," acknowledges that banking organizations "may not receive from the vendor the underlying code, data, or methodology." It treats validation of vendor products, by internal or outside parties, as an important element of model risk management, along with ongoing monitoring and outcome analysis.

Footnote 3 sets the boundary: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." It adds that a banking organization's "risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."

A vendor's credit scoring model, a traditional statistical model, falls under Section VII. A rented large language model or agent falls to the institution's own governance practices, and its provider still goes through the third-party program like any other vendor. The SR 11-7 and SR 26-2 entry has the background. Broker-dealers carry a further, enforceable obligation under FINRA Rule 3110, covered in the FINRA 3110 guide.

What the proposal changes

The OCC, the Federal Reserve Board, the FDIC and the NCUA published the proposal at 91 FR 58536 on September 15, 2026. "Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources." The proposal states that it "does not set forth enforceable standards or prescriptive requirements," and the OCC's bulletin adds that "non-compliance with the guidance will not result in supervisory action against a banking organization."

The responsibility stays where it was. The proposal states that the banking organization "remains responsible for complying with applicable laws and regulations, and operating in a safe and sound manner, regardless of a third party's use of subcontractors." Examiners will still ask how the institution oversees the AI it rents. Risk-based tailoring rewards the institution that can see its relationships: a bank can tier only the AI relationships it has identified, and the embedded ones are the easiest to miss.

Comments close November 16, 2026. Each agency takes comments under its own identifier: OCC-2026-0793 at the OCC, Docket No. OP-1881 at the Federal Reserve, ZRIN 3064-ZA58 at the FDIC and NCUA-2026-1684 at the NCUA. APERION filed a comment letter on October 14. Its first recommendation asks for one sentence stating that AI services are covered on the same risk-based terms as any other third-party relationship.

How APERION approaches it

Owned intelligence, governed from the first call. Enterprises will rent some intelligence and own more of it. Do not let the model provider become the architecture.

Every model a bank rents is a vendor relationship, and every model it owns needs the same identity, policy and evidence. APERION governs both from one control point inside the institution's own walls, so the policy, the evidence and the choice of model stay with the institution. Global policy. Local enforcement. Portable evidence.

The Trust Fabric has four layers: verified identity, access governance, runtime governance, and audit and evidence. Enforcement generates the evidence: the record of what was permitted, what was attempted and who decided is written as the system runs, inside the institution's environment. When an agent exceeds the authority delegated to it, the action goes back to the person who owns that authority, and that person decides.

A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.

Frequently asked questions

Is an AI model provider a third party under the interagency guidance?

Yes. The 2023 interagency guidance covers any business arrangement between a banking organization and another entity, by contract or otherwise, and says a relationship can exist without a contract or payment. A model provider the bank calls directly is a third party. A model inside a SaaS tool is typically overseen through the contract with the SaaS vendor or through a review of that vendor's own oversight of its subcontractors, as the 2026 proposal describes.

Does SR 26-2 cover generative AI vendors?

No. Footnote 3 of SR 26-2 states that generative AI and agentic AI models are not within the scope of the guidance, and it points banking organizations to their own risk management and governance practices for tools and systems the guidance does not cover. Section VII still applies to traditional vendor models, including validation and ongoing monitoring. A rented large language model's provider goes through the third-party risk program.

What should a contract with an AI model provider cover?

Notice of model, version and subcontractor changes; data use, retention and training restrictions; incident notification; audit rights; the records the bank receives about its own traffic; deprecation timelines; and termination assistance, including data export. The 2023 guidance also describes contracts that define performance measures and provide for periodic, independent audits of the third party.

Is the model behind a SaaS tool a separate third-party relationship?

Usually not on its own. The 2026 proposal says the use of subcontractors alone does not typically create an independent third-party relationship, and it describes oversight through contract terms or a review of the vendor's own program. The risk is that the model behind a SaaS feature can change, or change per request, without any amendment to the bank's contract.

When do comments on the proposed third-party guidance close?

November 16, 2026. The OCC, the Federal Reserve, the FDIC and the NCUA published the proposal at 91 FR 58536 on September 15, 2026. Each agency takes comments under its own identifier: OCC-2026-0793, Docket No. OP-1881 at the Federal Reserve, ZRIN 3064-ZA58 at the FDIC and NCUA-2026-1684. Any final version would replace the 2023 guidance and its supplemental resources.

What evidence should a bank keep for AI requests?

For each request: who made it, and on whose authority an agent acted; the model, version and provider that answered; the policy applied and its outcome; the data classes sent and returned; any tool calls; and the named person who approved a high-risk action. The bank keeps that record in its own log, under its own retention rules, rather than relying on the provider's console.

Sources

Each opened October 18, 2026. The comment deadline, SR 26-2 and the OpenAI deprecations page were rechecked October 31, 2026.

• OCC, Federal Reserve Board, FDIC and NCUA, Proposed Third-Party Risk Management Guidance, 91 FR 58536 (September 15, 2026). Comments due November 16, 2026.
• OCC, Bulletin 2026-46, Third-Party Risk Management: Proposed Guidance and Request for Comment (September 11, 2026), and the proposed guidance text.
• Federal Reserve, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023), and OCC Bulletin 2023-17 (June 6, 2023).
• Federal Reserve, OCC and FDIC, SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026), Section VII and footnote 3.
• OpenAI, Deprecations: Agent Builder, notice June 3, 2026, shutdown November 30, 2026; gpt-5-2025-08-07, notice June 11, 2026, shutdown December 11, 2026.
• Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5 (June 12, 2026), and Al Jazeera, US lifts restrictions on Anthropic's powerful AI models Fable and Mythos (July 1, 2026).