Quick answer: AI can help perform a risk-management task and also be something the institution needs to evaluate. Separate those two roles. A tool producing a vendor-risk summary does not by itself establish that its own data access, outputs, dependencies, and permitted use have been assessed.

Watch the video

AI Nightmares, Episode 1: Stacy, Steve and Shanee discuss AI use and risk

Related discussion with Stacy

Watch on YouTube if the player does not load.

In my conversation with Steve Bishop, I distinguished AI used in risk processes from AI becoming the subject of those processes. That distinction matters because the same tool can occupy both roles.

First ask what work AI is doing

Is it summarizing documents, organizing an evidence package, drafting questions, or supporting an employee’s analysis? Describe the actual task. Do not infer that a tool is making a decision because its marketing says it automates a workflow.

Then ask what needs evaluation

For the same use case, identify what information the tool can access, what an output can influence, which services it relies on, and what a person must review. An AI-generated summary may omit a qualification or combine information incorrectly. The operating question is who checks the evidence before the summary is used.

  • Input: what information enters the process?
  • Output: what is produced, and where does it go?
  • Influence: does it support a decision or trigger an action?
  • Review: who can catch and correct a mistake?
  • Dependency: which organizations or components support the service?
  • Change: what new feature or use would trigger another assessment?

Keep efficiency and confidence separate

A faster review process is useful only if the institution understands its limits. Record where the tool assists the reviewer and where a qualified person remains responsible. Avoid turning a fluent answer into an approval receipt.

Make the two roles visible in the workflow

Illustrative example: A team uses AI to draft questions about a vendor. The questions help its diligence work. Separately, the team documents the AI tool’s approved information sources, the way it stores interactions, and the person who reviews generated questions. The first activity uses AI; the second evaluates that use.

The community-bank third-party risk guide is a useful background resource for relationship management. Applying a lifecycle lens to this AI workflow is the analysis in this article, not a claim that the guide supplies a specific AI certification.

Guidance context, October 12, 2026: The agencies’ 2023 third-party relationship guidance and 2024 community-bank guide are the background for this discussion. In September 2026, the agencies issued proposed revisions; the OCC describes those revisions as proposed, with application when final. Do not treat a proposal, this article, or a vendor checklist as a binding rule.

Frequently asked questions

Can one AI tool be both a helper and a risk subject?

Yes. Its assistance with a task and the evaluation of its own use are separate questions.

Does a completed AI summary prove vendor diligence is complete?

No. The institution must determine whether the relevant evidence and review steps are complete. A summary is an input to that assessment.

Who should own the distinction?

Name an operational owner for the use case and involve the institution’s relevant security, risk, and other reviewers according to the task and its impact.

Sources

Continue the conversation

For help translating your product and sales process into a bank-ready decision, explore working with Stacy. For ongoing practical guidance, subscribe to Selling Fintech.

Adapted from Stacy Bishop’s original posts and newsletter with AI-assisted editing. Cover portraits were generated from Stacy’s reference photographs. Illustrative exercises are labeled.