Quick answer: A completed vendor questionnaire describes a point in time. If a vendor later adds AI, evaluate what actually changed: purpose, information access, outputs, subcontractors, controls, or customer impact. Agree on notification, review ownership, and escalation before a change gets buried in release notes.

Watch the video

AI Nightmares, Episode 1: employee and vendor AI use

Related discussion with Stacy

Watch on YouTube if the player does not load.

I asked what happens when a third-party vendor starts using AI after the institution has completed its diligence. The important question is not how many questions the original form contained. It is whether the relationship has a way to recognize and evaluate change.

A new feature may change more than a label

AI can enter a familiar product as a drafting assistant, a support feature, an analytical capability, or a workflow component. Ask what it does in this service. A cosmetic label change is different from new access to information or a new automated action.

Agree on what needs to be surfaced

  • New purposes for customer or institutional information.
  • New data recipients, processors, or relevant subcontractors.
  • New outputs used in an operational or customer-facing workflow.
  • Changes to permissions, retention, logging, or review controls.
  • A new dependency that affects continuity or the ability to exit.

Use the institution’s own risk assessment to decide which changes are material and how much review they need. This list is a practical discussion aid, not a universal legal threshold.

Connect notifications to an owner

A release note is useful only if somebody knows to read it and can route the issue. Ask who receives notices, which changes require further questions, and who can pause the affected use while those questions are answered. Where relevant, discuss change-notification and information obligations through the bank’s normal contract-review process.

Review employee use as well as vendor features

I also asked about employees using AI themselves. Maintain a separate view of approved employee tools and use cases. An institution can have a clear vendor process while remaining uncertain about where staff are supplying information to other services.

Illustrative exercise: Choose a vendor that recently added an AI feature. Record the change, the affected activity, the information involved, the people reviewing it, and the decision about continued use. An “AI added” label without those details is too broad to act on.

The 2024 community-bank guide includes ongoing monitoring as part of the relationship life cycle. That is the background principle for this article’s change-review approach.

Guidance context, October 12, 2026: The agencies’ 2023 third-party relationship guidance and 2024 community-bank guide are the background for this discussion. In September 2026, the agencies issued proposed revisions; the OCC describes those revisions as proposed, with application when final. Do not treat a proposal, this article, or a vendor checklist as a binding rule.

Frequently asked questions

Does every AI feature require a complete restart of diligence?

Do not assume that. Determine what changed and use the institution’s risk assessment and review process to choose the appropriate response.

What if AI is only mentioned in release notes?

Identify who tracks product changes, ask the vendor for the specific use and data flow, and route the answer to the person accountable for the relationship.

Is a long questionnaire enough?

The number of questions does not prove continuing coverage. Check whether changed activities and dependencies can be discovered, reviewed, and assigned to an owner.

Sources

Continue the conversation

For help translating your product and sales process into a bank-ready decision, explore working with Stacy. For ongoing practical guidance, subscribe to Selling Fintech.

Adapted from Stacy Bishop’s original posts and newsletter with AI-assisted editing. Cover portraits were generated from Stacy’s reference photographs. Illustrative exercises are labeled.