AI scoping records
Which AI capabilities come from vendors?
Identify the outside providers that an AI use depends on, including services your institution does not own.
What examiners look for
The Work Program includes hosted models, vendor tools, external platforms and AI services. Daily dependence matters even when another firm owns the model. A bank may buy one product while relying on several providers behind it. Keep the business use connected to the relevant relationship and the service being relied on.
CSBS Examiner Work Program, initial scoping 4. Checked October 16, 2026.
Which records answer the question
- Use the vendor-product list and AI inventory together.
- Keep oversight materials for the service that supports the use.
- Identify contract terms addressing data use and AI training.
- Retain service updates that change the service agreement or capability.
Where the answer directs review
A Yes can lead to Third-Party and Vendor Review through existing supervisory resources. The scoping answer identifies a review route; it is not a finding that a provider is suitable. Distinguish your team's own review from the provider's statements. A general assurance document may not cover the specific AI feature.
Core Examiner Guide, page 3. Checked October 16, 2026.
Two gaps to check
The vendor register lists the primary supplier but says nothing about the model service behind the feature. Ask what providers process the inputs and outputs. Record unanswered questions about subcontractors rather than inventing a complete processing chain.
The review relies on a broad security report from a different product or period. Check the document's scope, version and stated limits. Ask for evidence tied to that service before using the report to answer the AI question.
How to prepare the record
Collect the relevant product description, agreement, disclosure and current use description. Compare what each source says about data, access, training and exit. Keep blank or conflicting terms visible. Assign a vendor manager to seek the missing material and a reviewer role to assess the response. A returned reference is evidence to inspect, not automatic closure.
A row behind the question
Illustrative inputs, not a client.
| Use | Where it runs | Data it can touch | Owner | Evidence on hand | Question still open |
|---|---|---|---|---|---|
| AI feature purchased through a platform | Provider service with upstream model | Data categories still under review | Vendor manager role | Agreement and feature disclosure | Which providers can receive the input, and under what terms? |
What the reviewer should retain
The retained file should show what the bank or credit union relies on and why the available records do or do not answer its question. The output can enter the existing vendor-risk process. Keep the institution's acceptance conditions separate. A provider change or new data route can reopen an earlier conclusion.
Prepare the next step
Examine embedded features next, especially where a vendor has not described the AI feature clearly.