AI scoping records
Where is AI embedded in vendor products?
Check the AI features inside existing products before treating an old vendor review as current.
What examiners look for
The Work Program asks what the institution has done to identify embedded AI and what vendors have disclosed. Relevant sources include due diligence, questionnaires, product records, contract disclosures and updates. AI may appear as a feature in a familiar platform. A renewal or release can therefore raise a new question without adding a new vendor.
CSBS Examiner Work Program, initial scoping 5. Checked October 16, 2026.
Which records answer the question
- Keep the list of products with known or possible embedded AI.
- Attach vendor oversight records to the feature being assessed.
- Retain the relevant terms on data handling and training.
- Link a feature announcement to the related change-management record.
Where the answer directs review
A Yes can point to AI Inventory and Use Cases, plus Third-Party and Vendor Review. Unknown or unclear embedded AI also warrants attention to the vendor review route. An unanswered question should remain visible. Absence of a disclosure is different from evidence that a feature has no AI capability.
Core Examiner Guide, page 3. Checked October 16, 2026.
Two gaps to check
The proposal describes a new assistant but leaves its default setting unclear. Ask whether the feature is active, what can activate it and who can turn it off. Do not treat the ability to buy a feature as evidence about its current operating state.
A disclosure changed after the vendor was approved. Retain both versions and identify the earlier questions that depend on the old wording. Ask for clarification where the change affects data use, access, training, output handling or exit.
How to prepare the record
Start with one feature and the decision on the calendar. Compare the prior and current disclosures beside the actual use. Identify exact source locations and assign questions to the vendor owner. Keep the response, reviewer reasoning and proposed conditions together. A text difference is a candidate for review; a person still needs to decide what the change means.
A row behind the question
Illustrative inputs, not a client.
| Use | Where it runs | Data it can touch | Owner | Evidence on hand | Question still open |
|---|---|---|---|---|---|
| Vendor assistant within an existing platform | Vendor's hosted service | Not yet described | Product owner not yet named | Feature proposal | Is the feature on by default, and can the institution turn it off? |
What the reviewer should retain
A useful result names the change, its possible effect and the next evidence required. The institution may allow a bounded use, narrow the scope or defer the feature. Keep any later decision linked to its source versions. A new vendor statement can reopen a previously answered question without erasing the earlier record.
Prepare the next step
Review generative tools next when the feature creates text, images, summaries or other content.