Questions for a vendor adding AI

Confirm how the feature starts.

Ask whether the feature is on by default, who enables it, and who can disable it. Ask which existing entitlements and terms cover the feature. A sales proposal may leave these fields open.

Trace the data route.

Ask which data the feature can access, whether training use is permitted, which providers receive it, and how retention and deletion work. Request the relevant source and version for each answer.

Prepare the institution review.

Keep unanswered terms beside the proposed use. Assign the vendor follow-up and the internal reviewer separately. A declared vendor statement remains supplied until a reviewer inspects and evaluates the supporting evidence.

Sources and applicability.

CSBS AI Supervisory Framework. Source checked October 5, 2026. States decide how to use this framework for state-chartered banks and nonbanks; it creates no new legal obligations.

NCUA AI resources apply to the credit-union route. National banks should use their OCC supervisory route.

A review prepares a file. It does not certify compliance, give a legal opinion or connect to a core.

Inspect the review file.

Read a complete illustrative engagement. See the two-week inventory review.

Send the review question.

Tell us the decision, deadline and accountable role. A person will reply within one business day.