Written by: Rob Ellis, Senior Compliance Consultant, CRA & Fair Lending Specialist
Your Vendors Are Using AI Too
Most institutions think of AI as something they buy or build. The more common reality is that AI arrived through the back door — inside products and services they already purchased.
A core processor adds a model. A LOS vendor layers in decision support. A marketing platform starts generating content. A QC tool starts flagging files on its own. The institution did not choose AI. It inherited it.
Examiners ask whether the institution relies on third parties, vendors, or external platforms for AI capabilities — and whether anyone at the institution knows it.
The uncomfortable answer for many shops: the vendor knows. The institution does not.
This is not a hypothetical. Investor rules already require seller/servicers to oversee vendor use of AI to a standard no less protective than their own. If your vendor's AI is doing something your own policy would not allow, that is your problem, not theirs.
Vendor due diligence used to mean security and uptime. It now has to mean data use, training rights, model behavior, and the ability to restrict or halt a tool that is acting on your customers.
If your vendor management file does not mention AI anywhere, that file is incomplete — and you may not be the only one who has noticed.
The AI Hiding in Your Vendor Contracts
There is a difference between a vendor offering AI and AI being embedded in a product you already use.
The first is visible. You saw the demo. You read the proposal. The second is invisible — a feature that appeared in a routine update, a capability that was always there but never labeled, a subcontractor's model running under someone else's brand.
Examiners specifically ask whether institutions have tried to identify where AI is embedded in third-party products and services — and what those vendors actually disclosed.
Here is what we find when we look: the disclosure is usually thin. "We use machine learning to improve our service" tells you nothing about what data goes in, whether it is retained, or whether it trains someone else's model. The contract was signed before AI was a category anyone negotiated over.
So the institution is left with a product it cannot fully describe a vendor that will not fully describe it, and an examiner who will ask anyway.
The question is not whether your vendors use AI. They do. The question is whether you know enough about it to defend the relationship.
If you have never asked a vendor directly about AI — in writing, with the answer in your file — that conversation is overdue. Reach out to us today!
