AI Vendor Risk by Industry

Banking and financial services

An AI vendor assessment for banks should identify whether the service supports internal operations, customer service, fraud review, lending, or another decision process. For AI vendor risk for banks, record the system boundary, downstream providers, data exchanged, and the institution’s control over inputs and outputs. Ask:

• Could an output influence a customer outcome, account action, fraud escalation, or credit-related process?
• What evidence covers the specific AI feature, hosting environment, data flow, and service period?
• What human review, correction, fallback, logging, and change-notice procedures exist?
• How would the institution continue service, retrieve records, and revoke vendor access during an outage or exit?

The interagency third-party risk guidance is relevant to banking organizations within its scope; it is not an AI-specific classification or universal legal checklist. Ask the institution’s compliance and risk owners which requirements apply.

Healthcare and HIPAA questions

An AI vendor assessment for healthcare should distinguish clinical use from administrative or back-office use. Identify whether the system could influence diagnosis, treatment, access, scheduling, billing, or patient communications. For AI vendor risk for healthcare, ask how outputs are reviewed, corrected, logged, and escalated; which source data the system uses; and what happens when an output is missing or unreliable.

Map protected health information and other personal data through the application, model provider, logs, support tools, and backups. Where an organization subject to HIPAA engages a business associate to handle protected health information, HHS describes a written business-associate contract or arrangement as part of the applicable requirements. Determine whether the parties meet relevant definitions and whether a BAA is required for this service. A HIPAA AI vendor BAA question cannot be answered from the vendor’s industry label alone. See HHS guidance on covered entities and business associates.

Insurance

For AI vendor risk for insurance, identify whether the tool supports underwriting, claims, pricing, fraud review, customer service, or distribution, and specify the decision it may influence. Ask who can override the output, which data and proxies are used, how changes are reviewed, what evidence supports performance in the proposed context, and how complaints or corrections reach a human reviewer. Keep unknown answers visible; a general accuracy statement does not establish results for a particular population or decision.

The NAIC adopted a Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. A model bulletin is a reference for state insurance departments; check current law, bulletins, and guidance in the insurer’s jurisdictions before treating a provision as binding. See the NAIC AI topic page and its adoption notice.

Law firms and legal services

An AI vendor assessment for law firms should identify whether client information, privileged material, work product, or matter metadata may reach the vendor or its model providers. Ask whether inputs can be retained, reviewed by people, or used for model improvement; how access is restricted; and whether the firm can export and delete matter data at the end of the engagement. Review output verification, citation checking, client disclosure, and human responsibility for the work product.

Professional-conduct, privilege, confidentiality, and client-contract requirements depend on jurisdiction and matter facts. The responsible lawyer should check the applicable rules and client obligations. This guide does not map bar rules or establish that a deployment preserves privilege.

Small businesses

An AI vendor assessment small business review can begin with a short inventory: what the service does, who uses it, what data goes in, which systems it can access, and who owns the relationship. Prioritize evidence requests that could change the decision, such as training use, retention and deletion, administrator access, subprocessors, incident notice, and the exit path. Limit vendor access to what the task requires and document important security and data-handling expectations in the agreement.

The FTC’s Cybersecurity for Small Business guidance recommends assessing third-party risks and putting vendor security and data-handling expectations in writing. It is general small-business guidance, not an AI-specific rule.

State procurement and jurisdiction checks

For state AI procurement requirements, first identify the buyer, jurisdiction, procurement vehicle, system purpose, and affected population. Then check the current statutes, agency policies, solicitation terms, and contract requirements that apply to that procurement. Requirements can vary and change; this page does not provide a state-by-state legal inventory or assert a universal deadline. Record the official source reviewed, date, responsible reviewer, and unresolved questions.

Across sectors, use official sources as starting points, not as substitutes for scope review. The interagency guidance on third-party relationships concerns covered banking organizations and is not specific to AI. NIST SP 800-161 Rev. 1 Update 1 offers cybersecurity supply-chain guidance. NIST AI RMF 1.0 is voluntary risk-management guidance. Neither resource makes an industry-specific legal determination.

Worked hypothetical examples

Banking: A regional bank considers a vendor assistant that summarizes due-diligence documents for internal analysts. The vendor supplies a general assurance summary but does not identify whether the AI service and model subprocessor are within the reviewed boundary. The analyst records “AI feature scope: unknown,” assigns an evidence request to the vendor owner, and limits evaluation to synthetic documents while security and continuity reviewers confirm the scope.

Healthcare: A clinic considers a scheduling assistant that can see patient contact details but cannot recommend diagnosis or treatment. Reviewers confirm whether protected health information is involved, who can access logs and transcripts, whether a business-associate relationship applies, and how staff correct an erroneous message. Both examples are illustrative procurement workflows, not findings about real organizations or vendors.

Frequently asked questions

Does a healthcare-related vendor always need a BAA?

Not solely because it serves healthcare. Assess the parties, data, service, and applicable HIPAA definitions and requirements with the organization’s privacy or legal reviewer.

Does the interagency guidance set AI-specific bank requirements?

The guidance provides third-party risk-management context for banking organizations within its scope. It is not an AI-specific classification; confirm current applicable requirements with the institution’s reviewers.

Are the NAIC model bulletin and state rules the same thing?

No. Check the current law and guidance in the relevant jurisdictions; do not assume a model bulletin has been adopted or applies identically everywhere.

What should a small business review first?

Start with use, data, access, retention, training terms, subprocessors, incident handling, and exit. Assign an owner to each decision-relevant unknown.

Use the AI Vendor Assessment Questionnaire, the AI vendor evaluation guide, and the AI Vendor Monitoring and Tiering guide to document the decision.

Updated 2026-10-08. Sources are linked on this page.

DORA: AI third-party service review context

For a financial entity reviewing DORA: AI third-party dependencies, identify the ICT services, relevant functions and contractual arrangement before drawing conclusions about scope. An AI label alone does not establish whether an entity or arrangement is covered. The ESMA DORA overview describes the financial-sector digital operational-resilience framework and ICT third-party oversight. Qualified reviewers must assess applicability and the evidence for the actual arrangement; this worksheet does not make that determination.