%20rotate(-180)'%20xlink:href='%23linear-gradient'%3e%3c/linearGradient%3e%3clinearGradient%20id='linear-gradient3'%20x1='841.45'%20y1='247.11'%20x2='3086.34'%20y2='247.11'%20gradientTransform='translate(4479.33%203591.33)%20rotate(-180)'%20xlink:href='%23linear-gradient'%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20id='Z'%3e%3cpath%20id='_x31_'%20fill='url(%23linear-gradient)'%20d='M2695.1,484.18c20.1,19.58,37.87,42.03,52.67,67.11,57.79,97.91,59.52,215.79,4.58,315.34l-992.94,1799.47h200.21c274.56,0,527.42-149.27,660.07-389.66l989.02-1792.26h-913.62Z'%3e%3c/path%3e%3cpath%20id='_x32_'%20fill='url(%23linear-gradient1)'%20d='M2674.21,823.5h0c84.15-152.48-26.15-339.33-200.31-339.33h-1275.39c-274.56,0-527.42,149.27-660.07,389.66l-80.32,145.55h2108l108.09-195.88Z'%3e%3c/path%3e%3cpath%20id='_x33_'%20fill='url(%23linear-gradient2)'%20d='M1400.9,3611.82c-20.1-19.58-37.87-42.03-52.67-67.11-57.79-97.91-59.52-215.79-4.58-315.34l992.94-1799.47h-200.21c-274.56,0-527.42,149.27-660.07,389.66l-989.02,1792.26h913.62Z'%3e%3c/path%3e%3cpath%20fill='url(%23linear-gradient3)'%20d='M1421.79,3272.5h0c-84.15,152.48,26.15,339.33,200.31,339.33h1275.39c274.56,0,527.42-149.27,660.07-389.66l80.32-145.55H1529.88l-108.09,195.88Z'%3e%3c/path%3e%3c/g%3e%3c/svg%3e)
The interagency third-party risk guidance was written to be technology-neutral, and examiners are now applying it exactly that way. If an AI model or its provider touches a banking process, it belongs in your vendor inventory and your risk-rating workflow. The novelty of the technology does not create an exception. It raises the bar.
The wrinkle with AI is the supply chain. A single customer-facing feature can ride on a model provider, a cloud host, and a software vendor that stitches them together. Those are three distinct relationships, and each has its own concentration, data-handling, and continuity profile.
The AI vendor layers
| Layer | Suggested tier |
|---|---|
| Model provider: the frontier-AI lab behind the underlying weights and API | Critical |
| Cloud / inference host: where the model runs and your data transits | Critical |
| Application vendor: the product that wraps the model into a workflow | Elevated |
| Fine-tuning / data partner: anyone who sees your data to adapt a model | Elevated |
One AI feature is rarely one vendor. It is a stack, and the guidance expects you to see all of it.
Adding AI to the inventory
You do not need a new framework. You need to run your existing third-party process across a category most inventories missed. Start with the AI you already use, including the tools that arrived inside other products.
- Discover the shadow AI. Inventory every model, embedded feature, and pilot, including the ones procurement never saw.
- Risk-rate the provider as well as the app. Push diligence through to the model and host underneath the product.
- Pin versions and log changes. Model snapshots shift between exams, so record which version is in production and when it moved.
- Map concentration. Flag where one provider sits under multiple critical processes. That is your single point of failure.
Zovos auto-discovers the AI and model providers already in your stack, tiers them against your criticality criteria, and keeps the version log current. You build the inventory once and it stays current.
This is for information only and is not legal advice. Confirm your obligations against the current guidance and counsel before acting.