HighVendor Risk◐Demonstrated
Third-party / value-chain model risk
Governance, Accountability & ComplianceDescription
Reliance on external model providers/APIs creates concentration, continuity, data, and accountability risk.
Example scenario
A sole-provider outage or policy change disrupts the bank's customer service overnight.
Real-world evidence◐Demonstrated
Repeated industry surveys and regulatory reviews (BIS, FSB, IMF) document that most financial institution boards lack sufficient AI literacy and accountability structures, and some supervisory findings have cited this gap, but formal enforcement actions naming board-level AI accountability failure as the primary violation are not yet widespread.
Primary mitigations
- Vendor due diligence
- contractual data/no-train & SLA terms
- exit/continuity plans
- multi-provider strategy
- value-chain mapping.
Detection signals
Vendor-risk scoring; dependency mapping; SLA breach monitoring.
Mitigating controls
4 Non-agentic controls