Third-Party Due Diligence for AI Vendors: A Proportionate Approach for Small Providers

What proportionality means in the guidance

The final interagency guidance on third-party relationships, published in June 2023, sets out the agencies' views on sound risk management across all stages of the third-party life cycle. It does not suggest that every relationship needs the same level or type of oversight, because relationships carry different levels of risk. A banking organization analyzes the risks of each relationship and adjusts its practices commensurate with its own size, complexity and risk profile and with the nature of its third-party relationships. Ongoing monitoring follows the same logic.

The practical consequence for AI vendors is that a vendor's size is not the tiering variable. A five-person startup with access to sensitive data can warrant more scrutiny than a large provider supporting a low-risk internal task. The guidance also describes its examples of considerations as illustrative, not requirements, so teams have room to define what proportionate means in their own program and document the reasoning.

The guidance does not prescribe AI-specific or small-vendor evidence expectations. The tiering criteria and evidence substitutions below are practitioner judgment applied within its risk-based framing.

Tier small AI vendors by risk and criticality

Start in planning, before any vendor is selected. Assign a tier from the use case and the access the vendor will have, then record which criteria drove it. The criteria below are practitioner criteria, not terms taken from the guidance. A vendor lands in the highest tier that any single criterion supports.

• Tier 1: high: Handles sensitive data, takes part in consequential decisions, or invokes tools and takes actions with meaningful autonomy, and would be hard to replace. Full-depth diligence, tighter contract terms, frequent monitoring.
• Tier 2: moderate: Touches limited or non-sensitive data, informs decisions that a person makes, or can be replaced with some effort. Focused diligence on data handling and security, with periodic monitoring.
• Tier 3: low: No sensitive data, no consequential decisions, limited autonomy, easily substituted. Core questions answered, standard terms, light-touch monitoring.

Scope diligence to each tier and accept proportionate evidence

Every tier answers the same core questions drawn from the guidance: can the vendor perform the activity as expected, adhere to your policies, comply with applicable laws and regulations, and operate in a safe and sound manner. Diligence should also give you enough information to judge whether you can identify, monitor and control the risks of that particular relationship. What changes by tier is how much evidence you require and how independently you verify it.

Small vendors often cannot produce the certifications, audited financials or lengthy documentation of established providers. Treating that gap as disqualifying for every tier over-burdens the relationship. Treating it as irrelevant under-scrutinizes the vendors that matter most. A workable rule is to accept substitutes in Tier 2 and Tier 3, and to accept them in Tier 1 only when paired with compensating controls on your side. A non-binding NIST draft profile for generative AI points to checking references and reviewing content handling processes before agreements, which fit well as substitutes.

• Data handling: Ask for a data flow description, retention and deletion practices, and whether your data is used for training. Substitute a walkthrough and contract commitments where formal reports are unavailable.
• Subcontractors and upstream models: Ask which model providers and hosting services the vendor depends on and how it would notify you of changes. Require disclosure in the contract.
• Security posture: Prefer an independent assessment. For smaller vendors, a completed questionnaire, penetration test summary, or documented access controls can stand in for tiers below the highest.
• Financial and operational resilience: Where audited statements are unavailable, consider funding position, customer references, and a documented continuity and exit plan.

Risk that diligence reduces and risk only your controls can bound

Diligence and contracts reduce uncertainty about the vendor: its security practices, its dependencies, its stability, and its obligations to you. They do not show what the vendor's AI was permitted to do inside your environment or what it actually did. A questionnaire records what a vendor says it does. A model update, a new tool connection, or an agent calling a function it should not can change behavior after the review is signed off.

Those residual risks sit with the enterprise, and they are the ones to assign to your own controls. NIST AI RMF MANAGE 3.1 expects that risks from third-party AI resources are regularly monitored and that risk controls are applied and documented. That expectation lines up with the guidance's requirement that ongoing monitoring fit the risk of each relationship.

One way to meet it is to enforce policy in the execution path, so a vendor's model, agent, or tool call is subject to your rules whatever the vendor attests. Trussed enforces policy at runtime, not reviewed after the fact, across models, agents, tools and MCP servers: allow, redact, block, or escalate for human approval, applied to individual interactions and tool calls. That enforcement generates audit-ready evidence of what the AI was allowed to do and what it did, mapped to frameworks including NIST and NYDFS. This evidence does not depend on vendor self-reporting. It complements diligence and does not replace it, and it does not address vendor model provenance or lineage.

Governance, residual risk, and the 2026 proposal

Document each residual risk that diligence and contract terms leave open, name the control that covers it, and record who accepted what remains. Tie that acceptance to your stated risk appetite and tolerances. If you use an outside party to supplement diligence, that arrangement is itself a business arrangement that typically falls under your third-party risk management processes.

As of November 2026, the 2023 final guidance is the operative reference. The FDIC, OCC, FRB and NCUA have proposed replacement guidance, focused on tailoring risk management to the level of risk involved. It presents four components: identifying and assessing applicable risks, overseeing risks proportionate to their significance, making informed decisions about residual risks and risk acceptance, and establishing governance practices. It also says organizations typically prioritize oversight of higher-risk relationships. A tiered, documented program built on risk rather than vendor size should adapt readily if the proposal is finalized, but monitor its progress and revisit tier definitions and monitoring cadence when it is.