--- title: Cost of Vendor AI Oversight Under OCC Bulletin 2023-17 description: Learn about the costs and requirements of AI vendor oversight for community banks under OCC Bulletin 2023-17, ensuring compliance and effective risk management. image: https://blog.fivenines.com/hubfs/blog/taya-migration/9-ai-vendor-oversight-cost-coo.docx.png --- [Skip to the main content.](https://blog.fivenines.com/cost-of-vendor-ai-oversight-under-occ-bulletin-2023-17#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # Cost of Vendor AI Oversight Under OCC Bulletin 2023-17 [Five Nines Executive Team](https://blog.fivenines.com/author/five-nines-executive-team) : Nov 5, 2026, 5:59:59 AM 5 min read [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) ![Cost of Vendor AI Oversight Under OCC Bulletin 2023-17](https://blog.fivenines.com/hubfs/blog/taya-migration/9-ai-vendor-oversight-cost-coo.docx.png) *TL;DR* - OCC Bulletin 2023-17, together with the parallel Federal Reserve and FDIC adoptions, expects the bank to apply third-party risk management to every AI capability it consumes from a vendor. The expectation does not change because the AI is novel. It does change the operational depth the bank's vendor management function needs to deliver. - For a community bank with three to six AI-related vendor relationships across lending, fraud, AML, and productivity, the annual operating cost of substantive vendor AI oversight runs in the mid five figures to low six figures. The cost includes onboarding diligence, ongoing reviews, right-to-audit exercise, attestation reviews, and exit planning. The number scales with the number of relationships, not the size of each. - The COO question is not whether to oversee AI vendors. It is whether the existing vendor management program covers the AI-specific risk depth examiners now expect. A program designed for routine fintech relationships often misses the model-specific elements AI requires. ## Why AI Vendors Require Deeper Oversight Than Traditional Vendor Management A community bank COO who has run a vendor management program for years knows the framework. Risk-tier the vendors. Diligence at onboarding. Periodic reviews. Right-to-audit clauses. Exit planning. The framework is mature, and most community banks have a defensible baseline. What AI changes is the depth required for the vendor-supplied capability that affects credit decisions, fraud monitoring, or any other safety-and-soundness or consumer-facing function. The interagency guidance is direct on this point: "A banking organization's use of third parties does not diminish or remove its responsibility to ensure that activities are performed in a safe and sound manner." For AI vendors, the responsibility includes understanding the model the vendor operates, the data the vendor uses, the testing the vendor performs, and the bank's ability to demonstrate to its primary regulator that the bank governs the relationship rather than relying on vendor compliance. What follows is the plain-English version of what AI vendor oversight actually costs at community bank scale, where the work concentrates, and how the program differs from traditional vendor management.   ## What AI Vendor Oversight Requires at Each Lifecycle Stage OCC 2023-17 and the interagency parallels frame third-party risk management around five lifecycle stages: planning, due diligence, contract negotiation, ongoing monitoring, and termination. For AI vendors, each stage has AI-specific depth. 1. Planning. Before engaging the AI vendor, the bank evaluates whether the capability is consistent with the bank's strategy, risk appetite, and resourcing. For AI, the planning includes model risk implications and the bank's ability to oversee a capability it does not directly control. 2. Due diligence. The bank evaluates the vendor's financial condition, business model, controls, and capabilities. For AI vendors, due diligence extends to the vendor's model risk practices, training data, fairness testing, explainability output, change management for model updates, and incident response when the model misbehaves. 3. Contract negotiation. The bank's contract with the AI vendor addresses standard third-party clauses (confidentiality, indemnification, termination) plus AI-specific clauses (right-to-audit the model, right to receive attestations on model updates, vendor obligations on regulatory compliance, exit planning for model transitions). 4. Ongoing monitoring. The bank monitors the vendor's performance, financial condition, and continued ability to deliver the AI capability. For AI vendors, monitoring includes periodic reviews of model performance, attestation reviews when the vendor updates the model, and complaint or incident tracking. 5. Termination. The bank plans for the eventual end of the relationship, with continuity in mind. For AI vendors, exit planning addresses how the bank transitions away from the model without disrupting affected functions.   ## What AI Vendor Oversight Costs at Community Bank Scale The annual operating cost of AI vendor oversight for a community bank with three to six AI-related vendor relationships breaks into the following. 1. Onboarding diligence. Per-vendor one-time cost. Substantive AI vendor diligence runs in the low five figures per vendor at onboarding. The cost includes legal review of contracts, technical review of the model and its documentation, and the initial right-to-audit exercise. 2. Ongoing review. Annual cost per vendor. Quarterly or annual review of vendor performance, attestation review when the vendor updates the model, and documentation refresh. Runs in the low five figures per vendor annually. 3. Right-to-audit exercise. Periodic. The bank exercises its right to audit the vendor's model risk practices on a documented cadence (typically every two to three years for AI vendors). Per-exercise cost in the low to mid five figures. 4. Attestation review. Per-update. When the vendor pushes a material model change, the bank reviews the vendor's attestation and decides whether to accept, request additional information, or pause use of the model. Effort scales with update frequency. 5. Internal personnel time. The bank's vendor management function plus the model risk function combined own the AI vendor oversight workload. At community bank scale this is a fraction of one or two roles, with the BSA or compliance function contributing for specific AML or compliance-affecting vendors. The all-in annual operating cost for AI vendor oversight at a community bank with three to six AI vendor relationships runs in the mid five figures to low six figures. Banks with more vendors run higher; banks with fewer or simpler vendor relationships run lower.   ## Four Places Traditional Vendor Management Falls Short on AI The vendor management program that has worked for routine fintech relationships often falls short on AI in four specific areas. 1. The first is model risk depth. Traditional vendor management evaluates the vendor's controls and operations. AI vendor management adds the model itself as an evaluation target. The bank's vendor reviewer needs the competence to evaluate model risk, not just operational risk. 2. The second is update cadence. AI vendors push model updates more frequently than traditional vendors push software updates. The bank's review cadence needs to match the vendor's update cadence, or the bank operates with stale governance. 3. The third is right-to-audit substance. Many vendor contracts include right-to-audit clauses that are formal but never exercised. AI vendors require substantive periodic audit, not just contractual rights. The bank's vendor management calendar should include actual audit exercises. 4. The fourth is subservicer transparency. AI vendors often rely on cloud infrastructure providers, data providers, and model providers underneath their own service. The bank's oversight extends through the chain. Traditional vendor management often does not capture subservicer relationships at the same depth.   ## What the COO actually controls The COO controls four things in the AI vendor oversight program. 1. The first is the vendor portfolio. Which AI vendors the bank engages, how many, and in what risk-tier mix. A consolidated portfolio is easier to oversee than a sprawling one. 2. The second is the contract terms. The standard AI vendor contract at community bank scale should include specific AI-related clauses. The COO sets the policy on contract minimums. 3. The third is the review cadence. Annual, semi-annual, or quarterly review of each AI vendor depending on risk tier. The cadence determines whether the program operates substantively or formally. 4. The fourth is the personnel investment. The vendor management function and the model risk function both touch AI vendor oversight. The COO sizes the team and the engagement model.   ## What the COO Controls in the AI Vendor Oversight Program Somewhere in the AI vendor conversation, the COO will hear this argument. The AI vendor has SOC 2 certification and provides regulatory attestations. The bank can rely on those for compliance. That is a false choice. SOC 2 addresses controls but not model risk. Regulatory attestations are vendor statements about vendor compliance, not bank compliance. The bank's responsibility under OCC 2023-17 is to ensure that activities are performed in a safe and sound manner, including the AI activity the vendor performs. SOC 2 and vendor attestations are inputs to the bank's program, not substitutes for it. The right framing is not whether the vendor produces compliance artifacts. It is whether the bank reviews those artifacts, supplements them with the bank's own diligence, and documents the bank's own governance of the relationship. The first framing produces a delegated defense. The second framing produces an owned program.   ## Why SOC 2 and Vendor Attestations Don't Substitute for Bank Governance A community bank COO should work through three things before the next exam cycle. The first is a current-state inventory of every AI-related vendor relationship in the bank, with risk tier, contract terms, and review status documented. The second is a gap analysis between the current vendor management program and the AI-specific depth OCC 2023-17 and the interagency parallels expect. The third is a calendar discipline for ongoing reviews, attestation handling, and right-to-audit exercise that produces the documentation examiners ask for. When this discipline is in place, the third-party risk conversation moves from "explain your AI vendor oversight" to "review the program's most recent outputs," and the gap between those two postures is the gap between a finding and a routine confirmation.   ## Govern the AI Vendor Relationship — the Bank Is Accountable, Not the Vendor A community bank COO sizing AI vendor oversight is sizing the program that demonstrates the bank, not the vendor, governs the AI capability the bank consumes. The cost is moderate at community bank scale. The discipline is what makes the program credible to examiners and meaningful in practice. If your bank has not assessed its AI vendor oversight against OCC 2023-17 and the bank's current AI vendor portfolio in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next exam cycle. Five Nines Technology Group is a Tech-Operations partner for community banks and credit unions. Translating regulatory frameworks into operating discipline at community bank scale is where our team focuses. ## Frequently asked questions Does OCC 2023-17 apply to credit unions, or only to OCC-supervised banks? OCC 2023-17 is the OCC version of the interagency guidance. NCUA has parallel guidance for credit unions. The substance is consistent across regulators. Any federally regulated financial institution operates against the same third-party risk framework. What is the difference between a vendor and a fintech partner under the guidance? The interagency guidance applies the same framework to both. Fintech partners are a category of third-party relationship with the same risk management expectations. The labeling does not change the regulatory obligation. Can the bank rely on the vendor's model validation as its own? The bank can use the vendor's validation as one input. The bank cannot fully rely on it. SR 11-7 expects the bank's own validation oversight, even when the model is vendor-supplied. How often should right-to-audit be exercised? For high-risk AI vendors, every two to three years substantively, with annual lighter reviews. For lower-risk AI vendors, less frequent substantive audit. The bank's policy should specify the cadence. What if an AI vendor refuses to grant right-to-audit access? This is a contract negotiation issue. The bank's policy should require meaningful right-to-audit clauses for risk-tiered AI vendors. Vendors that will not grant the clauses should be diligenced more deeply or replaced. How does the AI vendor oversight program integrate with the bank's broader model risk management? Closely. The vendor's AI model is a model in the bank's inventory under SR 11-7. The vendor management program contributes to the model risk evaluation. The two programs share documentation, reviewers, and reporting. What is the most common AI vendor oversight finding? Inadequate documentation of substantive review. The bank engages the vendor, signs the contract, and consumes the output, but cannot produce evidence of ongoing substantive oversight. The program is functional; the evidence is not. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJL%2FmUBBbO1avnyKFna%2BZLxKPGyVS%2F64LeXTRH5yM1VUWywDOeMq6HSIL6zMYIpIebm3P5E1rrliv2mJ0EmWUcMOWBqoNmzHLiL0N2DTpEA4QssnGq1NIWkMdIsF2CojJi3LNEXlACc7Q016yBd6YEU46DyoXtuugtxrhoqvFn25hbI%2FnIniQyHg%2FTDOYE8x4UMfg%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "OCC 2023-17 is the OCC version of the interagency guidance. NCUA has parallel guidance for credit unions. The substance is consistent across regulators. Any federally regulated financial institution operates against the same third-party risk framework." }, "name" : "Does OCC 2023-17 apply to credit unions, or only to OCC-supervised banks?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The interagency guidance applies the same framework to both. Fintech partners are a category of third-party relationship with the same risk management expectations. The labeling does not change the regulatory obligation." }, "name" : "What is the difference between a vendor and a fintech partner under the guidance?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The bank can use the vendor's validation as one input. The bank cannot fully rely on it. SR 11-7 expects the bank's own validation oversight, even when the model is vendor-supplied." }, "name" : "Can the bank rely on the vendor's model validation as its own?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "For high-risk AI vendors, every two to three years substantively, with annual lighter reviews. For lower-risk AI vendors, less frequent substantive audit. The bank's policy should specify the cadence." }, "name" : "How often should right-to-audit be exercised?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "This is a contract negotiation issue. The bank's policy should require meaningful right-to-audit clauses for risk-tiered AI vendors. Vendors that will not grant the clauses should be diligenced more deeply or replaced." }, "name" : "What if an AI vendor refuses to grant right-to-audit access?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Closely. The vendor's AI model is a model in the bank's inventory under SR 11-7. The vendor management program contributes to the model risk evaluation. The two programs share documentation, reviewers, and reporting." }, "name" : "How does the AI vendor oversight program integrate with the bank's broader model risk management?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Inadequate documentation of substantive review. The bank engages the vendor, signs the contract, and consumes the output, but cannot produce evidence of ongoing substantive oversight. The program is functional; the evidence is not." }, "name" : "What is the most common AI vendor oversight finding?" } ] } ```