Key takeaways
- The FTC Safeguards Rule requires periodic, risk-based assessment of service providers, and Regulation S-P requires oversight through due diligence and monitoring.
- Neither rule sets a review schedule, so the firm chooses and documents a risk-based cadence.
- AI vendors change terms, models and features often, which can change the risk an approval was based on.
- The SEC's fiscal 2027 exam priorities say examiners will evaluate oversight of service providers under Regulation S-P.
- Each review should end in a signed, dated decision: renew, renew with conditions, restrict or retire.
Approving an AI tool is a decision made on one day, about one version of a product. The vendor keeps moving after that: new models, new features, new sub-processors, revised terms. For the CCO or COO of an RIA, broker-dealer, dual-registered firm or insurance agency, the approval memo in the file may describe a tool that no longer exists in that form. An annual review closes that gap and turns a one-time approval into ongoing AI vendor risk management.
Do GLBA rules require you to re-review vendors you already approved?
Yes. Both rules that implement GLBA safeguards for non-bank financial firms expect oversight to continue after approval. For firms under the FTC Safeguards Rule, 16 CFR 314.4(f)(3) requires "periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."
For SEC-registered advisers, broker-dealers and dual-registered firms, amended Regulation S-P Rule 248.30(a)(5) requires written policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. Service providers must notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting a customer information system they maintain. Both compliance dates have passed.
An AI vendor that receives client information through its service is a service provider for these purposes. Neither rule sets a review schedule. Annual review for vendors that touch client data, with event-driven reviews in between, is a common risk-based choice, and the firm should write down why it chose its cadence. The same steps fit inside your broader vendor oversight under GLBA.
How is AI vendor risk management different from other vendor oversight?
The facts behind the approval change faster. Model providers, data retention settings and training terms can shift between renewals. In February 2024 the FTC's Office of Technology warned that companies quietly changing their terms of service to allow AI training on user data could be engaging in unfair or deceptive practices. The warning exists because terms do change.
The NIST AI Risk Management Framework builds the same idea into its outcomes. GOVERN 6.1 calls for policies and procedures that address AI risks associated with third-party entities, and MANAGE 3.1 says AI risks and benefits from third-party resources are regularly monitored, with risk controls applied and documented. The framework is voluntary, but it gives a recognized structure for the review.
Examiners are looking at this too. The SEC's fiscal 2027 examination priorities, released October 23, 2026, say the Division will assess risks associated with registrants' increased use of third-party service providers and will evaluate oversight of service providers in Regulation S-P reviews.
What should an annual AI vendor review cover?
Everything the original approval relied on, checked against today's facts. Work through these items for each approved AI vendor:
- Actual use: who uses the tool and for what, compared with the approved use cases. License counts and sign-in records show whether use has spread beyond the original group.
- Client data: which categories of customer information now reach the tool, and whether data loss prevention alerts flagged anything during the year.
- Terms: the current terms of service, privacy policy and data processing agreement compared line by line with the versions on file, focusing on model training, retention periods and deletion.
- Models and sub-processors: any new underlying model provider, hosting region or sub-processor that handles your data.
- Security evidence: a current SOC 2 Type II report or equivalent, any bridge letter, and the vendor's disclosed security incidents for the year.
- Breach notice: whether the contract still supports the notice your incident response program needs, including the 72-hour service provider notice for Reg S-P firms.
- Access: single sign-on and MFA still enforced, admin roles limited, and departed staff removed.
- Decision: renew, renew with conditions, restrict to certain data or users, or retire, signed and dated by the reviewer.
What should trigger a review before the annual date?
Any change that could alter the risk the approval was based on. The rule language supports this: periodic assessment is tied to "the risk they present," and risk can change between scheduled reviews. Common triggers include:
- A notice of revised terms of service or privacy policy.
- A new AI feature, agent capability or integration that reads email, files or CRM records.
- A security incident reported by the vendor or in the press.
- An acquisition or change of ownership.
- Staff asking to use the tool for a new purpose or a new type of client data.
How do you document the review so an examiner can follow it?
Keep one dated record per vendor that shows what you checked, what you found and what you decided. A short page is enough if it lists the reviewer, the evidence collected (with copies or links), findings compared with the prior approval, the decision and conditions, and the next review date.
Those records then feed the rest of the program. Under the Safeguards Rule, the Qualified Individual's annual written report must address material matters including service provider arrangements, per 16 CFR 314.4(i)(2). SEC-registered advisers keep records documenting the annual review of their compliance policies under Rule 204-2(a)(17), and the AI vendor reviews are natural supporting evidence for that review.
What should you do this quarter?
Get every approved AI vendor onto a schedule and run the first reviews on the highest-risk tools. A workable sequence:
- Pull the list of approved AI tools, including AI features switched on inside software you already license.
- Rank them by the client data they receive and how many people use them.
- Save the current terms, privacy policy and data processing agreement for each, so next year's comparison has a baseline.
- Review the top-ranked vendors against the checklist above and record a decision for each.
- Write the review cadence and off-cycle triggers into your vendor oversight procedures.
How does s90 help?
s90 sets up AI guardrails that keep client data within approved tools and alerts you when staff start using a new AI app, so the approved list stays accurate between reviews. We gather the sign-in, license and data loss prevention evidence each annual review needs and fold the findings into your technology plan. If an annual AI vendor review is on your list this year, we are happy to help you run the first one.
