Buying an AI service does not transfer responsibility for the resulting customer, model or operational risk. A supplier may control the model, hosting, training data, updates and incident information while the regulated institution remains accountable for the service delivered to customers.
Assess the whole dependency chain
Review the model provider, cloud host, data supplier, identity service, subcontractors and support process. Measure concentration across business units and products. Several apparently separate AI tools may depend on one model family, cloud region or data provider.
Contract for evidence
Contracts should address data use, confidentiality, model changes, performance information, incident notification, audit access, testing, regulatory cooperation, location, retention and deletion. A generic uptime service level does not provide enough evidence for AI performance or outcome risk.
Test exit and resilience
Run a scenario in which the provider changes its model, suffers an outage, loses a licence or cannot return data. Test manual workarounds, model replacement, customer communications and reconciliation. Exit is a capability only when it has been exercised.
Use the official DORA text alongside applicable outsourcing and AI rules. Quantica Risk Modelling recommends a vendor evidence score that is reviewed by procurement, technology, risk, compliance and the accountable business owner.