As financial firms race to adopt artificial intelligence (AI), most have rightly focused first on managing risk within their own teams, ensuring that only permitted and approved AI tools are used and that they align with company policies. However, a growing blind spot remains: how AI is being used by third-party suppliers.
Independent financial firms, due to their smaller size, often rely heavily on external providers for outsourced services such as tech providers, compliance and legal support, accountancy, recruitment, and back-office service providers. Like everyone else, these businesses are increasingly embedding AI into the services they deliver. Yet many firms have little to no visibility into how these systems operate, what risks they pose, or whether they comply with emerging regulations.
Do you know how your suppliers are using AI?
Financial firms must maintain strong oversight across their entire supply chain. As part of their regulatory obligations around outsourcing, they need to understand each supplier, the services they provide, how those services are delivered, the data they manage, and the potential impact on their business. AI is no longer confined to headline-grabbing use cases; it’s now embedded in everything from tools like Microsoft CoPilot for general-purpose document generation, to agents replacing customer service chatbots, and more advanced, bespoke AI systems performing business-specific activities.
What contractual controls should you have in place?
To mitigate these risks, financial firms should revisit their contracts with each vendor and ensure that the following are in place:
- Disclosure obligations: Suppliers must inform you if AI is used in delivering services.
- Audit rights: You should be able to assess the AI system’s design, training data, and performance.
- Compliance clauses: Suppliers must adhere to applicable AI regulations (e.g., EU AI Act, DORA, GDPR).
- Incident reporting: Prompt notification of AI-related failures, biases, or breaches.
- Termination rights: The ability to exit contracts if AI usage introduces unacceptable risk.
These controls should be tailored to the criticality of the service and the risk profile of the AI system involved.
What are examples of “high-risk” AI systems?
Not all uses of AI are considered high risk, but firms must understand how AI is being applied. Under the EU AI Act, AI systems are categorised by risk level. “High-risk” systems include those used in:
- Creditworthiness assessments
- Insurance underwriting
- Employment decision-making
- Biometric identification
- Critical infrastructure operations
In a financial firm’s supply chain, this could include a vendor using AI to screen job applicants or a third-party analytics firm using machine learning to assess loan default risk on your behalf.
These systems are subject to strict requirements around transparency, data governance, human oversight, and robustness.
Where do regulators stand on this?
Regulators are increasingly alert to the systemic risks posed by AI, not just within firms, but across their supply chains.
The UK’s Financial Conduct Authority (FCA) has emphasised a principles-based, outcomes-focused approach to AI regulation. It expects firms to understand and manage AI-related risks, including those arising from third-party providers.
The U.S. Securities and Exchange Commission (SEC) has signalled that AI-related disclosures and governance will be a focus area, particularly where AI influences investment decisions or market behaviour.
Meanwhile, the EU’s Digital Operational Resilience Act (DORA) already imposes obligations on financial firms to manage ICT third-party risk and overlaps with AI governance in several areas.
In short, regulators expect firms to take responsibility for the AI systems their suppliers use, especially where those systems impact customers, markets, or regulatory compliance.
Final thoughts: From blind spot to boardroom priority
AI in the supply chain is no longer a theoretical risk; it’s real and growing. Like cyber security, it must become a board-level priority. Boards need to go beyond internal AI controls and extend their oversight to third-party providers. This means asking tough questions, updating contracts, and embedding AI risk into your supplier due diligence and monitoring processes.
Because in the age of AI, your risk extends across your entire supply chain, and it’s only as strong as the weakest link.
