The vendor manager should produce one description of the outsourced service that risk functions can assess consistently. Identify the business outcome, bank entities, customers, data, models, tools, human interventions, and consequential actions. Requesting a generic AI approval before describing those elements invites different functions to approve different versions of the same service.
US guidance issued in April 2026 excludes generative and agentic AI from its model definition while expecting appropriate governance outside that scope.1 This scope decision does not determine every bank policy or remove other obligations. The routing task is to identify the relevant controls rather than force the entire service into or out of a single inventory.
For a hypothetical onboarding service, a statistical risk score, a document-extraction model, and an agent updating the client record may require different assessments. The service should have one accountable business owner even when several specialist functions assess its components. Distinct expertise should produce a coordinated decision, not separate approvals with an unexamined gap between them.
Start with what the service can do. Reading a file, generating a recommendation, modifying a record, contacting a customer, and submitting a transaction create different exposures. For each action, record the data used, affected party, receiving system, intended authority, failure consequence, and evidence retained. These facts allow a specialist to explain why its framework applies.
Then map the applicable requirements. Distinguish law and supervisory expectations from bank policy, contractual promises, and voluntary standards. Record the relevant entity and activity, the function responsible for interpretation, and the provider evidence needed. A reference to a regulation without an applicability conclusion is an unresolved task, not a completed assessment.
The study reports uneven delivery-team knowledge of governing obligations and departures from intended control functions. It does not establish the legal applicability of every reference respondents named.2 Managers should therefore verify the obligation map with responsible bank specialists instead of copying framework names from provider responses.
Figure 1 proposes a routing record with four linked decisions. The action description establishes the scope; the specialist determines the applicable discipline; the control owner identifies operating evidence; and the service owner resolves gaps. Each record should state whether the conclusion is approved, conditional, inapplicable with reasons, or awaiting evidence.
Ask each function to specify the evidence it needs from the provider. Privacy may require processing purposes and downstream recipients; security may require identity and tool boundaries; operational risk may require recovery tests; compliance may require preserved reasons and customer records. The same execution trace can support several reviews if its content and access are agreed.
Avoid treating an unresponsive function as evidence that its review is unnecessary. Escalate unresolved ownership through the bank’s risk governance. A decision deadline should be connected to the planned deployment and the consequence of delay. Where material coverage remains unresolved, restrict the relevant action rather than describe the service as fully approved.
FINMA’s guidance identifies Swiss supervisory observations on AI governance, testing, and independent review.3 An EU or UK bank entity needs its own applicability analysis; US model-risk scope is not a global exemption. The service description can remain common while local counsel and risk functions document the conclusions for each entity.
Record the version and effective status of each authority used. A consultation, concept paper, industry framework, and binding rule should not receive the same label in the routing record. When a group chooses a stricter common policy, identify that as a group decision and verify whether local restrictions change the way evidence can be collected or shared.
The provider should receive one coherent operating instruction set with entity-specific conditions where necessary. Conflicting local conclusions should be resolved before the agent is allowed to select its own interpretation. Commercial pressure to standardize delivery does not remove the need to know which rule governs the affected activity.
A sensible objection is that a detailed map could duplicate existing risk inventories. Reuse established records and link to their current conclusions. The additional deliverable is the connection between components, actions, obligations, and the two-firm service decision. It should expose missing coverage rather than create a second description of every existing control.
Reassess routing when the provider adds a tool, changes the model’s role, expands the affected customer group, moves processing, or takes over a decision previously made by the bank. A release that looks technically small can change which function must assess the service. The change process should identify that trigger before production use.
The manager should close the review with an agreed service map, named control owners, provider evidence obligations, and explicit deployment conditions. The bank then has a defensible explanation of which disciplines govern the service and where authority remains restricted. An approval label becomes useful only when the operating coverage behind it can be demonstrated.
The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.4
This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a mixed-service risk-routing record connecting actual agent actions, jurisdiction-specific applicability, control evidence, and change triggers. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.