Research into two-party agentic delivery
Jurisdiction-specific obligations, risk-framework scope, regulated evidence, safety-related boundaries, and the translation of requirements into supplier delivery.
AAO-008 / Regulation and Compliance
Direct oversight of critical technology suppliers does not establish that a bank’s own agentic service is governed or recoverable. Directors should require a dependency review connecting the primary provider to the bank’s actual business service.
AAO-001 / Regulation and Compliance
US bank leaders should require a complete control coverage decision for every outsourced agentic service. Exclusion from model risk guidance leaves the bank with a governance task that a provider model review cannot settle.