The AI risk your examiner will ask about — and the rulebook nobody wrote for you.
You already run third-party risk assessments and a GLBA safeguards program. NobleCloak gives you one for AI — every AI tool your institution and its vendors actually use, what data it can reach, and evidence you can hand an examiner. On the budget line you already have, mapped to the frameworks you already report against.
A carve-out isn’t relief — it’s a rulebook nobody wrote for you.
Your customers' data. Your examiners. A staff already stretched thin. AI is spreading through your institution whether you sanctioned it or not — your core added an assistant, your loan-origination vendor shipped a summarizer, someone in the branch is pasting into a chatbot nobody approved. On April 17, 2026, the Federal Reserve issued SR 26-2, revising model-risk guidance and superseding SR 11-7 — and in a footnote it explicitly placed generative and agentic AI outside its scope, while aiming the guidance primarily at banks over $30 billion in assets. If you're smaller, you got excluded twice: it's not your rule, and it doesn't govern the AI you're most anxious about. That reads like relief. It's the opposite — the obligation didn't disappear, it got pushed back onto the governance you already have.
You fall squarely under the 2023 Interagency Guidance on Third-Party Relationships, and you run a GLBA safeguards program (16 CFR Part 314). Neither shrinks because the data now flows through an AI feature instead of a database. The larger banks SR 26-2 targets have model-risk teams and a supervisor actively shaping their AI governance — you inherit the logic without the scaffolding.
The assessment, in the language of your exam.
An AI vendor-risk assessment
The Discover scan fits the third-party-risk discipline you already run. Every AI tool your people authorized, the data scopes it holds, who is using it, and since when.
Findings you can act on
Instead of "please describe your AI data practices," you get "Otter.ai holds Calendar + Drive read access for 6 users since March. Recordings retained. No SOC 2 on file." Generated, not hand-written.
A framework crosswalk
Every finding mapped to your existing third-party-risk and GLBA safeguards obligations and to the NIST AI RMF, so the evidence lands in the language your exam already speaks.
Built for understaffed teams
Concierge. We run your first report with you. Low-ops by design.
Exposure and get-ahead — not a mandate that doesn’t exist yet.
This is exposure and get-ahead — not a claim that any US regulator mandates AI-specific vendor controls for a community bank today. There is no such mandate; the Fed's most recent word was to carve generative AI out of scope. What exists is the obligation you already inherited through third-party-risk guidance and GLBA: know what your vendors do with your customers' data, monitor them, prove it. The scan reads your SSO- and OAuth-discoverable AI surface as of the scan date — it does not capture personal-account usage, personal devices, or direct API access. We state that boundary on every report.
NobleCloak was built by people who sat inside the compliance conversation — a product leader from the third-party-risk world (banks and credit unions) and a security architect who built the guardrails. We know what an examiner pulls, because we used to assemble it.