The head of third party risk at a large bank under direct supervision of the European Central Bank lays two lists side by side. The first is the register of information required by the Digital Operational Resilience Act, which records every contractual arrangement for information and communication technology services. The second is the inventory of artificial intelligence applications kept by the data office. Different departments built them for different rules. The register shows a cloud tenancy, a document processing vendor, a customer service platform and a coding assistant as four unrelated suppliers. The inventory shows that all four reach the same small group of model makers.
That is concentration risk, and the Act has asked for it to be assessed since 17 January 2025. Article 29 requires the bank, before contracting for a critical or important function, to consider whether the provider is easily substitutable and whether it already holds several arrangements with the same or closely connected providers. It also asks whether long chains of subcontracting impair the bank's ability to monitor. Article 30 requires an exit strategy with a transition period that allows a move to another provider or to a solution in house. De Nederlandsche Bank reports that many banks have not completed implementation in full and that the quality of the register and of third party risk management has to rise.
The European Central Bank has made the subject a priority for 2026 to 2028. It writes that banks depend heavily on a handful of outside service providers, many of them based outside the Union. Its plans include workshops on generative artificial intelligence with selected banks and on site inspection campaigns on third party risk management. On 18 November 2025 the European Supervisory Authorities designated nineteen critical providers now under European oversight. The three large cloud companies are on the list. No company whose only business is making language models is on it. For the model maker behind the cloud tenancy or inside a vendor's product, the bank's own due diligence is all there is.
The usual response treats the model as a feature of whatever product contains it. The vendor answers the questionnaire about itself, concentration is assessed contract by contract, and the exit plan describes moving workloads to another data centre. Exit from a model is a different exercise. Prompts, evaluation sets and tuned behaviour are fitted to one model, and nobody knows whether a summary of a credit file still meets the bank's standard on another model until someone has measured it. Pedro Machado of the Supervisory Board of the European Central Bank described the ownership of artificial intelligence at banks in February 2026 as fragmented across information technology, data science, business lines and control functions. In a sample of 13 banks the supervisor found in November 2025 that about half had a dedicated policy or committee.
The route decision is where the bank regains some control. For each type of work it decides whether data may go to the online interface of a model provider under contract, to a private deployment, or only to the bank's own premises. For a critical or important function the decision should name a second route as well, and prove it. HSBC announced on 1 December 2025 that it would use models from Mistral AI hosted on its own internal systems, so the option is real at this scale. On an independent index read on 5 October 2026 the best open weight model scored 46 against 58 for the best hosted model, which means an exit route has to be tested on the bank's own tasks before anyone relies on it. A private deployment in a European region reduces practical exposure while the provider stays subject to the law of its home country. A model on the bank's premises removes that dependency and adds the burden of running it. Neither changes what the bank owes its supervisor.
The governance is the same on every route and needs one owner: inventory, role under the European Union Artificial Intelligence Act, supplier file, evaluation on the bank's own work, logging, human oversight, staff competence and an incident route. A bank that builds its own model to score natural persons is both provider and deployer of a high risk system once those obligations apply on 2 December 2027. The European Banking Authority found no significant contradictions between the Act and banking law in November 2025 and added that some effort may be needed to integrate the two frameworks. It saw no immediate need for guidelines of its own, which leaves the integration to the bank.
The AI Guys, a Dutch firm that works on compliance for artificial intelligence in regulated industries, does this work with banks from strategy through to implementation.
Next month the accountable board member should have four things. One joined list in which every artificial intelligence application is matched to its entry in the register of information and to the model maker at the end of the chain. A concentration table by model maker for the whole group. For the two most critical functions, a named second route and a date for testing it on the bank's own evaluation set. And the name of the one executive who owns the list.