# AI service-provider oversight example

Synthetic institution and procurement case. No real provider approval, contract or safeguards test is represented.

A fictional tax-preparation firm evaluates a limited wording task before permitting customer documents. Each finding leads to a specific evidence action.

| Review area | Illustrative finding | Evidence action |
| --- | --- | --- |
| Institution and information | Fictional covered tax-preparation firm; source files contain nonpublic client information. | Compliance owner confirms actual scope and data categories. |
| Necessity | Generic wording help does not require complete tax returns. | Business owner selects an invented or reduced-context first task. |
| Provider capability | Service-specific handling and safeguards have not been assessed in the scenario. | Security requests evidence relevant to the exact service and data flow. |
| Contract | Appropriate safeguards must be reflected in the applicable agreement. | Procurement records the actual obligations and unresolved terms. |
| Monitoring | No monitoring arrangement exists in the fictional starting proposal. | Assign a provider owner, review cadence and change triggers. |
| Test and decision | No live customer-data use or control test is authorised by the exercise. | Use synthetic material; record actual results and the accountable decision separately. |

## Review steps

- Confirm applicable coverage: Identify the institution, customer-information categories and relevant provider role.
- Match safeguards to the task: Review capability evidence, contractual requirements and ongoing assessment as three separate checks.
- Name the continuing owner: Record who responds to service changes, incidents and periodic reassessment findings.

## Safe example task

“Improve the wording of a generic message telling a client how to arrange an appointment. Do not invent names, income, tax identifiers or account information.”

## Example disposition

Proceed only with the invented wording exercise. The customer-document proposal remains outside this teaching decision. Actual service terms, controls and accountable review must be established for any real customer-information use.

## Source and scope

Guide: https://aona.ai/resources/guides/glba-ai-vendor-safeguards-review/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- FTC: Safeguards Rule, what your business needs to know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- 16 CFR 314.2: Definitions: https://www.law.cornell.edu/cfr/text/16/314.2
- 16 CFR 314.4: Information-security programme elements: https://www.law.cornell.edu/cfr/text/16/314.4