# AI service-provider oversight example

A fictional tax-preparation firm evaluates a limited wording task before permitting customer documents. Each finding leads to a specific evidence action.

Synthetic institution and procurement case. No real provider approval, contract or safeguards test is represented.

Source: https://aona.ai/resources/guides/glba-ai-vendor-safeguards-review/
Sources checked: 2026-09-21

## Three different evidence steps

### Select

Can the provider safeguard this information?

### Contract

What obligations apply to the actual service?

### Reassess

Are the safeguards still adequate as risk changes?

| Review area | Illustrative finding | Evidence action |
| --- | --- | --- |
| Institution and information | Fictional covered tax-preparation firm; source files contain nonpublic client information. | Compliance owner confirms actual scope and data categories. |
| Necessity | Generic wording help does not require complete tax returns. | Business owner selects an invented or reduced-context first task. |
| Provider capability | Service-specific handling and safeguards have not been assessed in the scenario. | Security requests evidence relevant to the exact service and data flow. |
| Contract | Appropriate safeguards must be reflected in the applicable agreement. | Procurement records the actual obligations and unresolved terms. |
| Monitoring | No monitoring arrangement exists in the fictional starting proposal. | Assign a provider owner, review cadence and change triggers. |
| Test and decision | No live customer-data use or control test is authorised by the exercise. | Use synthetic material; record actual results and the accountable decision separately. |

## Review checklist

- [ ] Confirm applicable coverage
  Identify the institution, customer-information categories and relevant provider role.
- [ ] Match safeguards to the task
  Review capability evidence, contractual requirements and ongoing assessment as three separate checks.
- [ ] Name the continuing owner
  Record who responds to service changes, incidents and periodic reassessment findings.

## Included example files

- glba-ai-provider-oversight.md
- glba-ai-provider-oversight.csv

## Source references

- FTC: Safeguards Rule, what your business needs to know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know (2026-09-21)
- 16 CFR 314.2: Definitions: https://www.law.cornell.edu/cfr/text/16/314.2 (2026-09-21)
- 16 CFR 314.4: Information-security programme elements: https://www.law.cornell.edu/cfr/text/16/314.4 (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.