Your AI risk doesn’t stop at your own front door

Encompass is now certified to ISO 42001, the international standard for AI governance.

For banks, that matters for a reason many have not yet considered: every vendor in your KYC stack is now using AI. Whether its product mentions it or not, and your existing vendor due diligence was not designed to catch that risk.

You can stop reading there. That’s the headline, and it’s a good one for Encompass and our customers.

But if you’re responsible for compliance, risk, or technology at a bank, the more useful question isn’t whether your vendors have an AI certificate. It’s whether you know how AI is being used across your supply chain, who is accountable for it, and how you would prove that to a regulator tomorrow.

We’ve seen hype cycles before. This one is different

Anyone who remembers the first dot-com boom will remember organizations adding “.com” to their names. With hindsight, most had no idea why. They just didn’t want to be left behind.

There have been plenty of hype cycles since. One old line stuck with me: XML is like violence, if it’s not working, you’re not using enough of it. For a while, I put XML everywhere. All it did was slow everything down. Swap XML for AI in that line and you have a fair summary of today’s market.

Every software company is now making bold claims about AI. The difference is that this cycle can’t simply be waited out. At Encompass, AI is already accelerating how we work, helping us build better, more intelligent software faster than ever. It’s also creating as many challenges as it solves. Banks face exactly the same tension, and their vendors do too.

What ISO 42001 actually is

ISO/IEC 42001 is the first international standard for an AI management system. It sets out how an organization should govern the AI it develops, provides, or uses, covering accountability, risk assessment, data quality, transparency, monitoring, and continual improvement.

Crucially, it’s certifiable. An independent auditor checks that the controls exist and work in practice, not just on paper. That’s what separates a certified AI governance program from a well-written AI policy or a marketing claim.

Five things banks may not have considered

1. Your vendors are using AI even if their product isn’t “AI”

   Most banks ask vendors whether their product uses AI. Far fewer ask whether AI is being used to build, test, or support it. AI-generated code, AI-assisted support, and AI tools handling customer data inside a vendor’s business all sit within your third-party risk, whether they appear on a product sheet or not.

2. Your due diligence questionnaire probably has a blind spot

   Security certifications such as ISO 27001 and SOC 2 tell you a vendor protects data. They don’t tell you how that vendor manages model drift, inaccurate outputs, bias, or where its training and reference data came from. If your onboarding checklist hasn’t changed since AI arrived, it’s assessing yesterday’s risks.

3. AI agents raise a new accountability question

   As banks connect AI agents to compliance workflows, agents begin querying data and triggering actions at speed. When an agent pulls the wrong record or acts on stale information, who is accountable: the bank, the model provider, or the data supplier? The answer depends on governance that must be in place before the agent goes live, not after something goes wrong.

4. Regulators will ask you, not your vendor

   Supervisors increasingly expect banks to explain and evidence how decisions are made, including decisions supported by third-party technology. Outsourcing a process doesn’t outsource the responsibility. If a vendor can’t show you how its AI is governed, you will struggle to show a regulator.

5. “Responsible AI” claims are easy to make and hard to verify

   Almost every vendor now has a responsible AI statement. Very few have had it independently tested. Third-party certification turns a claim into evidence you can put in front of your risk committee, your auditors, and your regulator.

Good AI governance isn’t new. It’s good governance, extended

As we’ve moved from prompts to skills, from skills to agents, and from agents toward digital employees, one thing has become clear: we don’t have to start from scratch. Much of AI governance is existing good practice applied to a new technology.

That means a reliable inventory of what AI is in use and where. Strong access controls over what it can see and do. Comprehensive monitoring and quality assurance of its outputs. And a clear understanding of the risks, with proportionate controls to manage them.

ISO 42001 dovetails with the ISO 27001 information security management system we already operate. Together, they give Encompass one framework for security and governance that extends the work we’ve done for years to cover AI. Independent assurance shows there’s substance behind it, not just hype.

Questions every bank should be asking its KYC vendors

Whether or not a vendor holds ISO 42001, these questions will tell you a lot about how seriously it takes AI risk:

• Where is AI used in your product, your development process, and your internal operations?
• How do you keep an inventory of the AI systems and models you rely on?
• What data can those systems access, and who controls that access?
• How do you monitor AI outputs for accuracy, drift, and bias?
• Can you provide an audit trail showing what data an AI agent accessed and when?
• Has your AI governance been independently assessed?

If the answers are vague, that’s your signal.

At Encompass, AI governance isn’t a separate initiative bolted on to meet a trend. It’s built into the same management system that already protects our customers’ data, and it’s now independently certified. For banks wiring AI into their KYC operations, that means one less blind spot in the supply chain.