The Current

Welcome back to The Current, where we cut through the noise and surface the risk and third-party management updates that actually matter.This week, the world’s biggest tech players and global regulators seem to be in a race, one side pushing innovation at full speed, the other slamming the brakes with new rules and expectations. And as usual, every ripple at the top becomes a wave headed straight for your risk program.

From emerging AI requirements to evolving vendor-oversight expectations, the landscape is shifting fast. But don’t worry, we’ve distilled what’s changing, why it matters, and what you should be doing about it right now.

Let’s dive in.🌊

What's New?

The OCC just announced a new Request for Information (RFI) asking community banks to weigh in on their biggest challenges with core service providers and other essential third-party vendors.

What changed:

The OCC wants direct input on pain points like contract terms, fees, data access, system interoperability, and how hard it can be to oversee major third-party providers. They’re also asking what regulatory or supervisory changes could make oversight more efficient and less burdensome.

What didn’t change:

This RFI doesn’t create new rules or obligations. Banks still need to follow existing third-party risk expectations, this is simply the OCC gathering intel before potentially updating guidance.

What it means for business:

Regulators are signaling that community banks need more clarity and support when dealing with mission-critical vendors. This could lead to more tailored guidance, streamlined oversight expectations, and clearer examiner focus areas, especially around contracts, monitoring, and system modernization.

A new generation of artificial intelligence, so-called “agentic AI”, is changing how cybersecurity and operational risk intersect. These systems don’t just respond to prompts; they can decide what to do next, act on behalf of an organization, and even initiate tasks without human instruction.

What’s changed:

Agentic AI isn’t just analyzing logs or flagging suspicious behavior. It can autonomously investigate alerts, run tests, prioritize vulnerabilities, and execute actions that traditionally required an analyst. In some cases, it’s acting not only within your environment, but also through third-party platforms that leverage AI on your behalf. That means software, not people, may now be making decisions using your data.

What didn’t change:

Autonomy doesn’t eliminate risk; it can actually multiply it if you’re not watching closely. Organizations often don’t know what information is being fed to an agentic AI system, what instructions it’s acting on, or how that data is being stored, transmitted, or reused. If a third party deploys agentic AI for your operations without your awareness, you inherit potential exposure you may not have wanted, including data leakage, unauthorized access, prompt-based manipulation, and logic that can be steered, corrupted, or outright jailbroken by attackers.

What it means for business:

Companies must now evaluate not only their own AI, but how vendors are using agentic AI on their behalf. Knowing what data these systems access, how they act, and who controls them is the new baseline for risk. Done right, agentic AI boosts detection and reduces workloads. Done wrong, it becomes an autonomous liability outside your governance.

We’ll be digging deeper in future insights.

Two ways to train. Built by practitioners, not academics.

Built by practitioners. NASBA-accredited CPE.

Got thoughts? Questions?

Hit reply. We actually read these.

See you in the next one.