Do regulators expect AI vendors to go through model risk management?

Yes. Model risk guidance such as SR 11-7 and OCC Bulletin 2011-12 applies to vendor models, and interagency third-party risk guidance covers vendor oversight. Institutions remain responsible for validating, monitoring, and documenting vendor AI. Credit unions should follow NCUA's expectations and carry more vendor oversight themselves.