GLBA Safeguards for AI Vendors: 16 CFR 314, the Interagency Guidelines, and the 30-Day Notification Bank IT Cannot Push to Anyone Else
The FTC's 2023 Safeguards amendments added a 30-day breach-notification duty and a list of nine information-security elements every covered non-bank financial institution has to encode. Banks operate under parallel Interagency Guidelines with their own notification rule. AI vendors sit inside both perimeters and the institutions we serve are running diligence and contract terms that anticipate what the next regulator will ask for.