Builders and Buyers

Each section moves in three tiers: a board line, a why it matters note, and a shaded detail block carrying the authority.

Accountability stays home

This paper makes its argument by demonstration rather than assertion. When four unrelated regimes reach the same conclusion without coordinating, the conclusion belongs to the oversight layer, not to any sector. The Builder statutes themselves now subsidize the Buyer's work, because the safety frameworks and incident reports they mandate are diligence material the law produced for exactly this purpose.

The segmentation, and why it changes the question

Builders and Buyers is a segmentation of oversight obligation, not a vendor-versus-customer relabeling. The Builder's duties attach to what it creates; the Buyer's attach to what it does with what it acquired.

Why it matters. The regimes now write the split explicitly: the EU AI Act allocates duties between providers and deployers, Colorado's replacement statute between developers and deployers, and the employment statutes bind employers regardless of who built the tool. An institution occupying both positions carries both sets of obligations and must know which activity sits where.

The non-transfer principle, four times over

2.1 Banking: the mature statement

Banking answered the central Buyer question more than a decade before generative AI raised it: the institution that deploys a model owns the model risk, whoever built it. The principle just survived a complete rewrite of the guidance.

Why it matters. A principle that survives a fifteen-year, ground-up revision is the durable layer, not a rule of the old framework. SR 26-2 also handed every board a finding worth more than the guidance itself: the agencies deliberately placed generative and agentic AI outside the revised framework. The most mature model-governance instrument in American supervision declines to cover the AI arriving fastest. The gap is not closing on its own.

2.2 Employment: the bluntest statement

The employment decision is the employer's decision, and the vendor's role in producing it does not displace the employer's responsibility. The Buyer who deploys a screening tool it cannot explain has purchased an exposure it cannot inspect.

Why it matters. The 2025 withdrawal of the EEOC's algorithmic technical assistance changed federal enforcement posture on disparate-impact theories; it changed nothing about the statutes, private rights of action, or the states, several of which now reach the Buyer directly.

2.3 Healthcare: the identification duty

Federally funded health programs must make reasonable efforts to identify the patient-care decision-support tools they use, and mitigate the discrimination risk. The duty is written for Buyers in everything but name.

Why it matters. The tools it reaches, risk scores, sepsis predictors, scheduling optimizers, arrive embedded in the electronic health record and in vendor software the institution adopted without evaluating as AI. A health system that strips its tool inventory because a rule may be revised has confused the obligation with the instrument that described it; the discrimination was unlawful before the rule named the tools.

2.4 Insurance: the program expectation

The insurer's written AI program is examined on the bought AI, not only the built. Insurance supervision states the non-transfer principle in its most operational form.

Why it matters. Over half the states now expect a written AI program covering third-party AI, with documentation producible in examination and an examiner tool arriving in late 2026. Colorado's life-insurance regime, binding the use of external data and models, survived the repeal of the state's comprehensive AI statute, evidence that sector supervision is the stable track.

Four regimes, four vocabularies, one principle: the deployment is the institution's act, and the accountability for it never signed the vendor contract.

The Buyer's program

If accountability does not transfer, the Buyer needs a program built for its actual vantage point: a vendor-embedded inventory, named ownership, escalation through the vendor relationship, and a record kept with built-AI discipline.

Why it matters. Each element answers what must be governed and who is accountable, with implementation left to the operational layers. The elements are the Caremark line's anatomy, translated to the Buyer who governs across an information boundary.

Build the program as if the AI were yours

Buying is deploying, deploying is the institution's act, and the act requires the same program the Caremark line demands for any mission critical risk.

The Buyer position feels safer than it is. The institution that builds nothing assumes it has delegated its AI risk along with its AI, and four bodies of law say otherwise in unison. Accountability stays home. Build the program as if the AI were yours, because in every forum that matters, it is. The program is the governance.