FWD-4 Control of AI decision data across vendors and borders

Fijishi Working Draft 4 – 14 October 2026

Stage 1 of 4: working draft. Not yet open for public comment, not a numbered version, and not the criteria Fijishi certifies against. This draft replaces, as a new version, the earlier paper "Privacy & Data Sovereignty Doctrine (PDSD)" (2023-2026); the earlier text is available on request. Standards in development

The question

When a vendor, or processing outside the firm's own jurisdiction, is involved in an AI decision, does the firm keep enough control over the data, records and model to explain, audit and keep operating its decisions – including if the vendor relationship ends?

Why it matters to firms

Many AI tools used in underwriting and claims are bought, not built. The firm remains accountable for decisions it does not fully control. What it can later show is largely settled by the contract it signs: access to records, notice of model changes, where data goes, and what happens on exit.

Principles

  1. Access: the firm can reach decision records and documentation when it needs them.
  2. Exit without loss: ending the contract does not end the firm's ability to explain past decisions.
  3. Notice of change: the vendor cannot change the model behind the firm's decisions without telling the firm first.
  4. Known location: the firm knows where its decision data is processed and stored.
  5. Limited use: the vendor uses the firm's data only as the firm agrees.

What a firm should be able to show (draft criteria)

  • FWD-4.1 A contractual right of access to decision records and system documentation for the life of the system and the retention period (FWD-2.3).
  • FWD-4.2 On exit, delivery of records and documentation in a usable form, within a set time, without conditions the firm cannot meet.
  • FWD-4.3 Notice from the vendor, before deployment, of model or version changes that affect the firm's decisions.
  • FWD-4.4 Knowledge of where decision data is processed and stored, sufficient to meet the firm's own cross-border data rules.
  • FWD-4.5 No use of the firm's data to train or improve models for others without the firm's written agreement.
  • FWD-4.6 Disclosure of sub-processors involved in the decision.
  • FWD-4.7 Audit rights the firm can exercise itself or through an independent party it appoints.

How it relates to existing rules and standards

  • Cross-border transfer and processor rules in data protection law, such as the EU's GDPR and India's Digital Personal Data Protection Act, 2023, apply on their own terms; this draft does not restate them.
  • Outsourcing and third-party risk rules for financial firms apply where they bind the firm.

Where it is used now

It informs FSDA and the Procurement Pre-Signature Review, which reads one contract for override independence, IP completeness and upgrade independence.

What happens next

Public comment follows FWD-1. Comments are welcome now: protocol@fijishi.com