Sound Practice 12 expects financial institutions to secure contractual rights covering audit access, data portability, security incident notification, and orderly service termination before deploying externally sourced AI systems.