From Pymnts · PYMNTS · · 1m 40s
States fill federal AI gap with bank exam playbook
State regulators release a framework for examining AI in banks, filling a void left by federal agencies that excluded generative AI from guidance.
In brief
State regulators release a framework for examining AI in banks, filling a void left by federal agencies that excluded generative AI from guidance. Banks now have a clearer roadmap for AI governance, but must prepare for deeper scrutiny beyond simple model risk management. Originally reported by Pymnts.
States release AI exam framework
The Conference of State Bank Supervisors released an AI Supervisory Framework on September 16 for state-chartered banks and nonbank financial institutions. It gives examiners a process for identifying AI use, evaluating risks, and deciding when deeper review is needed.
Framework includes detailed exam tools
The framework contains a core examiner guide, detailed work program, supplements for nonbanks, and a worksheet for risk classification. It covers governance, oversight, AI inventories, generative AI, and emerging applications.
Federal guidance left generative AI out
The OCC, Federal Reserve, and FDIC updated model-risk guidance in April but excluded generative and agentic AI, calling them novel and rapidly evolving. This left state-regulated institutions with a wider governance gap than federal guidance covers.
Exams now look beyond model risk
Traditional model-risk programs focus on development and validation. The state framework examines the entire AI system, including ownership, data access, vendor relationships, and business decisions it influences.
Banks need AI inventory with accountability
Maintaining an AI inventory is no longer enough. Banks must connect each entry to an accountable owner, documented purpose, risk classification, vendor relationship, and evidence that controls work.
Vendors face deeper customer scrutiny
Technology providers should prepare for detailed requests about training data, testing, monitoring, security, human oversight, and permitted AI agent actions. Banks will demand documentation before deploying AI systems.
The takeaway
Banks now have a clearer roadmap for AI governance, but must prepare for deeper scrutiny beyond simple model risk management.
