State Regulators Unveil AI Supervisory Framework for Financial Institutions
September 21, 2026
By: Brett J. Ashton, Michael J. Messaglia, David A. Bowen, Keaton J. Miller, and Maria Vladimirova Geltz
Artificial intelligence (AI) continues to attract significant regulatory attention. Yet, in the absence of comprehensive federal AI legislation and amid a growing patchwork of state requirements, many financial institutions remain uncertain about how regulators expect them to identify, manage, and govern AI-related risks.
In April 2026, the Federal Reserve, Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) issued their Revised Guidance on Model Risk Management, SR 26-2. While the guidance is most relevant to banking organizations with more than $30 billion in assets, it expressly excludes generative AI and agentic AI from its scope. Credit unions have received even less direct guidance. To date, the National Credit Union Administration (NCUA) has not issued formal AI supervisory guidance and instead directs institutions to existing regulations and resources, several of which are incorporated into the framework discussed below.
On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released its Artificial Intelligence Supervisory Framework (the "Framework"), which may be the most comprehensive regulatory guidance on AI issued to date and the first examination-focused AI guidance specifically directed at state-supervised financial institutions.
The Framework is designed to help state examiners identify and understand how financial institutions use AI, assess the resulting risks, and determine whether additional review is warranted using existing supervisory resources. To accomplish this objective, CSBS developed a Core Examiner Guide and a detailed Examiner Work Program. The Framework draws heavily from established industry resources, including the National Institute of Standards and Technology's (NIST) AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury's AI Lexicon.
Although the Framework is not legally binding and state regulators retain discretion regarding how it is incorporated into examination procedures, state-chartered and state-licensed financial institutions should expect examiners to apply substantially similar standards during future examinations.
Recommended Actions for Financial Institutions
As regulators continue to refine their expectations regarding AI oversight, financial institutions should proactively establish governance structures and risk management processes that will withstand increasing supervisory scrutiny. We recommend that every state-chartered bank and credit union, as well as state-licensed mortgage lenders, mortgage servicers, consumer lenders, money transmitters, debt collectors, and similar licensees take the following steps before their next examination:
- Conduct a self-assessment against the Framework.
- Develop or update a comprehensive AI inventory that includes AI capabilities embedded within third-party products and vendor solutions.
- Identify and document all material AI use cases.
- Assign an appropriate risk tier to each use case and maintain written support for the institution's risk classification and governance decisions.
Institutions that take these steps now will be better positioned to respond to examiner inquiries and demonstrate a thoughtful approach to AI risk management.
AI Supervisory Framework: Key Components
The Framework consists of five documents:
- Core Examiner Guide - provides initial scoping questions, document requests, and examination procedures focused on governance and oversight, AI inventories and use cases, and generative AI and other emerging applications.
- Examiner Work Program - expands upon the Core Examiner Guide by providing additional examiner procedures, source citations, and detailed areas of supervisory focus.
- Nonbank AI Supplement - addresses AI-related risks at nonbank financial services companies, with particular emphasis on third-party oversight, vendor management, model risk, and consumer protection considerations.
- AI Use Case Risk Tiering Worksheet - an optional tool designed to help institutions evaluate and categorize individual AI use cases according to risk.
- Source Support Document - identifies and consolidates the regulatory, industry, and technical resources that form the foundation of the Framework.
Why the Framework Matters
Some institutions may view the Framework as another layer of regulatory oversight. However, it also provides a practical roadmap for evaluating AI deployments, identifying potential risks, and establishing baseline governance controls. As AI adoption accelerates across the financial services industry, institutions that understand their AI environment and can articulate how associated risks are managed will be better prepared for supervisory scrutiny.
How Krieg DeVault Can Help
Krieg DeVault attorneys are actively monitoring developments in AI law and regulation affecting financial institutions and can assist your institution with preparing for examinations conducted under the Framework and similar regulatory standards, drafting and reviewing AI governance policies, procedures, and acceptable-use standards, evaluating vendor agreements and AI-as-a-service contracts, including provisions addressing AI functionality, data ownership, data use, and risk allocation, and assessing consumer-facing AI applications for compliance with the Equal Credit Opportunity Act (ECOA), fair lending requirements, unfair or deceptive acts or practices (UDAP), and unfair, deceptive, or abusive acts or practices (UDAAP).
Disclaimer: The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have.
Practices
Industries
September 21, 2026
By: Brett J. Ashton, Michael J. Messaglia, David A. Bowen, Keaton J. Miller, and Maria Vladimirova Geltz
Artificial intelligence (AI) continues to attract significant regulatory attention. Yet, in the absence of comprehensive federal AI legislation and amid a growing patchwork of state requirements, many financial institutions remain uncertain about how regulators expect them to identify, manage, and govern AI-related risks.
In April 2026, the Federal Reserve, Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) issued their Revised Guidance on Model Risk Management, SR 26-2. While the guidance is most relevant to banking organizations with more than $30 billion in assets, it expressly excludes generative AI and agentic AI from its scope. Credit unions have received even less direct guidance. To date, the National Credit Union Administration (NCUA) has not issued formal AI supervisory guidance and instead directs institutions to existing regulations and resources, several of which are incorporated into the framework discussed below.
On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released its Artificial Intelligence Supervisory Framework (the "Framework"), which may be the most comprehensive regulatory guidance on AI issued to date and the first examination-focused AI guidance specifically directed at state-supervised financial institutions.
The Framework is designed to help state examiners identify and understand how financial institutions use AI, assess the resulting risks, and determine whether additional review is warranted using existing supervisory resources. To accomplish this objective, CSBS developed a Core Examiner Guide and a detailed Examiner Work Program. The Framework draws heavily from established industry resources, including the National Institute of Standards and Technology's (NIST) AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury's AI Lexicon.
Although the Framework is not legally binding and state regulators retain discretion regarding how it is incorporated into examination procedures, state-chartered and state-licensed financial institutions should expect examiners to apply substantially similar standards during future examinations.
Recommended Actions for Financial Institutions
As regulators continue to refine their expectations regarding AI oversight, financial institutions should proactively establish governance structures and risk management processes that will withstand increasing supervisory scrutiny. We recommend that every state-chartered bank and credit union, as well as state-licensed mortgage lenders, mortgage servicers, consumer lenders, money transmitters, debt collectors, and similar licensees take the following steps before their next examination:
- Conduct a self-assessment against the Framework.
- Develop or update a comprehensive AI inventory that includes AI capabilities embedded within third-party products and vendor solutions.
- Identify and document all material AI use cases.
- Assign an appropriate risk tier to each use case and maintain written support for the institution's risk classification and governance decisions.
Institutions that take these steps now will be better positioned to respond to examiner inquiries and demonstrate a thoughtful approach to AI risk management.
AI Supervisory Framework: Key Components
The Framework consists of five documents:
- Core Examiner Guide - provides initial scoping questions, document requests, and examination procedures focused on governance and oversight, AI inventories and use cases, and generative AI and other emerging applications.
- Examiner Work Program - expands upon the Core Examiner Guide by providing additional examiner procedures, source citations, and detailed areas of supervisory focus.
- Nonbank AI Supplement - addresses AI-related risks at nonbank financial services companies, with particular emphasis on third-party oversight, vendor management, model risk, and consumer protection considerations.
- AI Use Case Risk Tiering Worksheet - an optional tool designed to help institutions evaluate and categorize individual AI use cases according to risk.
- Source Support Document - identifies and consolidates the regulatory, industry, and technical resources that form the foundation of the Framework.
Why the Framework Matters
Some institutions may view the Framework as another layer of regulatory oversight. However, it also provides a practical roadmap for evaluating AI deployments, identifying potential risks, and establishing baseline governance controls. As AI adoption accelerates across the financial services industry, institutions that understand their AI environment and can articulate how associated risks are managed will be better prepared for supervisory scrutiny.
How Krieg DeVault Can Help
Krieg DeVault attorneys are actively monitoring developments in AI law and regulation affecting financial institutions and can assist your institution with preparing for examinations conducted under the Framework and similar regulatory standards, drafting and reviewing AI governance policies, procedures, and acceptable-use standards, evaluating vendor agreements and AI-as-a-service contracts, including provisions addressing AI functionality, data ownership, data use, and risk allocation, and assessing consumer-facing AI applications for compliance with the Equal Credit Opportunity Act (ECOA), fair lending requirements, unfair or deceptive acts or practices (UDAP), and unfair, deceptive, or abusive acts or practices (UDAAP).
Disclaimer: The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have.