The Conference of State Bank Supervisors released an Artificial Intelligence Supervisory Framework Tuesday that gives state-chartered banks and nonbank financial institutions a detailed view of what examiners will look for when reviewing AI use. The framework fills a gap left open by federal regulators, who explicitly excluded generative and agentic AI from their latest model-risk guidance in April.
The CSBS framework provides examiners with a process for identifying AI use, evaluating associated risks and deciding when a deeper review is appropriate. It includes a core examiner guide, a detailed work program, supplements for nonbank financial companies and a worksheet for placing individual AI uses into risk tiers. The core guide covers governance, oversight, AI inventories, specific use cases, generative AI and other emerging applications.
What examiners will investigate
Rather than issuing broad instructions to manage AI responsibly, the framework identifies the records, controls and governance practices that examiners may probe. An examiner may want to know who owns an application, where it operates, which data it can access, which vendor provides it and which business or consumer decisions it can influence.
For nonbanks, the framework extends into third-party risk, model risk and consumer protection. That could affect FinTechs, lenders, payments companies and technology platforms that operate under state licenses or sell services to regulated institutions. The framework is discretionary, not a nationwide mandate. Each state regulator will decide how extensively to use it, and reviews are supposed to reflect an institution's size, complexity, risk profile and level of AI adoption.
The federal gap
The Office of the Comptroller of the Currency, Federal Reserve and Federal Deposit Insurance Corp. updated their joint model-risk guidance in April but left generative and agentic AI outside its scope. The agencies described those technologies as novel and rapidly evolving. They said they planned a separate request for information addressing banks' use of AI. That leaves state-regulated institutions facing a wider practical governance perimeter than current federal guidance defines.
Traditional model-risk programs tend to focus on how a model was developed, validated and monitored. The state framework points toward a broader examination of the entire AI system. Maintaining an AI inventory may no longer be enough. Institutions will need to connect each entry to an accountable owner, documented purpose, risk classification, vendor relationship and set of controls. They also may need evidence showing that those controls work.
What technology providers should expect
Technology providers should prepare for more detailed requests from financial institution customers. Banks may seek documentation about training data, testing, monitoring, security, human oversight and the actions an AI agent is permitted to take. The shift moves from managing models as isolated analytical tools to managing AI as part of a larger operating system. A model can produce an answer. A generative or agentic system may retrieve customer information, call outside tools and initiate actions.
For professionals working in regulatory affairs, understanding these examination expectations is becoming a practical necessity. AI Regulatory Compliance Courses can help teams build the documentation and governance practices that state examiners are now outlining. CSBS has not created a binding national standard. It has, however, shown institutions what an AI examination can look like. That may be enough to influence how banks document, purchase and deploy the technology before federal regulators complete their next move.
Why this matters for finance, insurance and legal professionals
The framework signals that AI governance is moving from principle to practice. For legal and compliance teams, the immediate task is mapping existing AI use against the examination areas the CSBS has identified - ownership, data access, vendor relationships and control evidence. For risk managers, the framework adds a layer of expected documentation that federal guidance has not yet required. Institutions that wait for a final federal rule may find state examiners are already asking questions.
Your membership also unlocks:
