New AI Supervisory Framework Aims to Assess Industry-Wide Use and Risks
By W.B. King
With the goal of providing clarity on all things AI, the Conference of State Bank Supervisors (CSBS) released a “new supervisory resource” to support state examiners in assessing the use and risks at state-chartered banks and state-licensed nonbank financial institutions.
“The use of AI provides a powerful new tool for financial institutions to improve services, protect consumers, and increase operating efficiency,” said Brandon Milhorn, President and CEO of the Washington, D.C.-based CSBC. The organization supports a network of financial regulators from all 50 states, American Samoa, District of Columbia, Guam, Puerto Rico, and U.S. Virgin Islands.
“While any new technology can present risks, the CSBS AI Supervisory Framework provides a principles-based approach to governance intended to help financial institutions explore and implement AI with additional confidence,” Milhorn added.
Credit unions were not explicitly named, but they are practically and indirectly impacted by the new framework.
According to CSBS, state regulators supervise 79% of all U.S. banks and a variety of non-depository financial services. CSBS, on behalf of state regulators, also operates the Nationwide Multistate Licensing System to license and register non-depository financial service providers in the mortgage, money services businesses, consumer finance, and debt industries.
Understanding Risk Management
The new supervisory resource, also knowns as The CSBS Artificial Intelligence Supervisory Framework, was designed to consider each institution’s size, complexity, risk profile, and use of AI, CSBS offered. “The framework is based on leading AI risk management resources, including the National Institute of Standards and Technology’s AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury’s AI Lexicon.”
Each state financial regulatory agency, Milhorn noted, determines the extent to which this framework is incorporated into respective supervisory programs. The framework, which went live on September 16, was approved by the CSBS State Supervisory Processes Committee (SSPC) and the CSBS Non-Depository Supervisory Committee (NDSC) in August 2026.
The framework consists of the following guidelines:
Core Examiner Guide: Provides the core examination approach for identifying and understanding AI use, including initial scoping questions, a document request list, and procedures for governance and oversight, AI inventory and use cases, and generative AI and emerging use.
Examiner Work Program: Provides additional detail and guidance for applying the Core Examiner Guide.
Nonbank AI Supplements: Provides additional guidance for reviewing third-party and vendor risk, model risk, and consumer protection at nonbank financial services companies.
AI Use Case Risk Tiering Worksheet: An optional industry tool to support a risk-based assessment of individual AI use cases and to help examiners determine where additional review may be appropriate.
The Source Support Document: Identifies the supervisory and risk management materials that were used in the development of the framework.
