The Conference of State Bank Supervisors (CSBS) on September 16, 2026 released an Artificial Intelligence Supervisory Framework designed to help state financial examiners identify and understand how the bank and non-bank institutions they regulate are using artificial intelligence, assess the associated risks, and determine when a more in-depth review may be appropriate.

The framework is significant because it provides state examiners with a common approach to AI supervision at a time when banks and nonbanks are rapidly expanding their use of AI, including generative and agentic AI. At the same time, CSBS emphasizes that the framework is a discretionary supervisory tool and does not establish new substantive requirements governing the use of AI.

CSBS is not the only group of regulators focused on artificial intelligence. The American Association of Residential Mortgage Regulators (AARMR), which is comprised of the state agencies who are responsible for supervising non-bank residential mortgage lenders, collaborated with the Mortgage Bankers Association on an industry survey conducted by the Boston Consulting Group as part of AARMR’s goal of understanding how mortgage companies are deploying AI across operations, risk management and compliance, while continuing to ensure consumers are protected. These same regulators will be determining whether they want to adopt the framework for the non-bank mortgage industry, and, if the past is any indication, we should expect wide-spread adoption and implementation of the framework.

A Risk-Based Supervisory Framework

CSBS says the framework is intended to take into account an institution’s size, complexity, risk profile, and particular uses of AI. It draws upon existing AI risk-management resources, including the National Institute of Standards and Technology’s AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury’s AI Lexicon.

The framework consists of several components. The Core Examiner Guide provides the basic examination approach, including initial scoping questions, a document request list, and procedures addressing AI governance and oversight, AI inventories and use cases, and generative AI and other emerging uses.

The Examiner Work Program provides additional guidance for applying the Core Examiner Guide. For nonbanks, the Nonbank AI Supplements address third-party and vendor risk, model risk, and consumer protection. CSBS also has developed an optional AI Use Case Risk Tiering Worksheet that can be used to assess individual AI applications and determine whether additional review may be appropriate.

The framework was approved by the CSBS State Supervisory Processes Committee and Nondepository Supervisory Committee in August. Each state financial regulatory agency will determine the extent to which it incorporates the framework into its supervisory program.

Why the Framework Matters

The most important point for financial institutions is that the framework does not itself impose new legal requirements. Rather, it gives state examiners a structured way to inquire into an institution’s use of AI and determine whether its existing governance, risk-management, and compliance processes adequately address the risks presented by those uses.

That distinction is important. CSBS expressly describes the framework as a “discretionary tool.” It also emphasizes that the supervisory approach should reflect the institution’s size, complexity, risk profile, and use of AI.

Thus, the framework appears designed to avoid a one-size-fits-all approach. The supervisory concerns presented by an employee using a generative AI application to summarize documents, for example, are quite different from those presented by an AI system that materially influences credit decisions or determines how a consumer is treated.

AI Inventories and Third-Party Risk

One practical consequence of the framework is that financial institutions should be able to identify where AI is being used throughout their organizations.

An institution should know what its material AI use cases are, which business functions use AI, whether the technology was developed internally or supplied by a third party, and what risks each use case presents. Institutions also should be prepared to explain who is responsible for AI governance and how AI-related risks fit within existing risk-management and compliance programs.

The framework’s specific attention to third-party and vendor risk will be particularly important for nonbanks. Many financial services companies will not develop their own AI systems. Instead, AI capabilities increasingly will be incorporated into products and services provided by vendors. State examiners therefore may focus on how institutions evaluate and monitor those vendors and determine whether their AI-related practices create risks for the institution or its customers.

This effort to identify third-party risk management issues in AI systems appears to fill a gap in guidance from federal banking regulators. The Interagency Guidance on Third-Party Relationships issued in 2023 by the OCC, FDIC, and Federal Reserve takes a “broad, principles-based approach [without addressing] specific topics or types of relationships,” and opted to avoid AI-specific guidance. The agencies most recent TPRM proposal to replace the 2023 guidance, which we wrote about here, also takes a broad approach, focusing broadly on “material financial risks and violations of laws and regulations rather than ineffective and counter-productive check the-box exercises.” Similarly, the 2026 revisions to the OCC, FDIC, and Federal Reserve’s Supervisory Guidance on Model Risk Management expressly excludes generative and agentic AI. So, even if imperfect, the framework provides financial institutions with targeted governance measures to consider – and sets potential supervisory expectations – as they develop and deploy a variety of AI tools.

Generative and Agentic AI

The framework’s treatment of generative AI and other emerging AI applications also is noteworthy. Traditional model-risk-management concepts do not necessarily fit neatly with every use of generative or agentic AI.

Financial institutions increasingly are using these technologies for customer service, fraud detection, document review, coding, marketing, underwriting support, and other functions that may not resemble traditional models. The supervisory questions therefore cannot be limited to conventional model validation.

The challenge for regulators and financial institutions will be developing controls that address genuine risks without imposing unnecessarily burdensome requirements on relatively low-risk uses of AI.

What Financial Institutions Should Do Now

Although the framework does not establish new regulatory requirements, institutions subject to state supervision may want to use it as a roadmap for preparing for their next examination.

In particular, institutions should consider whether they can readily answer basic questions concerning their AI inventory, governance structure, risk assessments, third-party providers, consumer-protection controls, and use of generative and other emerging AI technologies.

The significance of the framework ultimately will depend on how individual state regulators implement it. CSBS has made clear that each state agency will determine the extent to which it incorporates the framework into its supervisory program. The framework therefore does not necessarily mean that every state examiner will immediately conduct a separate AI examination.

Nevertheless, it gives state regulators a common set of tools and questions that can be incorporated into existing examinations. For financial institutions, that means AI supervision is moving from a largely conceptual issue toward a more concrete component of state supervisory examinations.

The CSBS Artificial Intelligence Supervisory Framework and its component materials are available from CSBS.