On September 16, CSBS published an AI supervisory framework providing state examiners with discretionary tools to identify AI use at state-chartered banks and state-licensed nonbank financial companies, assess associated risks, and determine when deeper review may be warranted. According to the announcement, the framework is designed to be applied in a manner proportionate to each institution’s size, complexity, risk profile, and use of AI. It draws on existing public resources, including the National Institute of Standards and Technology’s AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and Treasury’s AI Lexicon. The framework, which CSBS approved in August, does not create new legal obligations or supervisory requirements.

The framework’s core examiner guide directs examiners to scope whether an institution uses AI at all — including AI embedded in vendor products that may not be recognized as distinct AI use — and then to assess governance structures, AI inventories, and risk-based tiering of use cases. An accompanying examiner work program sets out detailed procedures for applying the guide. A dedicated section addresses generative AI, large language models, and agentic AI systems that can take actions with limited human direction, which the framework notes existing model risk resources may not fully address. For these systems, examiners may review human checkpoints, logging, reversibility, and the ability to restrict or halt the system. Separate nonbank supplements overlay AI-specific considerations onto existing supervisory resources for third-party and vendor oversight, model risk, and consumer protection at nonbank financial institutions. An optional risk tiering worksheet allows institutions to self-assess individual use cases across four factors: consumer impact, human oversight, harm potential from errors or outages, and data sensitivity. CSBS noted that each state financial regulatory agency will determine the extent to which it incorporates the framework into its supervisory programs, and that financial institutions can use the framework to assess their own AI programs, establish sound AI governance, and prepare for examinations.