State Bank Regulators Give Examiners a Road Map for AI Oversight

State financial regulators are beginning to define what artificial intelligence oversight looks like inside banks and FinTech companies, even without a comprehensive federal rule governing the technology’s use across financial services.

The Conference of State Bank Supervisors (CSBS) released an AI supervisory framework for examiners reviewing state-chartered banks and state-licensed nonbank financial institutions, according to a Sept. 16 press release. It gives examiners questions to ask, documents to request and ways to decide when an AI system warrants closer scrutiny. Each state agency will decide whether and how to use it, but the framework offers firms a view of what an examination may cover.

“The use of AI provides a powerful new tool for financial institutions to improve services, protect consumers and increase operating efficiency,” CSBS President and CEO Brandon Milhorn said in the release, adding the framework “provides a principles-based approach to governance.”

The examiner guide directs examiners to look for where AI is being used by institutions, including in products, operations, compliance and internal support functions, as well as AI built into third-party software. An institution uncertain whether it uses AI may face follow-up questions about its vendor and software inventories before an examiner closes the inquiry.

From there, examiners may request AI policies, use-case inventories, risk assessments, management reports, vendor contracts and testing records. For customer-facing systems, the list extends to samples of chatbot transcripts, notices and other AI-assisted communications. The framework also asks whether firms assign owners to AI uses, rank them by risk and revisit their controls as systems change.

Its treatment of agentic AI is particularly notable in light of the growing adoption of autonomous systems in commerce and financial institutions themselves. When a system can act with limited human direction, examiners are prompted to examine the boundaries on its actions, human checkpoints, logs, reversibility and the ability to stop it.

AI affecting consumers may also draw review under existing fair lending, disclosure, privacy and unfair practices standards. An AI-enabled underwriting tool, for example, could raise vendor, model risk and consumer protection issues at once.

The framework creates no new legal obligations, the guide said. Its significance lies in making AI use visible within established examination practices, while leaving individual states discretion over adoption.,

Firms should maintain clear governance, AI inventories and vendor oversight while monitoring how state agencies incorporate the framework into their programs, according to a Thursday (Sept. 17) advisory by Sheppard.

In a similar move, the New York State Department of Financial Services said in a Sept. 10 letter that regulated entities must keep cybersecurity risk assessments current when changes to their business or technology materially alter cyber risk. It identified AI, including frontier models, among the technologies that could require a fresh assessment.

The letter added no new obligations, but it said firms should be able to demonstrate how identified risks shaped their cybersecurity controls and decisions to accept risk.

California is approaching the issue from another direction. In an Aug. 31 blog post, Business and Consumer Services Agency Secretary Rohit Chopra said the newly formed agency will examine whether chatbots and other automated tools harm consumers or undermine licensing and consumer protection requirements. Its remit includes the state’s financial regulator.

A Sept. 10 Sheppard advisory said the announcement establishes no new requirements, but signals scrutiny of how regulated businesses use AI in consumer interactions and licensed activities.

Together, the developments point to a state-led approach built largely on existing authority. The practical question for financial institutions is whether they can show an examiner where AI operates, who is accountable for it, what risks it creates and how those risks are controlled. That record may matter as state regulators define the scope of AI supervision before a comprehensive federal framework takes shape.

For all PYMNTS AI coverage, subscribe to the daily AI newsletter.