What's Happening?
The Conference of State Bank Supervisors (CSBS) has issued its AI Supervisory Framework on September 16, establishing clear expectations for how state-chartered banks and state-licensed nonbank financial institutions should govern their use of artificial
intelligence. This framework provides state examiners nationwide with a standardized method for reviewing AI applications and outlines the questions and documentation institutions should anticipate during examinations. The CSBS framework is designed to help institutions align their AI programs with regulatory expectations, especially as federal guidance on generative and agentic AI remains limited. Connecticut has already implemented formal AI governance guidance, requiring regulated entities to maintain a written AI governance plan, while New York's Department of Financial Services has incorporated AI adoption as an emerging risk into its cybersecurity risk assessment requirements. These state-level initiatives are filling gaps left by federal guidance, which has not yet fully addressed the rapid advancements in AI technology.
Why It's Important?
This development is significant because state regulators oversee 79% of all U.S. banks, giving the CSBS framework substantial influence over the financial industry. The framework's risk-based approach, drawing from nationally recognized guidance like NIST and the Cyber Risk Institute, is likely to shape regulatory expectations across the entire sector. Financial institutions that proactively align their AI governance programs with this framework will be better positioned for future regulatory scrutiny and compliance. Conversely, those that delay may face increased costs and challenges in building compliant programs under greater pressure. The emphasis on embedded vendor AI also highlights a critical area where many institutions may be using more AI than they realize, necessitating a thorough inventory and oversight of third-party tools. This push for clear AI governance aims to ensure the safe and responsible use of AI systems, protecting consumers and maintaining financial stability.
What's Next?
In the coming months, financial institutions are expected to review and adapt their AI governance programs to align with the CSBS framework and emerging state-specific guidance. Examiners are not yet conducting AI-specific reviews at scale, providing a window for institutions to build documented, cross-functional governance programs. As generative and agentic AI capabilities become more integrated into core systems and customer-facing applications, regulators will likely raise their expectations further. Institutions should anticipate increased scrutiny on their AI inventories, use cases, and existing supervisory areas such as third-party oversight, model risk, and consumer protection. The CSBS encourages institutions to use the framework for self-assessment to prepare for future examinations. More states are expected to follow Connecticut and New York in issuing their own AI governance guidance, creating a more comprehensive regulatory landscape for AI in finance.
Beyond the Headlines
The proactive stance of state bank regulators in establishing AI governance frameworks underscores a broader trend of regulatory bodies attempting to keep pace with rapid technological advancements. This move highlights the challenges of regulating emerging technologies where federal guidance may lag. The CSBS framework's emphasis on accountability, consumer data protection, and adherence to industry standards reflects growing concerns about the ethical implications and potential biases of AI systems. By requiring institutions to document their AI governance plans and conduct risk assessments, regulators are pushing for greater transparency and control over AI's impact. This could lead to a more standardized approach to AI risk management across the financial sector, fostering trust in AI applications while mitigating potential harms. The framework also signals a shift towards recognizing that AI is not just a technological tool but a critical component of operational risk that requires robust oversight.
