What the CSBS AI Supervisory Framework tells financial institutions about the questions examiners may ask and the records they may review.
When a state examiner asks about artificial intelligence (AI), the answer may require input from several departments at a financial institution. The technology team may know which tools the institution purchased, while lending and servicing staff know how those tools are used. Management needs to bring those answers together, including what it knows about AI features within existing vendor products.
The Conference of State Bank Supervisors (CSBS) released its AI Supervisory Framework on September 16, 2026, to help state examiners review AI use and risk at state-chartered banks and state-licensed nonbank financial institutions. The published materials also included the questions and document requests that may come up during those reviews.
Institutions can use those materials to prepare. An AI policy will help explain the institution’s approach; however, management should also be able to show who approves AI use, how problems are identified, and what happens when a tool produces unreliable results.
What CSBS adds to AI supervision
Federal agencies have addressed aspects of AI risk through existing laws and guidance. In April 2026, the Federal Reserve, Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) issued revised model risk management guidance. However, that guidance expressly excludes generative (creates content based on prompts) and agentic (autonomously plans, decides, and executes multi-step workflows to achieve a goal) AI models, purportedly because those technologies are still developing.
The CSBS framework gives state examiners a way to identify AI use across an institution and decide which activities need closer review. The structure includes a Core Examiner Guide, an Examiner Work Program, nonbank supplements, and an optional worksheet for assessing use-case risk. Each state agency determines how extensively to incorporate the framework into its supervisory program.
Institutions operating in multiple states should check with their regulators about how the framework will be used in examinations. Although it provides a common starting point, each state agency will decide when to use it and how much of it to incorporate into its reviews.
What the framework means for institutions
The framework does not create new legal obligations or supervisory requirements. It is a discretionary resource, applied proportionately to an institution’s size, complexity, risk profile, and AI use.
Because the examination materials are public, institutions can review them before receiving a document request. Management can compare the questions with its current practices and identify where it needs better information, clearer responsibilities, or stronger controls.
For a smaller institution, a useful starting point may be a concise inventory, clear approval responsibilities, and documented controls for its most consequential uses. A more complex institution may need deeper coordination across business lines. Either way, employees responsible for AI oversight need to understand their roles and have the information and authority to perform them.
The first question: Do you know where AI is being used?
The Core Examiner Guide directs examiners to consider confirming a negative or unclear response about AI use against vendor and software inventories, approved tools, and recent platform changes. It also covers generative AI, including data controls, output review, and safeguards for systems that act with limited human direction.
Start by asking the departments that use the tools. Lending, servicing, compliance, anti-money laundering/fraud, marketing, operations, and technology staff may each know about uses that are missing from a central inventory. Ask vendors which features use AI and whether those features are active in your environment.
An institution may have approved one tool centrally while individual departments are using several others. A software update may introduce a capability that procurement never evaluated. If the inventory review uncovers either situation, management should determine how it happened and whether the approval or change process needs to be revised.
What examiners may ask to see
The guide’s document request list includes:
- Governance materials
- Inventories
- Risk assessments
- Monitoring and testing information
- Samples of AI-generated or AI-assisted consumer outputs, including notices and chatbot transcripts (where applicable)
Choose an AI use case that has a significant effect on the business or its customers and review the records supporting it. Look for the original approval, the compliance review, and any testing or monitoring results. If problems have occurred, the records should explain what the institution did about them.
Consider a tool that drafts servicing responses. A policy requiring employee review is a starting point. Management should also be able to show how reviewers detect incorrect information, escalate recurring errors, and check whether corrective actions were effective. Reviewing a sample of responses can help determine whether employees are following the policy and whether the review catches errors.
Vendor AI and consumer outcomes deserve particular attention
The Nonbank AI Supplements highlight vendor due diligence, data use, material changes, and oversight of outputs. Their consumer protection considerations address decision influence, specific and accurate reasons where required, proxy risks, differences in outcomes, and meaningful human review.
Lenders should look at how employees use AI recommendations when working with applicants. A tool does not need to make the final credit decision to influence which applications receive attention or how employees interpret information. Testing should reflect the way the institution actually uses the tool.
Vendor assurances can inform that review, but management should also seek evidence relevant to its own implementation. Where information is limited, document the limitation, assess its significance, and decide whether additional controls or restrictions are appropriate.
For example, a lender evaluating an AI tool that summarizes application files could test whether it consistently captures relevant income information and flags uncertainty for review. That exercise would help determine whether employees can safely rely on the summaries and where they need to consult the underlying file.
Preparing for an AI review
Management can use the framework to organize a review of its current AI practices:
- Confirm what is in use. Identify the AI capabilities the institution uses, assign an owner to each, and determine which warrant the closest review.
- Review how the controls work. Select several use cases and check how the institution handles approvals, employee use, vendor changes, and problems that require correction.
- Organize the supporting records. Gather the documentation management will need to explain its approach. Where the review identifies gaps, assign responsibility for addressing them and establish realistic completion dates.
Institutions do not need to wait for a broader federal AI rule to begin this work. CSBS has already published the questions state examiners may ask. Reviewing those questions now can help management identify what it can explain, what it can document, and where it still needs to make changes.
CrossCheck helps institutions review their AI governance programs, assess compliance and control gaps, and test how AI tools are used in lending and consumer communications. We work with management to identify concerns and develop recommendations that fit the institution’s operations.
Contact CrossCheck to discuss your institution’s AI governance and examination readiness.
Authored by Rebecca Escario
Learn More
- Explore CrossCheck’s AI governance services
- Read AI Governance in Financial Services: From Aspiration to Accountability
- View or subscribe to our industry publications
