CSBS releases AI Supervisory Framework for state-regulated financial institutions

The Conference of State Bank Supervisors released a new supervisory resource to support state examiners in assessing the use and risks of artificial intelligence (AI) at state-chartered banks and state-licensed nonbank financial institutions. CSBS announced the release on September 16, 2026, after the framework was approved by the CSBS State Supervisory Processes Committee (SSPC) and the CSBS Non Depository Supervisory Committee (NDSC) in August 2026.

What it is

The framework is a discretionary tool, meaning it creates no binding legal obligations on its own and each state financial regulatory agency will determine the extent to which this framework is incorporated into their supervisory programs. It is built on leading AI risk management resources, including the National Institute of Standards and Technology's AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury's AI Lexicon.

What it requires

The Core Examiner Guide provides the core examination approach for identifying and understanding AI use, including initial scoping questions, a document request list, and procedures for governance and oversight, AI inventory and use cases, and generative AI and emerging use. That guide centers on an eight-question initial scoping questionnaire for examiners to use during examinations, covering customer-facing AI use, reliance on third parties for AI use and handling of sensitive data with respect to AI processing. A companion Examiner Work Program, this 28-page companion document expands each scoping question and procedure with additional guidance, source citations and specific areas of supervisory focus. An optional AI Use Case Risk Tiering Worksheet is designed to support a risk-based assessment of individual AI use cases and to help examiners determine where additional review may be appropriate, assigning each AI use case a risk tier from 1 (lowest) to 3 (highest) based on consumer impact, human oversight, potential harm from errors or outages, and data sensitivity.

What security leaders should do

Security and compliance leaders at state-chartered banks and state-licensed nonbanks should treat the CSBS framework as a preview of how examiners will ask about AI, and complete a self-assessment against the Core Examiner Guide's scoping questions before an examiner does. Teams should build or update an AI inventory covering both internally built tools and vendor-embedded AI, apply the risk-tiering approach with documented rationale for each classification, and revisit vendor contracts for AI-specific data use, training-data and incident-disclosure terms. Because the framework explicitly calls out agentic AI permission boundaries, human checkpoints and logging, security leaders overseeing agentic deployments should ensure those controls, along with reversibility and the ability to halt actions, are documented and testable ahead of any examination.