CSBS Releases AI Examination Framework

The Conference of State Bank Supervisors (“CSBS”) recently released its AI Supervisory Framework. The new guidance offers tools for state examiners to use when examining banks’ implementation of AI tools.

The guidance includes a risk-tiering worksheet for banks to use when examining implementation of AI within their organization. The worksheet assigns low, moderate, and high-risk ratings to different bank AI use cases.

Among the highest risk uses of AI are instances where fully automated AI directly determines consumer outcomes. Examiners will be looking at the sensitivity of data provided to the system and whether humans are reviewing the AI decisions or output.

Regardless of the way that AI is used, the CSBS guidance recommends the following minimum safeguards:

• Maintenance of an AI inventory that identifies AI use cases and purposes;
• Written policy governing acceptable AI use that is periodically reviewed;
• Vendor contracts that address AI risks, including use by non-AI vendors;
• Training for staff on limitations and uses of AI;
• Controls over the quality of data provided to AI and then quality control over AI output;
• Third-party AI vendor contracts include audit rights; and
• Document the level of risk using the same tier matrix provided in the worksheet.

For higher-risk AI use cases, the guidance recommends additional steps such as independent model validation, ongoing monitoring of output, and appointing an AI governance board to oversee the implementation of AI. CSBS recommends that examiners request all written policies and inventories prior to commencing the examination.

Even if banks do not use AI for internal business purposes, they will soon confront a variety of challenges from consumer AI implementation. This blog previously covered the potential for increased disputes under the EFTA if agentic AI uses a consumer’s debit card to make unauthorized purchases. Banks should also ask outside vendors, including core processors and marketing vendors, about their use of AI to process proprietary bank and customer information.

Vendors are already offering AI-backed credit decision making platforms. Banks that may be exploring these options should pay careful attention to how these platforms ensure compliance with the Equal Credit Opportunity Act (“ECOA”) and Regulation B. Interest rates that vary just a few basis points between different categories of borrower can be enough to violate Regulation B, so banks must really dig into the decision-making process for any credit-related product. Even if the AI agent is only providing a summary of information for a credit committee to then decide on, bias in the AI agent could affect what information the credit committee sees.

Banks will increasingly have AI throughout their entire enterprise because AI is being added into existing software platforms. Even if a bank does not intend to implement AI, it will likely still be examined for its guardrails around AI components that are part of existing software. Bank management and their boards should take stock of the AI in their organizations.