State Bank Regulators Propose AI Risk Framework

The Conference of State Bank Supervisors released an optional framework for examining artificial intelligence use at state supervised banks, according to Banking Dive. The guidance includes an examiner guide, suggested procedures, a supplement for nonbanks, a risk worksheet and a list of supporting sources.

The framework proposes eight initial questions, including whether a bank uses AI, where it is deployed, how it affects customers or decisions, whether it comes from vendors, and whether sensitive information passes through it. Examiners would also consider generative AI use and how banks classify AI risks.

The framework defines three risk tiers. Tier 1 covers internal uses with human reviewed outputs, limited sensitive data and little potential harm. Tier 2 includes consumer facing or decision support uses with moderate data sensitivity or oversight based on exceptions. Tier 3 covers direct consumer outcomes, sensitive personal data, limited human review, significant operational reliance or material potential harm from failures.