CSBS Releases AI Supervisory Framework for Financial Institutions

The Conference of State Bank Supervisors (CSBS) recently released a new Artificial Intelligence Supervisory Framework. The resource is designed to help state examiners assess the use of AI and related risks at state-chartered banks and state-licensed nonbank financial institutions.

It also gives regulated institutions greater visibility into the general approach, questions, and information requests they may encounter during an examination. Financial institutions can use the framework now to evaluate AI programs, strengthen governance and risk management, and prepare for supervisory review.

What is the CSBS AI Framework?

The CSBS AI framework is a discretionary tool for state examiners to identify and understand how financial institutions use AI, assess associated risks, and determine when a deeper review may be appropriate.

It is designed to account for each institution’s size, complexity, risk profile, and use of AI. CSBS based the framework on established resources, including:

• The National Institute of Standards and Technology AI Risk Management Framework
• The Cyber Risk Institute Financial Services AI Risk Management Framework
• The U.S. Department of the Treasury AI Lexicon

Each state financial regulatory agency will determine how extensively to incorporate the framework into its supervisory program.

The framework includes a Core Examiner Guide, an Examiner Work Program, Nonbank AI Supplements, an AI Use Case Risk Tiering Worksheet, and a source support document. The materials address areas such as governance and oversight, AI inventories and use cases, generative AI and emerging use, third-party and vendor risk, model risk, and consumer protection.

Who is impacted by the CSBS AI Framework?

The framework is relevant to state-chartered banks and state-licensed nonbank financial institutions that use or evaluate AI-based products, services, and tools. Within those organizations, the release is particularly relevant to leaders responsible for governance, risk, compliance, technology, data, information security, consumer protection, operations, and examination management. CSBS designed the framework to scale to the institution’s circumstances rather than to apply a single approach regardless of size, complexity, risk profile, or AI use.

The framework does not create a stated compliance deadline, but it provides a practical reference point for readiness.

1. Start by reviewing the Core Examiner Guide and supporting materials through the lens of your current AI environment.
2. Confirm that your institution can clearly explain and document where AI is used, who is accountable for its oversight, how individual use cases are evaluated for risk, and what documentation supports those decisions.
3. Bring stakeholders from leadership, risk, compliance, technology, data, information security, and operations into the review so that responsibilities and responses are aligned.
4. Monitor how your relevant state regulator incorporates the framework into its supervisory program.

Because adoption will be determined by individual state agencies, institutions should watch for state-specific guidance and examination practices as they develop.

What’s Next for the CSBS AI Framework and Financial Institutions

The CSBS framework provides financial institutions with useful insight into the questions state examiners may ask about AI. Use it to compare your current AI governance and risk management practices with supervisory expectations, organize supporting information, and identify practical gaps before your next examination.

Eide Bailly can help you evaluate AI governance, technology risk, cybersecurity, and regulatory readiness so your institution can move forward with greater clarity and confidence.