The 60-second brief
- 1CSBS released an AI supervisory framework for state examiners on September 16, 2026, covering state banks and licensed nonbanks.
- 2It sorts AI uses into three risk tiers and asks whether AI is internal, vendor-supplied or embedded in vendor products.
- 3Adoption is up to each state agency, and the framework creates no new legal requirements.
- Risk tiers for AI use cases
- 3
- Share of FDIC-insured institutions supervised by state regulators (Banking Dive)
- Nearly 80%
- FDIC-insured institutions (Banking Dive)
- 4,233
- Framework documents
- 5
Why CEOs should care
For fintech CEOs whose companies hold state licenses, such as money transmitters and consumer lenders, the nonbank supplements are the part to read first. Expect examiners to request an AI inventory: every material use case, the business function it supports, whether it was built or bought, who owns it and how it is tested. Firms that cannot produce that list quickly will look weak on governance even if their models perform well.
CISOs and chief risk officers should focus on two questions the framework raises: where sensitive customer data flows through AI tools, and which vendors have added AI to products you already use. Ask your top vendors in writing whether their products now include generative or agentic AI features, what data those features see and whether you can switch them off. Map each use to the three tiers before an examiner does it for you.
Boards and CFOs should treat this as the start of AI appearing in routine state exams. Because adoption is state by state, multistate operators could face uneven expectations. Budget for a single enterprise AI register that satisfies the strictest state you operate in, rather than building state-specific answers.
Key takeaways
- CSBS released an AI supervisory framework for state examiners on September 16, 2026, covering state banks and licensed nonbanks.
- It sorts AI uses into three risk tiers and asks whether AI is internal, vendor-supplied or embedded in vendor products.
- Adoption is up to each state agency, and the framework creates no new legal requirements.
The news
On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released an AI supervisory framework to help state examiners identify how state-chartered banks and state-licensed nonbank financial firms use artificial intelligence, assess the risks and decide when deeper review is warranted.
The package includes a core examiner guide with scoping questions, document requests and procedures on AI governance, inventories and generative AI; an examiner work program; supplements for nonbanks covering vendor risk, model risk and consumer protection; an optional worksheet for rating the risk of individual AI use cases; and a list of source materials. CSBS said it drew on the National Institute of Standards and Technology's AI Risk Management Framework, the Cyber Risk Institute's financial services AI framework and the Treasury Department's AI lexicon.
Banking Dive reported on September 17 that the worksheet sorts AI uses into three tiers. Low-risk uses are internal, with human-reviewed outputs. Moderate-risk uses touch consumers or support decisions. High-risk uses directly affect consumer outcomes, involve sensitive personal data or run with limited human review. Examiners are directed to ask where a firm uses AI, whether it was built internally or bought, whether vendors have embedded AI in their products, and whether sensitive data passes through AI systems.
CSBS describes the framework as discretionary. Each state agency decides whether and how to use it, and law firm Ballard Spahr noted in a September 18 post that it does not create new substantive legal requirements. CSBS president and CEO Brandon Milhorn called it a "principles-based approach" meant to help institutions adopt AI with more confidence.
The framework arrives as federal guidance leaves a gap. Banking Dive and Ballard Spahr both noted that the federal banking agencies' updated model risk guidance excludes generative and agentic AI. According to Banking Dive, state regulators supervise nearly 80% of the nation's 4,233 FDIC-insured institutions.
The numbers
- Risk tiers for AI use cases
- 3
- Share of FDIC-insured institutions supervised by state regulators (Banking Dive)
- Nearly 80%
- FDIC-insured institutions (Banking Dive)
- 4,233
- Framework documents
- 5
Why CEOs should care
For fintech CEOs whose companies hold state licenses, such as money transmitters and consumer lenders, the nonbank supplements are the part to read first. Expect examiners to request an AI inventory: every material use case, the business function it supports, whether it was built or bought, who owns it and how it is tested. Firms that cannot produce that list quickly will look weak on governance even if their models perform well.
CISOs and chief risk officers should focus on two questions the framework raises: where sensitive customer data flows through AI tools, and which vendors have added AI to products you already use. Ask your top vendors in writing whether their products now include generative or agentic AI features, what data those features see and whether you can switch them off. Map each use to the three tiers before an examiner does it for you.
Boards and CFOs should treat this as the start of AI appearing in routine state exams. Because adoption is state by state, multistate operators could face uneven expectations. Budget for a single enterprise AI register that satisfies the strictest state you operate in, rather than building state-specific answers.
The bigger picture
Supervisory attention to AI is moving from principles to exam procedures, and states are moving first. Ballard Spahr noted that the American Association of Residential Mortgage Regulators has worked with the Mortgage Bankers Association on an AI survey and will decide whether to apply the framework to nonbank mortgage lenders. At the federal level, the Commodity Futures Trading Commission's innovation task force scheduled an October 28 forum focused on AI and agentic finance, according to a Lowenstein Sandler newsletter. For financial firms experimenting with AI agents that act for customers, state examiners may be the first regulators to ask how those agents are governed.
What's next
Watch which state agencies formally adopt the framework and fold it into exam schedules, and whether mortgage regulators apply it to nonbank lenders. Firms should expect AI inventory and vendor questions in upcoming state exam request letters and prepare answers ahead of time, starting with the high-risk uses that touch credit, fraud and customer data.
Sources
- PrimaryCSBS announces AI supervisory framework— Conference of State Bank Supervisors
- PrimaryCSBS Artificial Intelligence Supervisory Framework— Conference of State Bank Supervisors
- ReportState regulators float AI framework for banks, examiners— Banking Dive
- ReportCSBS releases artificial intelligence supervisory framework for state examiners— Consumer Finance Monitor (Ballard Spahr)
- ReportFinTech Five - September 22, 2026— Lowenstein Sandler
Spotted an error? Request a correction. Read our editorial standards and AI policy.
The Daily Brief
The technology briefing for people running businesses.
Weekdays at 6 a.m. ET. Free.
