What happened
CSBS released on Sept 16, 2026 a new Artificial Intelligence Supervisory Framework (csbs.org) giving state examiners a discretionary, risk-based tool to identify and understand AI at financial institutions, assess associated risks, and decide when deeper review is warranted. It is calibrated to institution size/complexity/risk profile and draws on NIST's AI RMF, the Cyber Risk Institute's Financial Services AI Risk Management Framework, and the US Treasury AI Lexicon; it covers governance and oversight, AI inventory/use cases, and generative AI, with an examiner guide of scoping questions, document-request lists and procedures.
Why it matters
This is the first coordinated state-level AI supervisory framework in US financial services, filling a governance gap left because federal OCC/FDIC/Fed model-risk guidance revisions expressly exclude generative and agentic AI. It sets de-facto examination expectations for how state-regulated institutions must govern AI and agentic systems, giving firms a concrete benchmark for what regulators will ask about.
Action needed
State-regulated financial institutions should build an AI/agent use-case inventory, stand up governance and oversight aligned to the framework's areas (governance, inventory/use cases, generative AI), and review vendor AI risk practices against it, treating it as a preview of future examination questions.