AI Regulation is Taking Shape: What the CSBS Framework Signals for Banks

Artificial intelligence (AI) is moving faster than almost any technology financial institutions have faced. Many built governance programs while putting AI into production, relying on best judgment about what regulators would eventually expect. 

That guesswork ends now. The Conference of State Bank Supervisors (CSBS) released its AI Supervisory Framework on September 16, setting clear expectations for the first time. Institutions that align their programs with this framework today will be better positioned as more state regulators follow suit. 

Key Takeaways 

• The CSBS AI Supervisory Framework gives state examiners nationwide a shared method for reviewing AI use and tells institutions which questions and documents to expect. 

• Connecticut has issued formal AI governance guidance, and New York has folded AI into its cybersecurity risk assessment expectations. 

• The CSBS framework and state guidance draw from the same sources, including NIST, the Cyber Risk Institute, and Treasury, so institutions should expect similar requirements across states. 

• Federal guidance covers generative and agentic AI thinly, and state regulators are closing those gaps. 

• Building governance after an examiner asks for it costs more than building it now, and institutions that start today can scale their programs to their size and actual AI use. 

What is the CSBS AI Supervisory Framework? 

The Conference of State Bank Supervisors released its AI Supervisory Framework, giving state examiners a clear method to assess AI use and risk at state-chartered banks and state-licensed nonbank financial institutions. State regulators oversee 79% of all U.S. banks, so the framework carries real weight. Each state agency decides how much of the framework to apply. CSBS encourages institutions to use it to assess their own programs and prepare for exams. 

The framework targets state-chartered banks and state-licensed nonbank financial institutions. It also gives other financial institutions a reasonable starting point in the absence of consistent supervisory guidance. Its risk-based approach draws on nationally recognized guidance for the safe and responsible use of AI systems, and it will likely shape regulatory expectations across the industry. 

The framework includes: 

• A core examiner guide 

• A detailed work program 

• Supplements for third-party, model risk, and consumer protection reviews 

• An optional AI use case risk-tiering worksheet 

 Examiners are directed to focus on: 

• Governance and oversight 

• The institution’s AI inventory and use cases 

• Generative AI and emerging uses 

• Existing supervisory areas such as third-party oversight, model risk and consumer protection 

The worksheet scores each use case on four factors: consumer impact, human oversight, potential harm from errors or outages, and data sensitivity. Controls scale up as risk increases. The framework carries no legal force, but legal commentators note that state-supervised institutions should expect examiners to apply substantially similar standards. 

Which States Have Issued AI Governance Guidance for Banks? 

Connecticut Requires a Written AI Governance Plan 

Some states have already moved further. In September, the Connecticut Department of Banking issued guidance requiring regulated entities to maintain an AI governance framework. That framework must rest on three pillars: board and senior management accountability, protection of consumer data, and recognized industry standards. Entities must document it in a written AI governance plan.  

The guidance applies to both consumer-facing and internal AI uses. The Department has also stated it plans to review AI governance during examinations. 

New York DFS Adds AI to Part 500 Cybersecurity Risk Assessments 

New York is moving in a similar direction. The state’s Department of Financial Services released its own cybersecurity guidance in September, built on Part 500 risk assessment requirements. The guidance names AI adoption as an emerging risk institutions should factor into their assessments. It also identifies significant AI developments as a type of material change that can trigger an updated risk assessment. 

Why AI Compliance Requirements Will Look Similar Across States 

Connecticut takes a different approach but draws on the same sources. Its guidance points to the NIST AI Risk Management Framework, ISO/IEC 42001, Treasury and FSSCC resources, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and New York DFS guidance. These sources also underpin the CSBS framework. This pattern is typical: one agency sets expectations in writing, and others adopt and adapt the same building blocks. 

Why Are State Bank Regulators Leading on AI Oversight? 

States are stepping in partly because federal guidance still has gaps. The revised interagency model risk management guidance issued in April 2026 (SR 26-2) specifically excludes generative and agentic AI, and the NCUA has not issued formal AI supervisory guidance. Institutions use these tools every day. State regulators are filling the gap. 

AI Adoption is Outpacing Governance at Financial Institutions 

Wolf & Company’s 2026 AI Adoption & Maturity Survey found that every institution surveyed had adopted AI in some form. Yet 30% said their use was limited to ad hoc or vendor-embedded tools, and only 5% had launched a scaled, governed AI program. 

Embedded vendor AI deserves particular attention. The CSBS framework tells examiners not to accept a “we don’t use AI” answer without checking it against vendor and software inventories. Connecticut’s guidance goes further, specifically naming AI features built into third-party and software-as-a-service (SaaS) products. Many institutions are using more AI than they realize. 

Why the Next Six Months Matter for AI Compliance 

Regulatory complexity will grow as AI systems grow more complex. Today’s guidance reflects yesterday’s AI use cases. As generative and agentic capabilities become standard in core systems, vendor platforms, and customer-facing applications, regulators will raise their expectations accordingly. 

The next six months matter. Examiners are not yet conducting AI-specific reviews at scale, and state guidance remains new. Institutions that use this window to build a documented, cross-functional governance program will enter 2027 from a position of strength. Those that wait will face a harder build, under greater scrutiny, with less time. 

How to Build an AI Governance Program Before Your Next Exam 

Building governance works best on your own timeline, not once an exam is already scheduled. The guidance is designed to scale with your institution. A community bank does not need the structure of a large institution, but it does need a foundation that fits how it actually uses AI. 

Here are the practical first steps: 

• Name an owner: Assign accountability for AI oversight to a specific senior officer or committee that reports to the Board. 

• Build the inventory: Identify the AI systems in use, including features embedded in vendor platforms and informal use of public generative AI tools. 

• Tier your use cases: Separate internal, human-reviewed tools from uses that affect consumers or support decisions, and match controls to the risk level. 

• Control the data: Define what information employees may enter into generative AI tools, and back those limits with system configuration and contract terms. 

• Align all three lines: Confirm that the first line, second line, and Internal Assurance each have defined roles in the governance program and operate from the same framework. 

• Use the programs you already have: Bring AI into existing risk assessment, information security, third-party risk, and change management processes. 

• Write it down: Keep documentation that shows how decisions were made and supports examination readiness. 

• Plan the next version: Treat the framework as a living document, with a review cadence tied to regulatory updates and new AI deployments. 

CSBS has given examiners a common approach, and individual states are beginning to set their own expectations. Institutions that build their AI governance programs now will be ready when examiners ask. 

How Wolf & Company Assesses Your AI Governance Readiness 

Financial institutions face growing scrutiny over AI governance from state and federal regulators. Wolf & Company’s Artificial Intelligence Services and IT Assurance teams assess where your governance stands today against those expectations. 

We identify gaps, prioritize next steps and build frameworks sized to your institution’s complexity and AI use. The outcome: a governance structure built for your actual risk profile, not a generic checklist. 

Regulators move fast on AI oversight. Contact Wolf & Company today to discuss where your organization stands.