On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released a new supervisory resource designed to support state examiners in assessing the use and risks of artificial intelligence (AI) at state-chartered banks and state-licensed nonbank financial institutions. The framework is publicly available and serves a dual purpose: it equips state examiners with a structured approach to evaluating AI use at supervised institutions, and it provides regulated financial institutions with meaningful advance transparency into the examination process.
What the Framework Does
The CSBS AI Supervisory Framework provides state examiners with a discretionary tool to identify and understand AI at financial institutions, assess associated risks, and determine when a deeper review may be appropriate using existing supervisory resources. Importantly, the framework is designed to consider each institution’s size, complexity, risk profile, and use of AI. This means examiners are expected to calibrate their inquiry to the individual institution rather than apply a one-size-fits-all approach.
The framework is based on leading AI risk management resources, including the National Institute of Standards and Technology’s (NIST) AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury’s AI Lexicon. By anchoring the framework in these established standards, CSBS has signaled that state supervisory expectations will largely track the AI governance principles that many larger institutions are already working to implement.
A Dual-Use Resource: Examination Preparation and Self-Assessment
The framework also doubles as an industry resource. Financial institutions can use the framework to assess their own AI programs, establish sound AI governance and risk management, and prepare for examinations. The publicly released framework also helps provide clarity to regulated financial institutions on the general approach, types of questions, and the information that a state examiner may request regarding the institution’s AI-based products, services, and tools.
This transparency is significant. Institutions now have a clear window into what examiners will be looking for, making the framework a valuable self-diagnostic tool that can inform internal AI governance reviews, audit programs, and board-level reporting.
State-by-State Adoption
A key practical consideration is that adoption of the framework is not automatic or uniform across all jurisdictions. Each state agency will determine the extent to which this framework is incorporated into their supervisory programs. Institutions should therefore monitor the approach of their primary state regulator(s) to understand whether and how the framework will be applied in upcoming examinations.
What This Means to You
The framework applies to state-chartered banks and state-licensed nonbank financial institutions. State regulators supervised through the CSBS network supervise 79% of all U.S. banks and a variety of non-depository financial services companies, including entities operating in the mortgage, money services businesses, consumer finance, auto finance, and debt collection industries. Accordingly, the framework has a broad practical reach across the U.S. financial services sector.
Financial institutions supervised by state regulators should treat the CSBS AI Supervisory Framework as both a compliance signal and a practical resource. We suggest the following steps:
- Review the Framework. Review the CSBS AI Supervisory Framework to understand examiner expectations, likely examination questions, and key risk categories.
- Conduct an AI Inventory. Identify all AI-based products, services, and internal tools currently in use or under development, as examiners will seek to understand where and how AI is deployed. For each use case, map what data the tool ingests, generates, or transmits, as this will come to bear on certain aspects of the framework’s application.
- Assess Governance Structures. Evaluate whether existing AI governance policies and risk management processes align with the framework’s principles-based expectations and its underlying standards (NIST AI RMF, Cyber Risk Institute, Treasury AI Lexicon).
- Engage Your Primary State Regulator. Monitor your primary state regulator’s approach to adopting the framework and consider whether to engage proactively to understand the expected scope and timing of any AI-focused examination activity.
- Prepare Documentation. Ensure AI-related documentation—including model inventories, governance policies, vendor management records, and risk assessments—is organized and readily accessible for examiner review.
- Coordinate Across Business Lines. Align legal, compliance, privacy, technology, and risk management teams on the institution’s AI governance posture and examination readiness.
Contact Us
If you have questions about this alert or would like additional guidance on preparing for AI- related examinations, please contact Christopher Friedman, Lauren Watson, Marci Kawski, Max Earp-Thomas, or your Husch Blackwell attorney.
This article provides general legal information. It does not constitute legal advice to the reader and does not create an attorney-client relationship between the reader and Husch Blackwell LLP. The reader should seek legal advice if they have questions about how this legal information may apply to their own circumstances.