The Conference of State Bank Supervisors (CSBS) has taken a significant step toward codifying how state-level regulators and the institutions they oversee should approach artificial intelligence, releasing a discretionary guidance framework that introduces eight examiner questions and a three-tiered risk classification system for banks deploying AI technologies. The move marks one of the most structured attempts by state banking authorities to give examiners a working vocabulary and analytical lens for evaluating AI risks — a domain that has, until now, outpaced regulatory infrastructure at virtually every level of the financial system.
The guidance, released in September 2026, is deliberately framed as discretionary rather than binding, a choice that reflects both the CSBS's advisory posture and the genuine difficulty of standardizing rules for a technology still evolving at pace. That discretionary designation matters enormously in practice. It means banks and their examiners are not immediately subject to enforcement actions predicated on this framework, but it also signals the direction of travel: state supervisors are building the intellectual architecture that mandatory rules will eventually inhabit. Institutions that treat the guidance as optional noise rather than an early-warning signal do so at their own strategic peril.
Eight Questions That Will Shape Examiner Conversations
The eight questions the CSBS proposes for examiners are the operational heart of this framework. While the full enumeration of those questions rewards careful reading in the source document, their collective purpose is clear: to give examiners a structured line of inquiry when they encounter banks using AI in credit decisioning, fraud detection, customer service automation, risk modeling, or any of the dozens of other functions where the technology is now embedded. Examiners have long struggled with AI deployments because traditional examination frameworks were built for human-driven, rules-based processes. An institution that replaces a rules-based underwriting model with a machine-learning system does not automatically trigger the same examination pathways — a gap that has created both supervisory blind spots and competitive asymmetries across the industry.
By anchoring examiner conduct to a defined set of questions, the CSBS is attempting to create consistency across the patchwork of state banking systems. Unlike federally chartered institutions overseen by the Office of the Comptroller of the Currency (OCC) or the Federal Reserve, state-chartered banks operate within fifty distinct regulatory environments. A framework that gives examiners in Montana and Massachusetts a common analytical vocabulary is genuinely valuable, even if it carries no mandatory weight today.
A Three-Tier Risk Architecture
The three tiers of AI-related risk identified in the framework represent the guidance's second major contribution. Tiered risk classification is a well-established tool in financial regulation — capital adequacy regimes, anti-money laundering (AML) programs, and cybersecurity frameworks all deploy some version of it — and its application to AI is logically overdue. By stratifying risk into three distinct categories, the CSBS provides banks with a proportionality principle: not every AI application carries the same supervisory weight, and institutions should calibrate their governance, testing, and documentation accordingly.
The tiered approach also offers examiners a triage mechanism. Rather than treating a chatbot deployment and an AI-driven credit scoring model as equivalent supervisory challenges, examiners can direct their scrutiny toward higher-tier applications where consumer harm, model opacity, or systemic exposure is more acute. This proportionality is essential if state supervisors — many of whom operate with constrained resources relative to the federal agencies — are to examine AI deployments with any degree of rigor and efficiency.
Context: A Regulatory Landscape Under Construction
The CSBS guidance arrives at a moment when AI regulation in financial services remains fragmentary at the federal level. The Federal Deposit Insurance Corporation (FDIC), the OCC, and the Federal Reserve have each issued statements and requests for information on AI, but no unified federal framework for bank AI governance has yet been enacted. The Bank for International Settlements (BIS) and international bodies have flagged AI model risk and algorithmic bias as macro-prudential concerns, but cross-border convergence on standards remains distant. Into this vacuum, the CSBS has inserted a state-level framework that is both modest in its immediate legal force and ambitious in its conceptual scope.
For community banks and regional institutions — the segment most directly subject to state supervision — the guidance represents a practical preview of what future examinations may look like. Institutions that begin aligning their AI governance documentation, model risk management practices, and vendor oversight programs with the CSBS's eight-question framework now will be better positioned when discretionary guidance hardens into enforceable expectations. The history of financial regulation is replete with examples of advisory guidance that quietly became the baseline for enforcement: the interagency model risk management guidance of 2011, originally issued as SR 11-7 by the Federal Reserve, is perhaps the clearest precedent.
What This Means for the Industry
The CSBS framework does not impose immediate compliance burdens, but it does something arguably more consequential: it legitimizes examiner scrutiny of AI as a distinct supervisory discipline. Banks that have treated AI deployment as a technology project rather than a risk management exercise will need to recalibrate. Boards and senior management teams should expect AI governance to become a standing agenda item in regulatory conversations, not an occasional technical footnote. The eight examiner questions and three risk tiers published by the CSBS are, in the broadest sense, the opening terms of a regulatory negotiation that will define how artificial intelligence operates inside American banking for the decade ahead.
Written by the editorial team — independent journalism powered by Codego Press.