How Should Community Banks Risk-Rate AI Use Cases?

How Should Banks Assess AI Use Case Risk?

Community banks should risk-rate AI use cases by evaluating four key factors: consumer impact, human oversight, potential harm from errors or outages, and data sensitivity. Using the Conference of State Bank Supervisors (CSBS) AI Supervisory Framework, institutions can classify AI use cases into three risk tiers: low, moderate, or high. Each tier determines the level of governance, monitoring, testing, and oversight needed. Banks should document their risk ratings, apply appropriate controls, and reassess AI use cases as their risks change.

AI is showing up at community banks and credit unions in many forms: features built into Microsoft 365, add-ons in core and loan platforms, fraud tools, chatbots, and free tools employees may be using without approval. The question for management is no longer whether the institution uses AI, but how much oversight each use deserves.

Not all AI carries the same risk, and effective AI risk management for banks starts with recognizing that. An employee using AI to clean up a marketing email is different from a vendor model that influences credit decisions. Treating every AI tool the same either buries your team in paperwork or leaves high-risk uses without enough oversight. A risk-tiering process applies stronger controls where AI could materially affect consumers, sensitive data, compliance, or operations, without overburdening lower-risk uses.

What CSBS Released

In September 2026, the Conference of State Bank Supervisors published its Artificial Intelligence Supervisory Framework. It’s a discretionary tool that helps state examiners understand how institutions use AI and decide when a deeper review is warranted. Each state regulator decides whether and how to use it. CSBS also says institutions can use it to assess their own AI programs and prepare for exams.

One part is especially practical: an optional AI Use Case Risk Tiering Worksheet. It’s meant to help institutions evaluate and document the relative risk of each AI use case. The framework’s Examiner Work Program refers examiners to this worksheet when they review how an institution tiers AI risk.

The 4 Risk Factors in the CSBS Worksheet

The worksheet evaluates each use case across four practical risk factors. The table below summarizes the key questions management should consider for each factor.

Before rating, the worksheet also has you record the use case’s business purpose, owner, AI type (including generative and agentic AI), and whether it was built in-house or comes from a vendor. Vendor-provided AI still needs to go through your third-party risk management program.

How the Tiering Works

AI risk tiering turns those factor ratings into an overall risk tier that guides how much oversight a use case needs. The highest-rated factor generally sets the preliminary tier. For example, a use case may be low risk on three factors but still receive a Tier 3 (High) preliminary rating if the AI processes NPI.

Two details are easy to miss:

• Controls build on each other. Tier 3 use cases should also have the Tier 1 and Tier 2 controls.
• Lowering a tier needs justification. You can assign a lower final tier, but you should document why, including mitigating factors and compensating controls, and get approval through your governance process.
  
  

Where to Start

1. Build an AI inventory. You can’t tier what you haven’t found, including AI embedded in vendor products and shadow AI.
2. Complete one assessment per use case. Use the CSBS worksheet or your own method to evaluate AI use case risk consistently.
3. Keep the documentation. CSBS suggests keeping completed worksheets to support exam requests.
4. Reassess when things change. Reassess when a use case expands, gains more decision-making authority, or has a vendor issue.

The goal isn’t to slow down AI adoption. It’s to make sure oversight matches the actual risk. If an examiner asks, your institution should be able to explain how each rating was reached, what controls apply, who approved the use, and when it will be reassessed.

For more on finding AI you might not know about, read our Shadow AI post on the Bedel Security blog.

Frequently Asked Questions About AI Risk Assessments

What are the four factors used to assess AI risk in community banks?

The CSBS AI Use Case Risk Tiering Worksheet evaluates four factors: consumer impact, human oversight, potential harm from errors or outages, and data sensitivity. These factors help institutions determine the appropriate level of oversight for each AI use case.

Does AI provided by a third-party vendor need a risk assessment?

Yes. Community banks should evaluate AI capabilities embedded in third-party products, including core banking systems, lending platforms, and fraud detection tools. Vendor-provided AI should be included in the institution's AI inventory and third-party risk management process.

How often should community banks reassess AI use cases?

Community banks should reassess AI use cases when material changes occur, such as expanded functionality, increased decision-making authority, changes in data sensitivity, or vendor-related issues. Institutions should also establish a periodic review schedule based on the risk of each use case.

Turn AI Risk Assessments into Ongoing Oversight

Risk-rating is one piece of AI governance. Our AI Risk Management & Oversight Program helps community banks and credit unions inventory AI use, assess and tier risk, and keep a repeatable oversight process that holds up under exam scrutiny. Contact us today to schedule a consultation!