This Halloween, we're separating the tricks from the treats when it comes to artificial intelligence (AI) risk management and oversight.
On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released its Artificial Intelligence Supervisory Framework, a resource designed to help state financial examiners identify AI use, assess associated risks, and determine when additional supervisory review may be warranted.
The framework is discretionary, and each state regulatory agency determines how to incorporate it into its supervisory activities. Still, it provides community banks with a useful opportunity to evaluate their own AI governance and risk management practices.
The framework includes an optional AI Use Case Risk Tiering Worksheet that categorizes AI use cases as low, moderate, or high risk.
The takeaway for community banks is simple: The higher the risk, the stronger the controls should be.
Let's look at the suggested controls for each tier.
Example: An employee uses an approved AI tool to summarize internal meeting notes.
Even low-risk AI needs basic oversight. Suggested controls include:
| ☐ | AI Inventory: Document each AI use case, including its purpose and business owner. |
| ☐ | Vendor Contracts: Address AI-related risks and responsibilities in vendor contracts. |
| ☐ | Management Reporting: Provide management with periodic reporting on AI use, performance issues, and control reviews, as appropriate. |
| ☐ | AI Policy: Document AI governance, policies, and acceptable-use expectations. Review them periodically and when organizational changes warrant it. |
| ☐ | Risk Tiering: Document the risk classification using the framework's methodology or another appropriate approach. |
| ☐ | Training: Train employees who use AI or rely on its outputs to understand its limitations. |
| ☐ | Data Quality Controls: Establish controls over AI inputs or document known data quality limitations. |
| ☐ | Right to Audit: Where applicable, include contractual audit rights and oversight obligations for third-party AI providers. |
The takeaway: Know where AI is being used, establish clear expectations, and make sure employees understand its limitations.
Example: AI helps prioritize fraud alerts or supports customer service responses that employees review before acting on them.
As AI takes on a greater role in business processes, banks need stronger testing, monitoring, and accountability.
Suggested controls include:
| ☐ | Model Risk Management: Establish a written model risk management or equivalent review process for the use case, as applicable. |
| ☐ | Customer-Facing Explanations: Maintain explainability documentation for consumer-facing AI outputs, as applicable. |
| ☐ | Escalation Paths: Define procedures for escalating anomalous, inaccurate, or potentially harmful AI outputs. |
| ☐ | Third-Party Management: Establish a process for overseeing third-party AI models and providers. |
| ☐ | Pre-Deployment Testing: Evaluate accuracy, performance, fairness, and potential consumer impacts before deployment, as applicable. |
| ☐ | Adverse Action Notices: Test processes for generating compliant adverse action notices when applicable. |
| ☐ | Periodic Model Reviews: Schedule and complete periodic reviews of model performance, outputs, and controls. |
| ☐ | Customer Complaint Process: Capture and investigate complaints involving AI-related decisions or interactions. |
The takeaway: Test AI before putting it to work, monitor how it performs, and establish a clear path for addressing problems.
Example: AI materially influences lending decisions or other outcomes that could significantly affect customers.
High-risk AI requires more rigorous safeguards, stronger oversight, and clear evidence that risks are being managed. In addition to applicable foundational controls, banks should prioritize:
| ☐ | Performance Monitoring: Continuously monitor accuracy, performance, fairness, consumer outcomes, and fair lending risks, as applicable. |
| ☐ | Comprehensive AI Inventory: Maintain a comprehensive inventory of AI use cases and ensure appropriate senior management review. |
| ☐ | Consumer Disclosures: Provide disclosures addressing automated decision-making when applicable. |
| ☐ | Senior Management Oversight: Ensure senior management, the board, or a designated oversight body receives appropriate reporting on the use case, associated risks, and significant issues. |
| ☐ | Independent Model Validation: Obtain independent validation by qualified personnel, as applicable. |
| ☐ | Incident Response: Document AI-specific incident response procedures, including how to address problematic outputs or failures. |
| ☐ | Pre-Deployment Reviews: Complete and document appropriate reviews of fairness, consumer impact, and fair lending risks before deployment. |
The takeaway: High-impact AI needs more than a policy. Banks need documented evidence of appropriate oversight, testing, monitoring, and accountability.
AI can create opportunities for community banks to improve efficiency, strengthen fraud detection, and enhance customer experiences. But those benefits come with risks that cannot be managed by simply adopting an AI policy or relying on a vendor's assurances.
Start with three questions:
1. Do we know where AI is being used?
Maintain an inventory of AI use cases, including those embedded in third-party products.
2. Do our controls match the risk?
Evaluate each use case based on its potential impact on customers, operations, compliance, and the bank's reputation.
3. Can we demonstrate oversight?
Maintain documentation showing how AI is approved, tested, monitored, and addressed when something goes wrong.
The goal isn't to eliminate AI risk altogether. It's to make informed decisions about where AI belongs, implement controls that match the risk, and demonstrate that the bank remains accountable for the outcomes.
This Halloween, don't let AI risk become a regulatory fright. Know your use cases, strengthen your controls, and keep oversight human.