State Regulators Step Into the Federal Void With New Artificial Intelligence Supervisory Framework for Banks

As the financial sector hurtles deeper into the digital age, the rapid adoption of artificial intelligence has outpaced the federal government’s ability to issue comprehensive regulatory guardrails. Anticipating a shifting regulatory landscape at the federal level with the transition into the second Trump administration, state banking regulators are increasingly stepping up to fill the void. This proactive posture has manifested most clearly through recent actions taken by the Conference of State Bank Supervisors (CSBS), which has rolled out a discretionary framework designed to help examiners evaluate how state-chartered financial institutions deploy and manage artificial intelligence.

The introduction of this framework highlights a growing schism between federal oversight and state-level supervision. While federal agencies have updated their expectations regarding traditional modeling for lending, pricing, and risk management, they have explicitly sidelined advanced AI systems—leaving millions of consumers and thousands of state-chartered institutions vulnerable to emerging technological risks without dedicated federal oversight.

The Federal Regulatory Gap and the Rise of State Oversight

To understand the significance of the CSBS’s new initiative, one must examine the limitations of recent federal guidance. In April, the nation’s primary federal banking regulators—the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC)—jointly issued updated guidance detailing how financial institutions should test, validate, and oversee the complex statistical models that govern core banking functions like lending, pricing, and risk assessment.

However, despite the explosive growth of generative artificial intelligence and agentic AI systems throughout 2023 and 2024, the federal agencies chose to exclude these advanced technologies from their updated directives. In their accompanying notes, the regulators explicitly stated that generative AI and agentic AI models are novel, rapidly evolving, and fundamentally distinct from traditional predictive models, and therefore fell outside the immediate scope of their guidance.

This regulatory omission left a massive blind spot in the supervision of the U.S. banking system. While federal agencies oversee national banks and federal savings associations, state-chartered institutions make up a staggering majority of the nation’s banking infrastructure. According to FDIC data, nearly 80% of the 4,233 FDIC-insured banking institutions in the United States operate under state charters and are primarily supervised by state-level regulatory agencies.

Recognizing that perceived deregulation or a hands-off approach at the federal level could leave state banking systems exposed to unchecked technological vulnerabilities, the CSBS took matters into its own hands.

Inside the CSBS Artificial Intelligence Supervisory Framework

Released on a Wednesday by the CSBS, the newly minted AI supervisory framework is explicitly discretionary—meaning it is not currently a compulsory mandate. Instead, it serves as a comprehensive, principles-based toolkit designed to guide examiners as they evaluate the governance, risk management, and operational controls of state-chartered institutions utilizing artificial intelligence.

CSBS CEO Brandon Milhorn emphasized the collaborative and supportive nature of the guidance in an official press release accompanying the rollout. He described the framework as a "principles-based approach" intended to help financial institutions explore and implement AI with additional confidence, noting that "any new technology can present risks."

The suite of documents provided by the CSBS to state examiners is robust and multifaceted. It includes:

• A Core Examiner Guide: Outlining the baseline philosophies and approaches for evaluating AI systems.
• A Work Program: Providing suggested, step-by-step procedures for examiners conducting on-site or off-site risk assessments.
• A Nonbank Supplement: Extending supervisory considerations to nonbank financial entities under state purview.
• A Tiering Worksheet: Categorizing banks based on the scale, scope, and sensitivity of their AI deployments.
• A Reference List: Documenting the foundational sources, industry best practices, and academic literature from which the framework is derived.

Central to the examiner guide are eight critical evaluation questions. These questions prompt examiners to scrutinize how banks vet third-party AI vendors, monitor algorithmic drift, manage data privacy, secure proprietary information, and ensure transparency in automated decision-making processes. By establishing these standardized inquiries, the CSBS hopes to bring uniformity to what could otherwise be a fragmented state-by-state regulatory patchwork.

A Three-Tiered Risk Assessment Model

Perhaps the most impactful component of the CSBS framework is its tiered risk-ranking system. Recognizing that a community bank utilizing an internal chatbot to draft marketing emails faces vastly different operational and consumer risks than a major state-chartered institution deploying autonomous algorithms to approve consumer loans, the CSBS established a three-tiered hierarchy.

Tier 1: Low-Risk Internal Applications

Tier 1 represents the baseline of AI adoption. The CSBS defines a bank as a Tier 1 institution when its use of artificial intelligence is strictly limited to internal administrative functions. Such systems typically feature human-reviewed outputs, limited consumer impact, highly restricted data sensitivity, and minimal potential for harm in the event of software errors, hallucinations, or system outages. Examples might include internal code-assistance tools, automated meeting transcribers, or workflow optimization software.

Tier 2: Moderate-Risk Decision Support

Tier 2 captures institutions employing AI in more prominent roles that interact directly or indirectly with operations and customers. A bank reaches Tier 2 when it gives artificial intelligence a consumer-facing or decision-support role. These systems often involve moderate data sensitivity, exception-based human oversight (where humans only intervene if flagged by the algorithm), and moderate potential harm from errors or system outages. Automated customer service avatars, marketing personalization engines, and preliminary fraud-detection scoring models generally fall into this category.

Tier 3: High-Risk Consumer Outcomes

Tier 3 represents the highest level of supervisory scrutiny. This tier is triggered when a bank’s AI use cases involve direct consumer outcomes, processing of sensitive personal data, limited or non-existent human review, significant operational reliance, or material potential harm resulting from errors, bias, or system outages. Automated credit underwriting systems, algorithmic pricing models for mortgages, and autonomous investment advisory tools fall squarely into Tier 3, demanding rigorous validation and continuous monitoring.

Dual-Purpose Utility: A Guide for Regulators and Industry Alike

Crucially, the CSBS designed the framework not merely as an auditing manual for state examiners, but as a practical compliance roadmap for the financial industry itself.

In its public announcements, the organization emphasized that the framework doubles as a vital resource for banking institutions striving to navigate the ethical and operational complexities of modern technology. Financial institutions of all sizes can leverage the framework to assess their own internal AI programs, establish robust AI governance models, implement comprehensive risk-management protocols, and proactively prepare for upcoming regulatory examinations.

Industry groups and risk-management consultants have responded favorably to this dual-purpose design. For smaller and mid-sized state-chartered banks, which often lack the massive compliance budgets of Wall Street mega-banks, having a clear, transparent framework from their primary regulators provides a valuable roadmap for innovation. Rather than guessing what state examiners might object to, banks can align their internal risk tiers and governance structures directly with the CSBS matrix.

Broader Implications for the Future of Financial Regulation

The rollout of the CSBS framework marks a significant milestone in the evolution of American financial regulation. It underscores a broader trend where state regulators are increasingly willing to assert leadership in areas where federal agencies lag behind due to bureaucratic inertia, political transitions, or jurisdictional debates.

As artificial intelligence continues to mature, moving rapidly from static machine-learning models to dynamic, autonomous agentic systems, the potential for systemic risk, algorithmic bias, and consumer harm grows exponentially. By providing a discretionary, risk-tiered framework today, the CSBS is laying the groundwork for what may eventually become mandatory regulatory standards tomorrow.

Ultimately, the initiative proves that state regulators are acutely aware of the digital transformation reshaping the banking sector. By equipping both examiners and institutions with the tools to safely harness artificial intelligence, the CSBS is attempting to strike a delicate balance: fostering technological innovation and operational efficiency while safeguarding the stability of state-chartered financial institutions and protecting the everyday consumers who rely upon them.