{"resourceId":"csbs-ai-supervisory-framework-core-guide-20260916","versions":[{"version":"external-68aea0f67d67b93b352ab291e8c4aa9a79e8ddefe2471902372fe3ba5d4123ef","resource":{"id":"csbs-ai-supervisory-framework-core-guide-20260916","title":"CSBS releases discretionary AI Supervisory Framework for state bank and nonbank examiners","organization":"Conference of State Bank Supervisors (CSBS)","sector":"State financial regulation — examiner guidance for AI risk","geography":"United States (all state banking/nonbank supervisors; agency-optional adoption)","publishedAt":"2026-09-16","publicationDate":"2026-09-16","eventDate":"2026-08-13","sourceName":"CSBS Artificial Intelligence Supervisory Framework — Core Examiner Guide Version 1.0 (public release announced 2026-09-16)","sourceLabel":"Public-sector association supervisory framework / examiner guide","sourceUrl":"https://www.csbs.org/sites/default/files/other-files/AI%20Supervisory%20Framework%20-%20Core%20Examiner%20Guide%20V1.0.pdf","evidenceClass":"public-sector-association","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model","developers-agents"],"finding":"Why now: same-week NY DIGIT/DFS RAISE build-out elevates how state financial regulators will examine AI; CSBS’s framework was not in the archive. Publicly announced 2026-09-16, the Core Examiner Guide v1.0 (approved 2026-08-13) gives state examiners a proportionate, discretionary tool to scope AI use, request governance/inventory/GenAI documents, and reuse existing third-party, model-risk, consumer-protection, and operational-risk procedures. It expressly does not create new legal obligations; each state agency decides incorporation. Emerging control infrastructure for supervised institutions—not measured exam outcomes.","sledRelevance":"Provides the concrete examiner question set and document-request list state banking departments may apply to GenAI/chatbots/vendors—material for state CIOs whose agencies or regulated entities will face these exams, and for GovOps comparing financial-regulator AI oversight maturity.","evidence":"PDF v1.0 approval 08/13/2026; sections on Initial Scoping, Document Request List, Governance and Oversight, AI Inventory and Use Cases, Generative AI and Emerging Use, and Use of Existing Supervisory Resources; statement that guide does not create new legal obligations; newsroom 09/16/2026: discretionary tool; each state agency determines incorporation; usable by industry for self-assessment.","architectureImplications":"Examiners will expect inventories of internal, vendor, and embedded AI; GenAI policies; output-review evidence; and vendor contract terms on data use/training—pushing institutions toward auditable AI architecture diagrams and logging.","governanceImplications":"Moves AI from principle statements to exam scoping with board/management reporting expectations, while preserving state discretion—governance will diverge by state adoption choices.","securityPrivacyImplications":"Document requests explicitly contemplate consumer-facing chatbot transcripts/samples and vendor data-training terms—elevating conversation-log and training-data controls as examination artifacts.","caveats":"Optional; not federal guidance; does not bind state agencies that decline adoption; no public statistics yet on exam findings using the guide; Sep 16 precedes last run but was absent from 2026-09-20 edition and newly relevant beside NY DFS DIGIT operations.","streamIds":["state-government"],"roles":{"sales":"Sales framing: CSBS just handed state examiners a public GenAI/inventory/vendor scoping guide—optional but directional for banks and nonbanks under state supervision. Engage state banking departments, DFS-like regulators, and CIOs at supervised institutions preparing self-assessments. Offer an exam-readiness gap map against the Core Examiner Guide—not a claim that every state has adopted it. Unsupported: that the guide creates new legal duties or predicts specific MRAs.","engineering":"Engineering framing: Fit is control evidence—AI inventory, GenAI allowlists, vendor AI disclosures, output-review samples, and model-risk artifacts examiners can request. Integrate inventory CMDB fields for embedded vendor AI and retain chatbot transcript samples where consumer-facing. Prerequisites: AI use-case register and third-party AI clause inventory. Constraints: state-optional adoption; financial-institution focus; not a general state-agency IT standard.","delivery":"Delivery framing: Work is building the document pack examiners will request and deciding whether the state agency will incorporate the guide into exam modules. Ownership spans state supervisory policy leads and institution compliance/AI governance teams. Acceptance should include completed inventory, GenAI policy, and tabletop document production—not merely downloading the PDF. Risks: checkbox inventories; missing embedded vendor AI; uneven multi-state exam expectations."},"roleDetails":{"sales":{"customerProblem":"State-supervised institutions lack a shared view of what examiners will ask about GenAI, inventories, and vendor-embedded AI.","stakeholders":["State banking commissioners / exam chiefs","Institution CISO/AI governance leads","Vendor risk managers","State CIO liaisons to regulated entities"],"discoveryQuestions":["Will your state incorporate the CSBS AI framework into exams?","Do you maintain an AI inventory including embedded vendor AI?","Can you produce GenAI policies and sample consumer outputs on request?","Where do chatbot transcripts and training-data contract clauses live?"],"valueHypothesis":"A short exam-readiness assessment against the Core Examiner Guide can surface inventory and vendor-AI gaps before the first AI-scoped exam.","potentialEngagement":"2–4 week readiness map: inventory completeness, GenAI policy, vendor AI clauses, and mock document-request response.","unsupportedClaims":["That CSBS created new legal obligations","Uniform adoption across all states","Predicted CAMELS or MRA outcomes"]},"engineering":{"fit":"Examination-evidence architecture for AI inventories, GenAI controls, and vendor oversight—not a product model.","architectureIntegration":"Tag AI systems in inventory; capture vendor embedded-AI attestations; retain policy and sample-output artifacts for examiner requests.","prerequisites":["AI use-case register","Third-party risk workflow","GenAI acceptable-use policy"],"constraints":["Optional state adoption","Bank/nonbank scope","Proportionate application by size/complexity"],"security":"Protect examiner-bound packages containing transcripts and model documentation; control access to consumer-output samples.","proofOfValue":["Inventory covering embedded vendor AI","Successful mock document-request pull","Board/management AI risk reporting evidence"]},"delivery":{"work":"Decide state adoption posture; update exam modules; help institutions assemble CSBS-aligned evidence packs.","dependencies":["State supervisory policy approval","Exam staff training","Institution compliance partners"],"ownership":"State agency exam leadership for incorporation; institution AI governance for evidence production.","skillsAdoption":"Examiners need GenAI literacy; institutions need inventory stewards and vendor-AI clause analysts.","governanceCheckpoints":["Adoption decision memo","Examiner training completion","First AI-scoped exam pilot retrospective"],"acceptanceCriteria":["Written incorporation (or deferral) decision","Updated request-list templates","Trained examiner cohort"],"risks":["Paper adoption without staff capacity","Inconsistent multi-state expectations","Over-collection of sensitive model IP"]}},"retrievedAt":"2026-09-21T22:11:42-05:00","enrichedAt":"2026-09-21T22:11:42-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Primarily examiner and compliance workforce upskilling; consumer accessibility impacts depend on how institutions remediate chatbot/output issues found in exams.","procurementImplications":"Will pressure vendor contracts to disclose embedded AI, data-training restrictions, and audit cooperation—relevant to state procurement of banking/fintech platforms and to institutions buying GenAI tools.","operatingModelImplications":"Encourages ongoing AI inventory hygiene and GenAI oversight committees rather than one-time policies; state agencies that adopt it add AI scoping to existing exam operating models.","sourceVerification":{"openedUrl":"https://www.csbs.org/sites/default/files/other-files/AI%20Supervisory%20Framework%20-%20Core%20Examiner%20Guide%20V1.0.pdf","referenceExcerpt":"It does not create new legal obligations or supervisory requirements.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}