From the State Government edition of September 21, 2026
CSBS releases discretionary AI Supervisory Framework for state bank and nonbank examiners
Conference of State Bank Supervisors (CSBS) · State financial regulation — examiner guidance for AI risk · United States (all state banking/nonbank supervisors; agency-optional adoption)
- Publisher
- CSBS Artificial Intelligence Supervisory Framework — Core Examiner Guide Version 1.0 (public release announced 2026-09-16)
- Original publication
- 2026-09-16
- Source retrieved
- 2026-09-22
- Event date
- 2026-08-13
What happened
Why now: same-week NY DIGIT/DFS RAISE build-out elevates how state financial regulators will examine AI; CSBS’s framework was not in the archive. Publicly announced 2026-09-16, the Core Examiner Guide v1.0 (approved 2026-08-13) gives state examiners a proportionate, discretionary tool to scope AI use, request governance/inventory/GenAI documents, and reuse existing third-party, model-risk, consumer-protection, and operational-risk procedures. It expressly does not create new legal obligations; each state agency decides incorporation. Emerging control infrastructure for supervised institutions—not measured exam outcomes.
Why it matters
Provides the concrete examiner question set and document-request list state banking departments may apply to GenAI/chatbots/vendors—material for state CIOs whose agencies or regulated entities will face these exams, and for GovOps comparing financial-regulator AI oversight maturity.
Evidence and measured results
PDF v1.0 approval 08/13/2026; sections on Initial Scoping, Document Request List, Governance and Oversight, AI Inventory and Use Cases, Generative AI and Emerging Use, and Use of Existing Supervisory Resources; statement that guide does not create new legal obligations; newsroom 09/16/2026: discretionary tool; each state agency determines incorporation; usable by industry for self-assessment.
Limitations and uncertainty
Optional; not federal guidance; does not bind state agencies that decline adoption; no public statistics yet on exam findings using the guide; Sep 16 precedes last run but was absent from 2026-09-20 edition and newly relevant beside NY DFS DIGIT operations.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-21; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- State-supervised institutions lack a shared view of what examiners will ask about GenAI, inventories, and vendor-embedded AI.
- Stakeholders
- State banking commissioners / exam chiefs
- Institution CISO/AI governance leads
- Vendor risk managers
- State CIO liaisons to regulated entities
- Discovery questions
- Will your state incorporate the CSBS AI framework into exams?
- Do you maintain an AI inventory including embedded vendor AI?
- Can you produce GenAI policies and sample consumer outputs on request?
- Where do chatbot transcripts and training-data contract clauses live?
- Value hypothesis
- A short exam-readiness assessment against the Core Examiner Guide can surface inventory and vendor-AI gaps before the first AI-scoped exam.
- Potential engagement
- 2–4 week readiness map: inventory completeness, GenAI policy, vendor AI clauses, and mock document-request response.
- Unsupported claims
- That CSBS created new legal obligations
- Uniform adoption across all states
- Predicted CAMELS or MRA outcomes
Pre-sales engineering
Role takeaway
- Fit
- Examination-evidence architecture for AI inventories, GenAI controls, and vendor oversight—not a product model.
- Architecture and integration
- Tag AI systems in inventory; capture vendor embedded-AI attestations; retain policy and sample-output artifacts for examiner requests.
- Prerequisites
- AI use-case register
- Third-party risk workflow
- GenAI acceptable-use policy
- Constraints
- Optional state adoption
- Bank/nonbank scope
- Proportionate application by size/complexity
- Security
- Protect examiner-bound packages containing transcripts and model documentation; control access to consumer-output samples.
- Proof of value
- Inventory covering embedded vendor AI
- Successful mock document-request pull
- Board/management AI risk reporting evidence
Delivery
Role takeaway
- Work
- Decide state adoption posture; update exam modules; help institutions assemble CSBS-aligned evidence packs.
- Dependencies
- State supervisory policy approval
- Exam staff training
- Institution compliance partners
- Ownership
- State agency exam leadership for incorporation; institution AI governance for evidence production.
- Skills and adoption
- Examiners need GenAI literacy; institutions need inventory stewards and vendor-AI clause analysts.
- Governance checkpoints
- Adoption decision memo
- Examiner training completion
- First AI-scoped exam pilot retrospective
- Acceptance criteria
- Written incorporation (or deferral) decision
- Updated request-list templates
- Trained examiner cohort
- Risks
- Paper adoption without staff capacity
- Inconsistent multi-state expectations
- Over-collection of sensitive model IP
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Examiners will expect inventories of internal, vendor, and embedded AI; GenAI policies; output-review evidence; and vendor contract terms on data use/training—pushing institutions toward auditable AI architecture diagrams and logging.
Governance
Who approves, reviews and stays accountable for outcomes?
Moves AI from principle statements to exam scoping with board/management reporting expectations, while preserving state discretion—governance will diverge by state adoption choices.
Security and privacy
What data, permissions and controls need testing?
Document requests explicitly contemplate consumer-facing chatbot transcripts/samples and vendor data-training terms—elevating conversation-log and training-data controls as examination artifacts.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Primarily examiner and compliance workforce upskilling; consumer accessibility impacts depend on how institutions remediate chatbot/output issues found in exams.
Procurement
What should contracts, pricing and exit terms secure?
Will pressure vendor contracts to disclose embedded AI, data-training restrictions, and audit cooperation—relevant to state procurement of banking/fintech platforms and to institutions buying GenAI tools.
Operating model
Which teams own the service once it runs?
Encourages ongoing AI inventory hygiene and GenAI oversight committees rather than one-time policies; state agencies that adopt it add AI scoping to existing exam operating models.
Publication history
- 2026-09-21State Government · Issue 164 resources
Stable resource ID: csbs-ai-supervisory-framework-core-guide-20260916