Artificial intelligence is already embedded in many community bank operations. Fraud monitoring systems, credit decisioning tools, customer chatbots, and vendor-provided analytics often rely on AI or algorithmic processes and may have been implemented before the bank understood that AI was involved. Employees may use these tools without realizing that the oversight expectations applied to traditional models and third-party relationships may also apply here. Community banks should adopt a coherent, risk-based AI governance approach as part of ordinary risk management rather than wait for a formal regulatory mandate.
The United States does not yet have a single comprehensive federal AI statute as of the date of this article, but the guidance landscape has matured quickly over the last few years, with recent efforts in the banking industry providing clearer direction on governance needs. Several documents already provide useful expectations and frameworks for responsible use of AI in financial services that offer a workable foundation for community banks to establish and build upon as frameworks and laws are formalized and the industry learns from early adoption and oversight challenges.
Current U.S. AI Governance Guidance Relevant to Banks
NIST AI Risk Management Framework (AI RMF 1.0). The NIST AI Risk Management Framework remains one of the federal government’s primary voluntary frameworks for trustworthy and responsible AI. Published on January 26, 2023, it organizes risk-management activities around four functions: Govern, Map, Measure, and Manage. Its principles concerning fairness, transparency, accountability, privacy, reliability, and safety align well with existing banking risk-management obligations. NIST is currently revising AI RMF 1.0, but it remains a useful baseline for organizations managing AI risk.
Financial Services AI Risk Management Framework (FS AI RMF). In February 2026, the U.S. Department of the Treasury announced the Financial Services AI Risk Management Framework along with a shared AI Lexicon for the financial sector. The FS AI RMF was developed through a public-private collaboration led by the Cyber Risk Institute in coordination with the Financial Services Sector Coordinating Council, with participation from more than 100 financial institutions and input from government agencies, including NIST. The framework adapts the NIST structure specifically for financial services and addresses AI risk across areas such as credit, fraud, AML, operations, customer interactions, and vendor-supplied systems. It includes practical tools such as an AI Adoption Stage Questionnaire and a Risk and Control Matrix containing 230 control objectives. While voluntary, it is designed to scale to financial institutions of different sizes and provides a useful reference point for governance, audit, and examination readiness.
Revised Interagency Model Risk Management Guidance (SR 26-2 / OCC Bulletin 2026-13). Issued on April 17, 2026, this guidance updates the longstanding model risk framework and replaces prior interagency model risk guidance. It reaffirms the importance of model inventories, validation, performance monitoring, documentation, governance, and effective challenge while emphasizing a risk-based approach tailored to an institution’s model risk profile, size, and complexity. The Federal Reserve states that the guidance is expected to be most relevant to banking organizations with more than $30 billion in total assets. Although many community banks fall below that threshold, the risk-management concepts may still provide useful guidance where appropriate. Generative and agentic AI models are outside the formal scope of the guidance because those technologies are novel and rapidly evolving. The agencies nevertheless state that a banking organization’s risk-management and governance practices should guide appropriate controls for tools outside the guidance. Traditional statistical and quantitative models and non-generative, non-agentic AI models remain within its scope.
CFPB expectations under ECOA/Regulation B, UDAAP, and related guidance. CFPB guidance issued in 2022 and 2023 emphasized that the use of AI or complex algorithms does not relieve a creditor of its obligation under the Equal Credit Opportunity Act (ECOA) and Regulation B to provide specific and accurate adverse-action reasons. Creditors cannot rely on a model being too complex or opaque to explain the actual principal reasons for an adverse action. More broadly, existing fair-lending and consumer-protection laws continue to apply when AI is used in credit decisioning, underwriting, marketing, product selection, or other consumer-facing activities.
NAIC AI Model Bulletin. Although written for insurers, the National Association of Insurance Commissioners’ Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted in December 2023, can provide a useful reference for banks. It emphasizes governance, risk management, fairness, accountability, transparency, and controls surrounding AI systems. Its approach also reinforces the importance of adapting third-party risk and data-governance processes as AI becomes more widely used.
American Bar Association Formal Opinion 512 (July 2024). Issued for attorneys, the opinion highlights confidentiality and other professional-responsibility risks associated with the use of generative AI. The practical lesson for banks is straightforward: nonpublic personal information, proprietary data, and confidential bank materials should not be entered into external AI tools unless the bank has approved the tool and established appropriate data-sharing, confidentiality, and security controls.
American Bankers Association resources. In June 2026, the American Bankers Association published an AI Policy Template designed to help banks establish an AI policy. ABA also makes available The AI Framework for Community Banks, which emphasizes practical governance, oversight, and integration of AI considerations into existing risk, compliance, cybersecurity, and operational programs. Community banks can use these resources as a starting point for policy and governance development.
Independent Community Bankers of America (ICBA) Community Banker AI Security Readiness Guide. ICBA released its Community Banker AI Security Readiness Guide on June 3, 2026. Developed with community bankers serving on ICBA’s AI Task Force, the resource highlights the changing AI security environment, including AI-enabled fraud and other emerging threats. It also addresses third-party due diligence, vendor dependence, contract language, incident response planning, board oversight, and cyber insurance considerations.
Why Community Banks Should Act Now
AI is appearing in workflows faster than formal governance structures are being built. Employees may use AI-enabled features without realizing the tools require oversight. Vendors increasingly embed AI in core systems, digital banking platforms, fraud tools, and analytics products, so banks often use AI indirectly. Without a basic inventory, these systems can remain invisible and unmanaged.
The risks are concrete and familiar:
- Consumer harm from biased or insufficiently transparent credit or underwriting decisions.
- UDAAP exposure when AI influences product offers, marketing, or customer interactions.
- Data leakage if nonpublic personal information or proprietary information is entered into external AI tools.
- Model performance drift when models are not monitored against changing economic conditions and borrower behavior.
- Third-party risk when vendors use AI without adequate disclosure or documentation.
- Gaps in fairness or explainability arising from incomplete data or unexamined assumptions.
The difference is that AI can amplify these risks quickly and across multiple business lines at once.
A Practical Governance Approach for Community Banks
Community banks do not need a large, specialized team to begin. Most already maintain model risk, third-party risk, data governance, information security, and compliance programs. The task is to extend those programs deliberately to AI and algorithmic tools.
Start with a complete inventory. Identify every AI system, machine-learning model, algorithmic decisioning tool, and vendor product that uses AI or automated decision logic. Include tools used in credit, fraud, AML, operations, marketing, and customer service, whether developed internally or supplied by a vendor.
Once the inventory exists, apply existing controls:
- Assess each system for fairness, transparency, explainability, and consumer impact, especially where credit, underwriting, or product decisions are involved.
- Prohibit the entry of nonpublic personal information, proprietary data, or other sensitive bank information into external AI tools unless the arrangement has been reviewed and approved. Reinforce the rule through regular staff training.
- Apply model risk-management principles where appropriate: validation, performance monitoring, documentation of assumptions, and effective challenge. For generative tools outside formal model guidance, document the purpose, data-handling rules, human-review requirements, and escalation paths.
- Strengthen third-party risk management so that vendors disclose AI use and, where relevant and reasonably available, provide information regarding data sources, decisioning processes, testing, controls, and documentation sufficient to meet the bank’s risk-management standards.
- Establish a written AI policy or update existing policies to address inventory, human oversight, data protections, vendor expectations, and board or senior management reporting. ABA’s policy template and related community-bank materials offer a practical starting point.
- Human oversight should remain an important control for material or higher-risk uses where appropriate. Document where that review occurs and who is responsible. Lifecycle monitoring, including checking that systems continue to perform as expected, should be built into existing risk and compliance calendars.
What to Do Next
Community banks should begin laying the groundwork now. Start by building an inventory of every AI-enabled tool already in use, including those embedded in vendor platforms. Clarify internal data-handling expectations so staff understand what information may and may not be shared with external systems. Ask key vendors to disclose how AI is incorporated into their products and what documentation, testing results, or model explanations they can provide. Use these insights to draft or update a concise AI policy that matches the bank’s size, complexity, and risk profile.
For significant or novel AI uses, banks should also consider whether discussion with appropriate supervisory contacts is warranted, particularly when the use could materially affect consumer compliance, model risk, cybersecurity, or other significant risk areas.
Banks that take these steps now will be positioned to adopt AI with greater confidence through the traditional risk-based approach of protecting consumers, safeguarding sensitive data, and meeting evolving regulatory expectations. This work is not a departure from traditional risk management; it is an extension of the discipline the industry already knows well. Starting early simply reduces the scramble later and helps ensure the institution is ready for the rapid evolution ahead.
Dana Paull, CRCM
Virtual Compliance Officer