State examiners now have an AI playbook. You can read it too.

What happened. On September 16, the Conference of State Bank Supervisors released its Artificial Intelligence Supervisory Framework — a resource for state examiners reviewing AI use at state-chartered banks and state-licensed nonbank financial institutions. It is discretionary: it creates no new legal requirements, and each state decides how to use it. Its Core Examiner Guide lays out how an examiner approaches AI at an institution: initial scoping questions, a document request list, and procedures covering governance and oversight, the AI inventory and use cases, and generative AI and emerging uses. The framework builds on the NIST AI RMF, the financial sector's FS AI RMF, and Treasury's AI Lexicon.

Why it matters to you. Most community banks are state-chartered, which makes this the most direct answer yet to the question every leadership team has been asking: what will our examiner actually ask about AI? Until now that was inference from non-binding federal frameworks. Now the examiner's own guide — the questions, the documents, the review areas — is public. And note what the guide centers on: governance, an AI inventory, and generative AI specifically. That last one matters because SR 26-2, the interagency model-risk guidance, is non-binding and leaves generative AI outside its formal scope — the state framework walks right into the space the federal guidance left open.

What to do with it. Three moves, all preparation rather than new systems:

1. Read the Core Examiner Guide before your examiner does — or at least before your next exam. Have someone on your risk or compliance team answer its scoping questions on paper now, as a dry run.
2. Pre-stage the document request list. An AI use inventory, your AI or acceptable-use policy, and the vendor list with AI features flagged cover most of it. If those don't exist yet, this is the forcing function.
3. Give generative AI its own page. The framework treats it as a distinct review area, so an institution whose AI documentation stops at models in the SR 26-2 sense has a visible gap.

A discretionary framework is not a mandate. It is something better: advance notice of the conversation.