Do community banks need a separate AI policy?

There is no federal rule that requires a standalone AI policy. But staff are already using AI tools, and the AI examination framework state bank supervisors released in September 2026 asks how that use is approved and restricted. A short acceptable use policy, or an AI section added to your existing information security or acceptable use policy, is the simplest way to show that the institution has drawn a line.

How long should an AI acceptable use policy be?

Two to four pages is usually enough for a community bank or credit union. The policy sets the rules; procedures, tool lists, and training material sit underneath it and can change without board re-approval.

Should the policy ban public AI tools like ChatGPT?

A blanket ban is easy to write and hard to enforce, because the tools are on every phone. A more workable approach is to name the approved tools, stating plainly that customer and member information never goes into an unapproved tool, and giving staff a sanctioned option for everyday drafting work.

Who should approve the AI policy?

Follow the path your other risk policies take. Typically management drafts it, the risk or technology committee reviews it, and the board approves it. The list of approved tools should be owned by management so it can be updated without a board vote.

Guide · Approved AI Access · Compliance, IT, and executive teams

How to write an AI acceptable use policy for a community bank

What an AI acceptable use policy at a community bank or credit union needs to say, what it can leave out, and how to get it approved without a six-month committee.

An AI acceptable use policy has one job: tell every employee what they may do with AI, what they may not, and who to ask when they are unsure. It is not a strategy document and it is not a model risk framework. Institutions that try to make it either one often end up with a draft that never leaves committee — while staff keep using whatever is on their phone.

There is no federal AI-specific banking regulation that dictates what the policy must contain. GAO-25-107197 found that oversight of AI in financial services works primarily through existing frameworks rather than a dedicated AI rule. That is freeing. It means your policy can be short, written in your own terms, and tied to obligations you already manage: information security, third-party risk, fair lending, and records.

What the policy must cover

Seven sections carry almost all of the weight. If your draft has these, it is a working policy.

Purpose and scope. Who it applies to (employees, contractors, directors) and what counts as AI. Keep the definition broad: any tool that generates text, images, code, summaries, or recommendations, including AI features built into software you already license.
Approved tools. Name them, or point to a list management maintains. Separate tools approved for customer or member information from tools approved only for public or internal, non-sensitive work.
The data line. The single most important sentence in the policy. State in plain words which information may never be entered into an unapproved tool: customer and member nonpublic personal information, account numbers, credit files, Suspicious Activity Report content (including whether a SAR exists) and other BSA/AML investigation details, examination findings, and confidential strategy. Give examples staff will recognize.
Human review. AI output is a draft. A named person reviews it before it reaches a customer or member, a regulator, or the file. Say which uses need a second reviewer — anything touching a credit decision, a disclosure, or a complaint response.
Prohibited uses. Short and specific. For example: no AI-only credit decisions, no AI-generated content presented to customers as if a person wrote it where that would mislead, no uploading of vendor contracts or exam reports to public tools.
New uses and new tools. How someone proposes a new AI use or tool, who reviews it, and that approved uses get recorded in the AI use case inventory.
Ownership, training, and exceptions. Who owns the policy, how staff are trained on it, how exceptions are requested, and what happens when someone breaks it.

What to leave out

Leave the tool list, prompt guidance, and step-by-step procedures out of the policy itself. Those change monthly. Put them in a procedure or a staff reference card that management can update without returning to the board. The policy points to them; it does not contain them.

Leave out aspirational language about transformation and innovation. An examiner reading the policy is looking for the rules and the owner, not the vision.

Write it so a teller can follow it

The test for every sentence: could a teller, a loan assistant, or a new marketing hire read it and know what to do on Monday? Phrases like "appropriate safeguards" and "where reasonable" fail that test. "Never paste a customer name, account number, or Social Security number into a tool that is not on the approved list" passes.

A one-page staff summary of the data line and the approved tools does more for actual behavior than the policy itself. Write both.

Getting it approved

These policies tend to stall in review, not drafting. Three moves keep it moving:

Draft from a starter, not a blank page. Our AI use policy starter covers these seven areas, plus documentation and incident response, written for a community institution.
Route it like your other risk policies. Management drafts, your risk or technology committee reviews, the board approves. Do not invent a new governance path for this one document.
Approve the policy and the first tool list together. A policy that approves nothing pushes staff straight back to unapproved tools.

What examiners are likely to look for

The CSBS Artificial Intelligence Supervisory Framework, released in September 2026, gives state examiners a document request list and review procedures covering governance, the AI inventory, and generative AI. It is discretionary, and each state decides how to use it. But it is a clear signal that "do you have a policy, who owns it, and how do you know it is followed" are likely to be early questions. Federally chartered banks and credit unions should expect similar questions from their own examiners. Read our briefing on the CSBS framework for what to pre-stage.

The non-binding FS AI RMF from Treasury and the financial sector gives larger programs more structure if you want it. A community bank does not need to adopt it to have a sound policy.

A realistic timeline

A small team can produce a reviewed draft in two to three weeks: one week to draft from a starter and agree on the data line, one week for compliance, IT, and legal comments, and the next committee cycle for approval. If yours has been in review for a quarter, the problem is scope. Cut it back to the seven sections and move the rest to procedures.

Common questions

Do community banks need a separate AI policy?: There is no federal rule that requires a standalone AI policy. But staff are already using AI tools, and the AI examination framework state bank supervisors released in September 2026 asks how that use is approved and restricted. A short acceptable use policy, or an AI section added to your existing information security or acceptable use policy, is the simplest way to show that the institution has drawn a line.
How long should an AI acceptable use policy be?: Two to four pages is usually enough for a community bank or credit union. The policy sets the rules; procedures, tool lists, and training material sit underneath it and can change without board re-approval.
Should the policy ban public AI tools like ChatGPT?: A blanket ban is easy to write and hard to enforce, because the tools are on every phone. A more workable approach is to name the approved tools, stating plainly that customer and member information never goes into an unapproved tool, and giving staff a sanctioned option for everyday drafting work.
Who should approve the AI policy?: Follow the path your other risk policies take. Typically management drafts it, the risk or technology committee reviews it, and the board approves it. The list of approved tools should be owned by management so it can be updated without a board vote.