Guide · Compliance Clarity · Compliance officers and executive teams
How to prepare for AI questions in your next exam
What examiners are likely to ask about AI, the documents to have ready, and how a community bank or credit union can run a dry run before the exam letter arrives.
There is no comprehensive AI-specific banking regulation. GAO's 2025 review found that regulators primarily oversee AI through existing laws, regulations, guidance, and risk-based examinations. In practice that means AI questions show up inside reviews you already know — information security, third-party risk, compliance management, and governance — rather than as a separate exam.
What changed in 2026 is that the questions became easier to predict. The CSBS Artificial Intelligence Supervisory Framework gives state examiners a Core Examiner Guide with initial scoping questions, a document request list, and procedures for governance and oversight, the AI inventory and use cases, and generative AI. It is discretionary — each state decides how to use it — but it is public, and you can read it before your examiner does. It is written for state-chartered banks and state-licensed nonbanks; if a federal agency is your primary regulator, treat it as a public preview of the questions rather than your examiner's checklist.
The five documents to have ready
- AI use case inventory. Every AI use, built, bought, or embedded in vendor software, with an owner and a risk tier. How to build one.
- AI policy. Approved tools, the data line, human review, and how new uses are approved — including generative AI specifically. What to include.
- Vendor list with AI flagged. For each vendor whose product uses AI, the due diligence on file and any contract terms on data use.
- Training records. Who has been trained on the policy and when.
- Governance trail. Committee minutes or board reports showing that management and the board know what AI is in use and how it is controlled.
If one of these does not exist, that is your work plan.
Run a dry run
Have someone in risk or compliance answer the scoping questions on paper as if the examiner were asking them. Practical questions to rehearse:
- What AI does the institution use today, and how do you know the list is complete?
- Who approves a new AI tool or use, and where is that recorded?
- What data are employees allowed to put into AI tools? How do you know they follow that?
- Which AI uses affect customers or members directly? How is output reviewed before it reaches them?
- Which vendors provide AI, and what did your due diligence find?
- How does the board hear about AI risk?
Write the answers down. Where an answer is "we don't know," you have found a finding before the examiner did.
Separate models from generative AI
Examiners may treat traditional models and generative AI differently, and so should your documentation. SR 26-2, the April 2026 model risk guidance, is non-binding and leaves generative and agentic AI outside its formal scope. The CSBS framework, by contrast, gives generative AI its own review area. An institution whose AI documentation stops at credit and BSA models will have a visible gap. More on SR 26-2 and generative AI.
What good looks like
For a community bank or credit union, a strong answer is not a large program. It is a short, current inventory; a policy staff can actually follow; vendor files with the AI questions answered; and evidence that leadership is paying attention. A small program that is real is easier to defend than a large one that exists only on paper.
Common questions
- Are examiners asking about AI at community banks?
- Oversight of AI runs primarily through existing examinations, and state examiners now have a published framework for it. The CSBS AI Supervisory Framework, released in September 2026, gives state examiners scoping questions, a document request list, and procedures for reviewing AI. Each state decides how to use it.
- What documents should we have ready?
- An AI use case inventory, an AI or acceptable use policy that covers generative AI, a vendor list with AI features flagged and the related due diligence, evidence of staff training, and records showing how AI use is reported to management and the board.
- Is the CSBS framework a new regulation?
- No. It is a discretionary tool for state examiners, and each state agency decides how far to incorporate it. It is useful because it shows the questions and documents a state examiner may use.
- We barely use AI. Do we still need to prepare?
- Yes, briefly. Many institutions already use AI through vendor products without labeling it as AI. Being able to say clearly what AI you use, who owns it, and how it is controlled is the preparation, and it is quick when the honest answer is short.