Artificial Intelligence (AI) is already present in many financial institutions. Sometimes it is through tools employees use directly, such as ChatGPT or Claude. Other times, it is built into products the institution already uses from vendors such as Microsoft and Salesforce.
The CSBS AI Supervisory Framework Framework gives state examiners a voluntary guide for understanding how institutions use AI and manage the related risks. It looks beyond the AI tool itself and considers areas such as governance, inventory, vendor oversight, data use, employee training, monitoring, and documentation.
While the framework was written for examiners, it also gives financial institutions a helpful look at what may be reviewed during an examination. In this article, we will break down the framework, explain what it may mean for your institution, and share steps you can take to prepare.
And the timing for the framework is ideal since the industry is seeing formal adoption of AI increase year-over-year, including the latest Tandem Cybersecurity GRC Report finding formal adoption almost doubled from 27% in 2025 to 50% in 2026.
How the Framework is Organized
The framework includes two primary documents. The Core Examiner Guide provides the overall structure, while the Examiner Work Program provides source-based context and examiner focus points. The materials draw from resources such as the NIST AI Risk Management Framework, the CRI Financial Services AI Risk Management Framework, and the U.S. Department of the Treasury AI Lexicon.
Not every institution uses AI in the same way, so the level of review will depend on the institution’s size, complexity, risk profile, and AI use cases. A community bank using AI for limited internal tasks, for example, may receive a different level of review than an institution using AI to support lending decisions or to interact with customers.
The following is a list of areas covered by the framework, along with a summary of what an examiner may be trying to understand from the information.
| Framework Area | What the Examiner is Trying to Understand |
| Initial Scoping | Where and how the institution uses AI, which types of AI are involved, and which areas may need further review. |
| Document Request List | What documentation the institution maintains for AI governance, inventories, risk assessments, training, monitoring, and controls. |
| Governance and Oversight | Who is responsible for AI, how use cases are evaluated and approved, and what information is reported to management and the board. |
| AI Inventory and Use Cases | Where AI is used, its business purpose and owner, how risk is assessed, and whether vendor-provided or embedded AI is included. |
| Generative AI and Emerging Use | How the institution manages generative AI, large language models, and systems that can take actions with limited human direction. |
| Existing Supervisory Resources | When the AI use case may require additional review for third-party, model, consumer protection, or operational risk. |
Key Takeaways from the CSBS AI Supervisory Framework
Know Where AI is Being Used
One of the first questions examiners may ask is also one of the hardest to answer: Where is the institution using AI? The answer may go beyond approved tools such as ChatGPT or Copilot. AI can also be built into vendor products, internal processes, customer-facing services, analytics, and decision-making tools.
A complete AI inventory helps financial institutions see the full picture. It should identify each AI tool or capability, its business purpose, owner, provider, data use, risk rating, and potential impact. The inventory should also include vendor-provided or embedded AI features added to products the institution already uses.
Use Risk-Based AI Governance
A risk-based approach to AI governance helps financial institutions match the level of oversight with how an AI tool is used and the potential impact of that use. According to the CSBS framework, each AI use case should have a clear owner, an approval process, and appropriate expectations for monitoring and reporting.
A lower-risk use case, such as an internal productivity tool, may only need documented approval, employee guidance, and periodic review. AI used for customer interactions or significant decisions may require more detailed testing, ongoing monitoring, change management, independent review, and reporting to senior management or the board.
Manage Generative AI and Agentic AI
Generative AI brings risks that may require institutions to expand their existing review processes. The CSBS framework highlights concerns such as inaccurate output, hallucinations, prompt injection, and data exposure. Financial institutions should also understand whether employees are using public, private, internally deployed, or vendor-provided AI tools because the available controls may differ.
Agentic AI introduces another level of risk because these systems may be able to make decisions or take actions with limited human direction. The framework encourages institutions to consider what the system can access, which actions require human approval, how activity is logged, whether actions can be reversed, and how the system can be restricted or stopped. These controls become especially important when AI can access sensitive data, send communications, initiate transactions, or connect with other business systems.
Build AI Into Existing Risk Management Processes
Financial institutions do not have to build an entirely new risk management program for AI. The CSBS framework indicates many AI risks can be addressed through processes already in place for third-party risk management, model risk management, consumer compliance, and operational risk. The key is making sure those processes account for how AI changes the risk.
For vendor-provided AI, that may mean updating due diligence, contract reviews, performance monitoring, change management, and contingency planning. When AI is used to support significant decisions, your institution may need additional documentation, validation, monitoring, and review of its assumptions and limitations. Customer-facing AI may also need to be evaluated for accuracy, explainability, privacy, fair lending, and potential UDAAP concerns.
How Financial Institutions Can Prepare for AI Examinations
Financial institutions don’t need to wait for an exam to start asking questions. The CSBS AI Supervisory Framework can serve as a readiness checklist for identifying gaps in AI governance, risk management, and documentation. Here are six areas to start with:
-
Build and maintain an AI inventory. Document approved AI tools, vendor-embedded capabilities, business purposes, owners, data use, and risk ratings. Include a process for adding new tools and updating existing records.
-
Define AI governance responsibilities. Identify who evaluates and approves AI use cases, who monitors them, and when information should be reported to management or the board.
-
Assess each AI use case based on risk. Consider the sensitivity of the data, importance of the output, level of human involvement, potential customer impact, and to what extent the system can act independently.
-
Review third-party AI. Ask vendors how AI is used in their products, what data is collected or retained, how features and models change, and which controls support security, privacy, performance, and continuity.
-
Set expectations for data and output review. Define what employees may enter into AI tools, how outputs should be reviewed, when human approval is required, and which uses are prohibited.
- Keep evidence of the process. Retain policies, approvals, AI risk assessments, vendor reviews, training records, monitoring reports, and other documentation showing how AI risks are managed.
The CSBS also released the AI Use Case Risk Tiering Worksheet to help financial institutions apply a risk-based approach to individual AI use cases. The worksheet walks financial institutions through:
-
Use Case Identification
-
Business Purpose and Role of AI
-
Risk Factor Assessment
-
Tier Assignment
- Suggested Controls by Risk Tier
Together, the framework and worksheet can help institutions understand where AI is being used, determine which use cases need stronger oversight, and organize the documentation examiners may request.
How Tandem Supports AI Governance and Risk Management
Preparing for AI-related examiner questions may involve several areas of the institution, from cybersecurity and vendor management to policies and employee training. Tandem provides tools and resources that can help financial institutions bring those pieces together:
-
AI Cybersecurity Assessment Frameworks: Review AI-related cybersecurity controls using frameworks available in Tandem Cybersecurity Assessment, including the new CSBS Artificial Intelligence Framework.
-
AI Risk Assessment Template: Identify and evaluate risks associated with vendor-provided AI tools and services, including Microsoft Copilot, OpenAI ChatGPT, Anthropic Claude, Perplexity AI, Grok by xAI, and others.
-
AI Policy Template: Create clear expectations for acceptable AI use, data handling, third-party AI services, and oversight responsibilities.
-
AI Security Awareness Training Courses: Help employees understand AI-related risks, use AI responsibly, and protect organizational information.
- AI Vendor Review Templates: Evaluate how vendors use AI within their products, what data may be involved, and which controls are in place to manage the associated risks.
Visit the Tandem AI Resources page for additional tools, educational content, and updates related to AI governance and risk management.
Frequently Asked Questions (FAQs)
What is the CSBS AI Supervisory Framework?
The CSBS AI Supervisory Framework helps state examiners understand how financial institutions use AI and manage the related risks.
Who is the CSBS AI Supervisory Framework intended for?
The framework was developed for state examiners, but financial institutions can also use it to review their AI governance and prepare for examinations.
What AI documentation may examiners review?
Examiners may request and review documents like AI policies, inventories, risk assessments, approvals, vendor documentation, training records, monitoring reports, and management or Board reporting.
Do financial institutions need a separate AI risk management program?
Not necessarily. Many AI risks can be addressed by updating existing processes for risk management, vendor management, cybersecurity, compliance, and employee training.
What should a financial institution include in an AI inventory?
An AI inventory should identify each tool or capability, its business purpose, owner, provider, data use, and risk rating.
How should financial institutions evaluate third-party AI tools?
Institutions should understand how vendors use AI, what data is collected or retained, how the technology may change, and which controls protect the institution and its customers.
What is the CSBS AI Use Case Risk Tiering Worksheet?
The worksheet helps financial institutions document AI use cases, assess risk factors, assign risk tiers, and identify suggested controls.
What is the difference between generative AI and agentic AI?
Generative AI creates content or produces responses, while agentic AI can make decisions or take actions with limited human direction. Agentic AI may require additional controls for access, approvals, logging, and system shutdown.
