The Conference of State Bank Supervisors released an Artificial Intelligence Supervisory Framework on September 16, 2026. It is a voluntary tool, not a new rule: it gives state examiners a structure for asking questions, requesting documents, and deciding when an AI use case warrants closer scrutiny at state-chartered banks and state-licensed nonbank financial institutions. CSBS says plainly that the framework does not create new legal obligations, but it does create a predictable, reusable template that state examiners can start applying immediately, and it is the first AI-specific supervisory tool built to reach nonbank entities that most federal AI guidance leaves out.
That last point is the one worth sitting with. A state-licensed money transmitter, a state-regulated mortgage lender, or a fintech operating under a money services business license has spent two years watching federal AI guidance, SR 26-2, the OCC’s bulletins, the agencies’ model risk letters, written for federally chartered banks. The CSBS framework is the first supervisory document built with nonbank, state-licensed entities as a named audience, not an afterthought. For a Chief Compliance Officer or CISO at one of those firms, this is the clearest signal yet of what a state examiner will actually ask about AI.
Want to put this into practice? Use our AI risk-tiering wizard.
What the CSBS AI Supervisory Framework is
CSBS is the national organization of state banking and financial regulators. It does not supervise institutions itself; it coordinates and standardizes how the roughly fifty state agencies that do supervise banks and nonbanks approach shared problems. The AI Supervisory Framework is exactly that kind of coordination tool. It was approved by CSBS’s State Supervisory Processes Committee and its Nondepository Supervisory Committee in August 2026 and released publicly on September 16, 2026.
The framework is reported across multiple legal and industry sources as a package of several linked documents rather than a single rule:
- A core guide that orients examiners to AI risk concepts and supervisory objectives.
- A detailed work program that lays out the examination procedures, the questions examiners ask, and the documents they request.
- A supplement that addresses nonbank financial institutions specifically, recognizing that their AI use cases, data, and risk profile differ from a depository institution’s.
- A worksheet examiners use to rate an individual AI use case by risk, so that a chatbot answering account-balance questions and an AI model making a lending decision are not reviewed with the same intensity.
- A short list of the source materials and existing frameworks the document draws on.
That structure matters more than its length. It tells you the framework is built to be used in the field by an examiner who needs a repeatable process, not a position paper meant to be read once and filed.
Who it reaches, and who it does not
This is the detail most coverage of the framework undersells. The CSBS framework applies to state-chartered banks and state-licensed nonbank financial institutions. It does not apply to national banks or federal savings associations, which remain under the OCC’s supervision and the federal interagency guidance track (SR 26-2 and its OCC and FDIC counterparts).
| Institution type | Primary supervisor | Governed by |
|---|---|---|
| National bank, federal savings association | OCC | SR 26-2 / OCC Bulletin 2026-13, federal interagency guidance |
| State-chartered bank | State banking department | CSBS AI Supervisory Framework (where the state adopts it), plus applicable federal guidance |
| State-licensed nonbank (money transmitter, licensed lender, many fintechs) | State financial regulator | CSBS AI Supervisory Framework nonbank supplement (where adopted); limited federal AI-specific guidance otherwise |
| Broker-dealer, RIA | SEC / FINRA | Reg S-P, FINRA guidance; not covered by CSBS |
| Insurer | State insurance department | NAIC AI Model Bulletin; not covered by CSBS |
Each state financial regulator decides independently whether and how to incorporate the framework into its own supervisory program. CSBS cannot bind a state agency; it can only offer the tool and the state has to choose to pick it up. Given how large a share of US banks are state-chartered, and how many fintechs and money services businesses operate under state licenses rather than a federal charter, industry commentary expects broad adoption over time, but the pace will vary state by state. A captive finance arm or fintech licensed in a dozen states should expect to meet this framework on an uneven timeline, not all at once.
What the framework draws on
CSBS did not invent a new risk taxonomy. The framework is reported to build on three existing references: the NIST AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework published with the Financial Services Sector Coordinating Council in February 2026, and the US Department of the Treasury’s AI Lexicon. That lineage is a practical advantage for any institution that has already organized its AI governance around NIST AI RMF’s GOVERN, MAP, MEASURE, and MANAGE functions: the state examiner is likely to ask questions that map onto a structure you may already have in place, rather than an unfamiliar one.
A readiness framework for the CSBS examination
Because the CSBS tool hands examiners a worksheet for rating AI use cases by risk, the fastest way to prepare is to build your own version of that worksheet before an examiner builds one for you. Use this five-part sequence:
- Inventory every AI use case, including vendor-embedded AI. State examiners are directed to look past the AI you built and into the AI your vendors shipped inside a loan origination system, a fraud tool, or a servicing platform. An inventory that only lists internally built models will miss most of what an examiner finds.
- Classify each use case by risk, the way the CSBS worksheet does. A customer-facing chatbot, a credit or pricing decision, and an internal drafting tool do not carry the same exposure. Document the classification and the reasoning, not just the label.
- Map each high-risk use case to an approval and monitoring record. For every use case rated higher risk, confirm there is a named owner, a documented approval, and an ongoing monitoring process an examiner can be shown without reconstruction.
- Review vendor contracts for AI-specific terms. Because the nonbank supplement is built for institutions that rely heavily on vendor platforms, confirm each AI vendor contract addresses data use, notice of material model changes, and audit access, not just general service-level terms.
- Confirm your state’s adoption posture. Because adoption is state by state, check directly with your chartering or licensing state regulator on whether and how it is incorporating the CSBS framework, rather than assuming either universal adoption or universal irrelevance.
How this fits alongside SR 26-2 and existing programs
A bank or fintech that already built a model risk and AI governance program around SR 26-2 and the NIST AI RMF is not starting over. The CSBS framework draws on the same NIST foundation, and a credible AI inventory and risk-tiering practice built for one supervisory audience transfers directly to the other. The work is reconciliation, confirming your existing inventory, tiering, and evidence would hold up against the CSBS work program’s specific questions, not building a second, parallel governance program from scratch.
The institutions with the most work ahead are the nonbank, state-licensed entities that never had a federal AI supervisory framework written with them in mind. If your compliance function has treated AI governance as “something the banks have to worry about,” the nonbank supplement is the signal that assumption no longer holds.
What this guide is / What it is not
What it is: A practitioner explanation of the CSBS AI Supervisory Framework released September 16, 2026, who it reaches, what it draws on, and a readiness sequence for state-chartered banks and state-licensed nonbank financial institutions preparing for a state AI examination.
What it is not: It is not legal advice, and it is not a certification or a guarantee of any examination outcome. The CSBS framework is a voluntary, non-binding tool; CSBS states it does not create new legal obligations or supervisory requirements, and adoption is a decision made independently by each state financial regulator. DSE prepares organizations for audit and examination and helps assemble the evidence a reviewer expects. We do not certify compliance and we do not guarantee any examination result. Confirm current adoption status and specific examiner expectations with your chartering or licensing state regulator.
FAQ
What is the CSBS AI Supervisory Framework? It is a voluntary tool released by the Conference of State Bank Supervisors on September 16, 2026 that gives state examiners a structured way to review AI use at state-chartered banks and state-licensed nonbank financial institutions. It includes a core guide, a detailed examiner work program, a supplement for nonbank institutions, a risk-rating worksheet for individual AI use cases, and a list of source materials. CSBS states it does not create new legal obligations; it is a supervisory tool, not a regulation.
Does the CSBS framework apply to my institution? It applies to state-chartered banks and state-licensed nonbank financial institutions, such as money transmitters, licensed lenders, and many fintechs operating under a state license. It does not apply to national banks or federal savings associations, which remain under the OCC and the federal interagency model risk track. Whether it applies to you in practice also depends on whether your specific state financial regulator has chosen to adopt it, since each state decides independently.
How is this different from SR 26-2? SR 26-2 is federal interagency guidance from the Federal Reserve, OCC, and FDIC that governs model risk at the banks those agencies supervise, and it explicitly excludes generative and agentic AI from its scope. The CSBS framework is a state-level supervisory tool aimed at a different population, state-chartered banks and state-licensed nonbanks, and it covers AI use broadly rather than carving out generative and agentic systems. An institution supervised at both the federal and state level may need to satisfy both.
Our fintech is not a bank. Why does this matter to us? Because the CSBS framework explicitly includes a supplement for nonbank financial institutions, something most federal AI guidance has not addressed directly. If your fintech operates under state money transmitter, lending, or servicer licenses, your state regulator is a plausible adopter of this framework, and the nonbank supplement describes the questions and documentation an examiner is likely to request from you specifically.
What should we do first if we have not started? Start with an AI use-case inventory that includes vendor-embedded AI, then classify each use case by risk the way the CSBS worksheet does. Those two steps surface most of the gap an examiner would find, and they are the foundation every other step in a readiness program builds on.
The Bottom Line
The CSBS AI Supervisory Framework does not change federal law, and it does not bind any institution on its own. What it does is hand roughly fifty state regulators a ready-made structure for examining AI, built explicitly to reach the state-chartered banks and state-licensed nonbank financial institutions that most federal AI guidance has left outside its scope. For a captive finance arm, a state-licensed lender, or a fintech that assumed AI supervision was a federal, bank-only concern, that assumption just got noticeably less safe. The readiness work is familiar: inventory, classify by risk, document ownership and monitoring, and check your vendor contracts, but the audience asking to see it just grew to include your state regulator directly.
Building or reconciling an AI governance program against SR 26-2, NIST AI RMF, and now the CSBS framework is exactly the work our banking AI governance engagement is built for. Start with the AI Governance Checklist to see whether your inventory, risk tiering, and evidence would hold up against a state examiner’s work program today.
Key facts
- The Conference of State Bank Supervisors released its Artificial Intelligence Supervisory Framework on September 16, 2026, a voluntary tool that gives state examiners a structure for reviewing AI use at state-chartered banks and state-licensed nonbank financial institutions (DSE, 2026).
- The framework explicitly does not create new legal obligations or supervisory requirements; each state financial regulator decides independently whether and how to incorporate it into its own supervisory program (DSE, 2026).