Artificial intelligence is already creating value throughout financial services. Banks use AI and machine learning in credit decisioning, fraud detection, anti-money laundering monitoring, cybersecurity, customer service and back-office operations. Often, however, technology enters through an existing vendor platform rather than a separately identified AI initiative.
A community bank may therefore be using substantially more AI than its board and senior management realize. Software updates may add AI-assisted underwriting or customer-service features, while employees may use public generative AI tools to summarize information or prepare communications. Individually modest uses can collectively create regulatory, legal, operational and reputational risks that the bank has not formally evaluated.
The goal is not to eliminate AI risk or to slow responsible innovation. It is to make sure the bank knows where AI is being used, who is accountable for it and which uses require greater oversight.
Existing laws still apply
There is no single, comprehensive federal statute governing every use of AI by financial institutions. That does not mean AI operates outside the law. Existing banking, lending, consumer protection, privacy, cybersecurity and third-party risk requirements continue to apply when a bank uses AI.
For example, the Equal Credit Opportunity Act and Regulation B apply when an AI model affects a credit decision. The Fair Credit Reporting Act may apply when consumer report information is used. The prohibition against unfair, deceptive or abusive acts or practices may apply when a customer-facing AI tool provides misleading or inaccurate information. Gramm-Leach-Bliley Act safeguards remain relevant when an AI system processes nonpublic personal information.
The practical message is straightforward: a new technology does not displace an existing legal obligation.
A financial services framework for AI risk
In February 2026, the U.S. Department of the Treasury released an Artificial Intelligence Lexicon and the Financial Services AI Risk Management Framework, or FS AI RMF.1U.S. Department of the Treasury. (2026, February 19). “Treasury Releases Two New Resources to Guide AI Use in the Financial Sector.” https://home.treasury.gov/news/press-releases/sb0401 The framework adapts the NIST AI Risk Management Framework to financial services and provides scalable implementation materials and control objectives.2Financial Services Sector Coordinating Council. “Financial Sector Artificial Intelligence Executive Oversight Group Deliverables.” https://fsscc.org/AIEOG-AI-deliverables/
Although voluntary, the framework gives banks a recognized structure for organizing AI programs and documenting decisions. A community bank need not implement every control, but it should be able to explain why its approach is reasonable for its size, complexity, risk profile and actual uses.
Start with an AI inventory
The first governance question is basic: Where is the bank using AI? The inventory should cover underwriting, fraud and transaction monitoring, anti-money laundering systems, customer service, marketing, cybersecurity, human resources, core processing, document workflows and employee use of generative AI.
An inventory should identify the business owner, vendor, purpose, data involved, affected customers or employees and whether the output contributes to a significant decision. It should also indicate whether the use has been reviewed by information security, compliance, legal, model risk management or other appropriate functions.
An inventory need not be perfect before it becomes useful. A smaller institution can begin with significant vendors and functions involving automated decisions, then update the inventory as it learns more.
Assign responsibility
AI governance does not require a community bank to establish a large new committee. It does require clear ownership.
Management should assign one existing function or senior leader to oversee the bank’s AI governance program. That owner should maintain the AI inventory, coordinate reviews with technology, information security, compliance, legal and enterprise risk personnel, and elevate significant issues to senior management or the board.
The board should oversee rather than administer the program. Directors should understand how AI supports strategy, what presents the greatest risk and whether management has established accountability, risk tiering and meaningful human oversight.
Do not overlook model risk management
Existing model risk management principles remain an important foundation. If AI influences lending, pricing, fraud detection or account decisions, the bank should test, validate, document and monitor the model. Vendor development does not eliminate the bank’s responsibility to understand operational effects.
AI models may be harder to explain and may change as data or conditions change, making ongoing monitoring essential. Explainability has direct compliance consequences because an institution must identify specific reasons when a model contributes to an adverse credit decision.
The practical message is straightforward: a new technology does not displace an existing legal obligation.
5 questions community bank leaders should ask
Where are we currently using AI?
Does our inventory include AI embedded in vendor products, rather than only tools separately purchased as AI products?
Who owns AI governance?
Has management assigned responsibility for maintaining the inventory and coordinating risk review?
Which uses present the greatest risk?
Have we distinguished routine administrative uses from systems affecting credit, pricing, customers, employees or confidential information?
Can we explain our automated decisions?
If AI influences a credit decision, can we provide the applicant with specific and accurate reasons?
What information reaches the board?
Does the board receive enough information to understand the bank’s principal AI uses, risks and controls?
A community bank does not need to complete every element of an AI program at once. It does need to begin. Assigning an owner, preparing an initial inventory and identifying the bank’s highest-risk uses will establish the foundation for a practical, scalable governance program.
This article will continue in the November/December issue of Hoosier Banker with “Managing vendor, consumer and generative AI risks.”
This information is provided for general education purposes and is not intended to be legal advice. Please consult legal counsel for specific guidance as to how this information applies to your institution’s circumstances or situation.
