The Conference of State Bank Supervisors (CSBS) and the NYDFS have each issued new guidance addressing how financial institutions should identify and manage risks associated with AI and other emerging technologies. On September 16, CSBS released a new AI supervisory framework designed to help state examiners assess AI use and related risks at state-chartered banks and state-licensed nonbank financial institutions. The framework follows September 10 guidance from NYDFS addressing cybersecurity risk assessments, including how regulated entities should account for AI and other emerging technologies.
The CSBS framework is a discretionary tool designed to help state examiners identify and understand AI use, assess associated risks, and determine when additional review may be appropriate. Each state regulator will decide whether and how to incorporate the framework into its supervisory program. NYDFS, meanwhile, clarified how entities subject to its Cybersecurity Regulation should conduct and update required risk assessments. The NYDFS guidance does not create new obligations, but specifically identifies AI, including frontier AI models, as a technology that may materially change an entity’s cyber risk profile.
Specifically, the CSBS framework and NYDFS guidance:
- Emphasizes governance and oversight. Institutions should establish clear responsibility for identifying, assessing, and managing technology risks and ensure relevant findings reach senior management.
- Calls for comprehensive risk identification. CSBS provides tools for inventorying and risk-tiering AI use cases, while NYDFS expects risk assessments to account for emerging technologies, assets, data flows, and changing threats.
- Focuses on third-party dependencies. Both materials highlight risks arising from vendors and service providers, including model, cybersecurity, concentration, and operational risks.
- Treats risk management as an ongoing process. Institutions should revisit assessments as technologies, business operations, vendors, and threat environments change rather than relying on static reviews.
Putting It Into Practice: The CSBS framework and NYDFS guidance follows other recent state-level efforts to address the use of AI and emerging technologies in financial services (previously discussed here). The latest developments reinforce the importance of maintaining clear AI governance, inventories of AI use cases, vendor oversight, and risk-assessment procedures that account for changes in technology and business operations. Financial institutions should also monitor how individual state agencies incorporate the CSBS framework into their examination and supervisory programs.