A bank's AI policy should say what counts as AI at the bank, who approves and owns it, and how each use is inventoried, risk-rated, tested, monitored and retired. The documents that supervisors and standard-setters have published name thirteen clauses between them: scope and definitions; board approval and senior ownership; roles and approval authority; an inventory; risk classification; permitted use and decision boundaries; development, testing and validation standards; data governance; human oversight; monitoring, change and incidents; third-party AI; training; and retirement and review. No document requires a standalone AI policy or prints a template. The fullest list of contents is Principle 2.3 of the PRA's SS1/23, which sets eight minimum items for a board-approved model risk policy. NIST AI 100-1 (January 2023) frames its GOVERN function around policies, processes, procedures and practices. The FSB's twelve sound practices of October 15, 2026 say AI risk goes into existing policies, with new ones 'as appropriate'. In the United States, the April 17, 2026 model risk guidance (OCC Bulletin 2026-13, SR 26-2) describes what effective policies do but excludes generative and agentic AI, and OCC Bulletin 2026-54 of November 4, 2026 gives examiners sixteen components without setting expectations for banks. NCUA Letter 26-CU-01 does not mention AI. Seven banks on this site disclose an AI policy; none publishes its text.
PROFILES AND DOCUMENTS ON THIS SITE: Barclays · KeyBank · FNB · Citizens Business Bank · Banner Bank · Columbia · UBS · OCC Bulletin 2026-54 · OCC Bulletin 2026-13 · SR 26-2 · NCUA Letter 26-CU-01 · NIST AI RMF 1.0 · FSB AI sound practices (final report, Oct 2026) · PRA SS1/23 · MAS Guidelines on Artificial Intelligence Risk Management · Regulation (EU) 2024/1689 · EBA/GL/2026/09 (third-party risk)
AI policy for banks: what the documents name
Bank supervisors and standard-setters name thirteen clauses for a bank's AI policy, from scope and definitions through board approval, an inventory, risk classification, permitted use, testing, human oversight, monitoring, third-party AI and training to retirement. None of them requires a standalone AI policy or publishes a template. The most detailed list of contents is in the PRA's SS1/23, and the most recent US text, OCC Bulletin 2026-54 of November 4, 2026, is written for examiners and sets no expectations for banks.
What should a bank's AI policy contain?
Read together, the documents bank supervisors and standard-setters have published name thirteen things a bank's AI policy covers. None of them prints a model policy, and they do not agree on a format: the PRA lists the minimum contents of a model risk policy clause by clause, NIST and the FSB describe outcomes that policies should produce, and the OCC's November 2026 framework describes what examiners may look at. The table keeps each document's own words so that a clause can be traced to the text that names it.
| Clause | What the documents say | Named in |
|---|---|---|
| Scope and definitions | PRA SS1/23 lists first among a policy's minimum contents 'the definitions of a model and model risk'. The US model risk guidance puts generative and agentic AI outside its scope and says the bank's own 'risk management and governance practices should guide the determination of appropriate governance and controls' for what it does not cover. The OCC framework starts from 'a clearly defined and documented purpose' for each system. | PRA SS1/23, SR 26-2, OCC Bulletin 2026-13, OCC Bulletin 2026-54 |
| Board approval and senior ownership | SS1/23: 'The board should approve the MRM policy and appoint an accountable individual'. MAS expects the board and senior management to set 'clear roles and responsibilities, risk appetite, and risk management frameworks, policies and procedures'. FSB Sound Practice 1 has the board and senior management align AI adoption and governance with business model, risk appetite and strategy. NIST GOVERN 2.3: 'Executive leadership of the organization takes responsibility for decisions about risks'. | PRA SS1/23, MAS AI Risk Management Guidelines, FSB sound practices (Oct 2026), NIST AI 100-1 |
| Roles, responsibilities and approval authority | The US guidance says sound governance delineates 'the individual(s) responsible for key activities throughout the model lifecycle'. The OCC framework lists decision rights for 'development or procurement, risk classification, testing, deployment, material change, exception approval, suspension, and retirement'. NIST GOVERN 2.1 asks that roles, responsibilities and lines of communication be documented. | SR 26-2, OCC Bulletin 2026-54, NIST AI 100-1, FSB sound practices (Oct 2026) |
| Inventory and documentation of AI use | NIST GOVERN 1.6: 'Mechanisms are in place to inventory AI systems'. MAS expects institutions to 'maintain inventories at an appropriate level of granularity'. FSB Sound Practice 3 includes 'processes for documentation of AI use'. The OCC framework says an inventory may capture 'the use case, owner, provider, permissions, deployment status, monitoring, and fail-over arrangements'. The US guidance calls a model inventory 'common industry practice'. | NIST AI 100-1, MAS AI Risk Management Guidelines, FSB sound practices (Oct 2026), OCC Bulletin 2026-54, SR 26-2 |
| Risk classification and materiality | SS1/23 puts 'the model tiering approach' in the policy, including how tiers set the scope, intensity and frequency of validation. FSB Sound Practice 5 asks for a systematic assessment of the materiality and risk of AI use cases 'at the inception stage and thereafter'. The OCC framework says classification may rest on 'potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication' of the system. | PRA SS1/23, FSB sound practices (Oct 2026), OCC Bulletin 2026-54, MAS AI Risk Management Guidelines |
| Permitted use and decision boundaries | The OCC framework describes documenting 'what an SI system or agent is designed to do, what it is not designed to do, who or what may invoke it, the data and systems it is permitted to access, the actions it could take, and the circumstances that may require human review or suspension', and treats activity outside the approved purpose as a possible control failure. | OCC Bulletin 2026-54 |
| Development, testing and validation standards | SS1/23 requires 'standards for model development' (testing procedures, selection criteria, documentation standards, performance thresholds) and 'standards for model validation'. FSB Sound Practice 9 has institutions evaluate AI performance 'through performance assessments, testing, and ongoing monitoring'. For high-risk systems, Article 17 of the EU AI Act lists examination, test and validation procedures among the written policies of a provider's quality management system. | PRA SS1/23, FSB sound practices (Oct 2026), EU AI Act, SR 26-2 |
| Data governance | SS1/23: 'data quality management procedures', with specific controls for 'alternative or unstructured data'. FSB Sound Practice 7: data that is 'fit-for-purpose for training, testing, and using AI (i.e. accurate, complete, consistent, reliable, secure)'. EU AI Act Article 17(1)(f): 'systems and procedures for data management'. | PRA SS1/23, FSB sound practices (Oct 2026), EU AI Act |
| Human oversight | FSB Sound Practice 10 asks for human oversight 'relevant to the materiality, risk, autonomy, complexity, and explainability' of each use case. NIST GOVERN 3.2: 'Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems'. The OCC framework distinguishes human-in-the-loop review before an action from human-on-the-loop monitoring with authority to intervene. | FSB sound practices (Oct 2026), NIST AI 100-1, OCC Bulletin 2026-54 |
| Monitoring, change and incidents | SS1/23 puts performance thresholds, root-cause analysis and 'the model approval process and model change' in the policy. MAS names 'monitoring and change management' among the lifecycle controls. NIST GOVERN 4.3 covers 'AI testing, identification of incidents, and information sharing'. The FSB report describes 'root-cause analysis and post-incident reviews for AI-related incidents'. | PRA SS1/23, MAS AI Risk Management Guidelines, NIST AI 100-1, FSB sound practices (Oct 2026) |
| Third-party and vendor AI | NIST GOVERN 6: 'Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues'. FSB Sound Practice 12 focuses on 'performance, transparency, data quality, supply chain and concentration risks, and business continuity'. MAS: institutions 'remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties'. | NIST AI 100-1, FSB sound practices (Oct 2026), MAS AI Risk Management Guidelines, OCC Bulletin 2026-54 |
| Training and AI literacy | NIST GOVERN 2.2: personnel and partners 'receive AI risk management training'. Article 4 of the EU AI Act requires providers and deployers to 'take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff'. The OCC framework notes that board members, senior management, independent risk management, validation and audit 'may need technical knowledge and access proportionate to the bank's use cases'. | NIST AI 100-1, EU AI Act, OCC Bulletin 2026-54 |
| Retirement and review of the policy itself | NIST GOVERN 1.7 covers 'decommissioning and phasing out AI systems safely'; GOVERN 1.5 plans 'ongoing monitoring and periodic review of the risk management process'. SS1/23 has firm-wide policies 'reviewed on a regular basis', including for 'new and advancing technologies the firm is exposed to'. The FSB report lists 'refreshing policies, standards and procedures based on learning'. | NIST AI 100-1, PRA SS1/23, FSB sound practices (Oct 2026) |
Two patterns show in the table. First, the most detailed list of policy contents is not in an AI document at all: paragraph (c) of Principle 2.3 in PRA SS1/23 sets out eight items "at a minimum", from definitions and tiering to data quality, validation, performance monitoring, mitigants and the approval and change process, and requires that firm-wide policies be approved by the board. Second, the clauses that are specific to newer AI, permitted use, decision boundaries and human oversight of agents, come from the two 2026 documents written with generative and agentic systems in view: OCC Bulletin 2026-54 and the FSB's sound practices.
The wider governance structure a policy sits in (the committee, the inventory, validation, monitoring and board reporting) is laid out element by element on AI governance in banking. This page is about the policy document: which clauses the texts name, whether any text requires the document, and what banks have said about theirs.
Is a bank required to have a written AI policy?
No document on this page requires a bank to hold a standalone document titled "AI policy". What the texts require or expect is that AI risk is covered by written policies and procedures, and several say explicitly that existing ones may do the job. The FSB's final report says institutions incorporate AI risk "into existing risk management frameworks, policies and procedures, as appropriate" and enhance them or establish new ones only where they fall short. MAS's media release says existing governance structures may be used and that institutions with low-impact AI use "may put in place basic policies and procedures". The OCC framework says examiners "should not treat SI as a separate and distinct risk category".
| Document | Issued by | Date | Legal force, in its own words | What it says about a written policy |
|---|---|---|---|---|
| OCC Bulletin 2026-54 | OCC | Nov 4, 2026 | Examiner resource; 'does not establish supervisory expectations for banks' | Does not ask for an AI policy document. Defines SI governance as 'the set of organizational policies, rules, frameworks, roles, and oversight processes' for SI, and says banks 'are not required to define a separate SI risk appetite'. |
| OCC Bulletin 2026-13 | OCC, with the Federal Reserve (SR 26-2) and FDIC | Apr 17, 2026 | Guidance; 'does not set forth enforceable standards or prescriptive requirements' | 'Effective policies define risk management expectations and establish a framework for assessing the magnitude of model risk'. Generative and agentic AI are outside its scope. |
| NCUA 26-CU-01 | NCUA | Jan 14, 2026 | Supervisory priorities for 2026 | Does not mention artificial intelligence. Its references to policies concern capital planning and Bank Secrecy Act compliance; it lists Letter 07-CU-13 on third-party relationships among its lending resources. |
| NIST AI 100-1 | NIST | Jan 26, 2023 | Voluntary framework, 'non-sector-specific, and use-case agnostic' | GOVERN 1: 'Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively'. |
| FSB sound practices (Oct 2026) | Financial Stability Board | Oct 15, 2026 | 'Non-prescriptive and do not constitute a binding international standard' | AI risk goes into 'existing risk management frameworks, policies and procedures, as appropriate'; where those fall short, institutions 'enhance these policies, procedures, or frameworks, or establish new ones as appropriate'. |
| PRA SS1/23 | Prudential Regulation Authority (UK) | May 17, 2023 | Supervisory statement, in effect since 17 May 2024 | Principle 2.3: 'comprehensive policies and procedures that formalise the MRM framework', approved by the board, with eight minimum contents. It is a model risk policy, written for all models rather than for AI specifically. |
| MAS AI Risk Management Guidelines | Monetary Authority of Singapore | Oct 7, 2026 | Guidelines; take effect 7 October 2027 | Institutions 'may put in place basic policies and procedures to govern their AI use' where poor performance or unavailability of their AI is unlikely to have a material impact; controls scale with risk exposure. |
| EU AI Act | European Union | Jul 12, 2024 | Regulation (binding) | Article 17: providers of high-risk AI systems document a quality management system 'in the form of written policies, procedures and instructions'; for financial institutions most of it is deemed fulfilled by complying with internal governance rules under EU financial services law. |
The legal weight differs sharply across the eight. Only the EU AI Act is binding law, and its written-policies requirement in Article 17 falls on providers of high-risk AI systems; Article 17(4) says that for financial institutions subject to internal governance requirements under EU financial services law the obligation is, apart from three listed points, deemed fulfilled by complying with those rules. The US model risk guidance states that non-compliance with it "will not result in supervisory criticism". The NIST framework describes itself as voluntary. The FSB calls its practices a toolkit that institutions can tailor.
One document often cited in this context says less than its reputation suggests. NCUA Letter 26-CU-01, the agency's 2026 supervisory priorities, does not mention artificial intelligence. It tells credit unions that examiners may review "policies, procedures, risk limits, and capital planning practices" and that Bank Secrecy Act policies must keep pace with rule changes, but it names no AI clause. The NCUA's AI material sits on its resource pages, which are listed on the NCUA page of the tracker.
What do the OCC and the Federal Reserve say an AI policy should cover?
Two US documents bear on the question and they divide the field between them. The April 17, 2026 interagency model risk guidance, issued by the OCC as Bulletin 2026-13 and by the Federal Reserve as SR 26-2, has a section on governance and controls that opens: "All components of the model lifecycle benefit from model governance that is supported by clear policies and effective controls." It continues: "Effective policies define risk management expectations and establish a framework for assessing the magnitude of model risk and for applying model risk management practices commensurate with that risk. Procedures support policy implementation by establishing a monitoring and control process and specifying the allocation of resources to that process." The same section covers roles and responsibilities, the model inventory and documentation.
That guidance applies to traditional statistical and quantitative models and to "non-generative, non-agentic AI models". A footnote puts the rest outside: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." For those, it says only that a banking organization's risk management and governance practices should guide the choice of governance and controls. A bank's policy therefore has two populations of systems to describe, one inside model risk guidance and one outside it.
The second document is the examiner's side of that gap. OCC Bulletin 2026-54 (November 4, 2026) transmits a framework of sixteen components grouped into six pillars: purpose, risk, control, oversight, resilience and assurance. It does not ask for a policy document: the word "policies" appears in its glossary definitions of guardrails and of SI governance, and its bulletin says the framework "does not establish supervisory expectations for banks". What it adds to the clause list is specificity about agents: a documented purpose statement, the people and systems permitted to invoke a system, the data and tools it may reach, the actions it may take alone and the ones that call for "review, approval, abstention, or escalation", and decision rights at each lifecycle gate. Component 2.4 says the board and senior management "may establish an SI risk appetite, identify accountable executives and use-case owners, assign responsibilities and receive information on material SI use". The component-by-component reading is in our guide to the OCC Super Intelligence framework; it is not repeated here.
What do NIST, the FSB, the PRA, MAS and the EU AI Act add?
NIST AI 100-1
The GOVERN function of the AI Risk Management Framework is the closest any of these texts comes to a table of contents for a policy. Its six categories cover policies and processes for managing AI risk (GOVERN 1), accountability structures (2), workforce diversity in risk decisions (3), a culture that considers and communicates AI risk (4), engagement with outside AI actors (5) and third-party software, data and supply chain (6). Subcategories name legal and regulatory requirements (1.1), the level of risk management set by risk tolerance (1.3), an inventory (1.6), decommissioning (1.7), training (2.2) and incident identification (4.3). The framework is voluntary and written for all sectors. In the disclosure table below, KeyBank says its AI risk management framework is aligned to the framework's core functions and Columbia says its AI asset platform aligns with it.
FSB sound practices (October 2026)
The FSB's final report of October 15, 2026 sets out twelve sound practices in two groups, organisation-wide governance (1 to 4) and risk management across the AI lifecycle (5 to 12). Practice 3 is the one that speaks about policies directly, and Practice 4 asks institutions to adjust oversight and governance as AI evolves. The report says boards and senior management are "strongly encouraged to reference" the practices and that they "are non-prescriptive and do not constitute a binding international standard".
PRA SS1/23
SS1/23 is a model risk statement, in effect since 17 May 2024, and its Principle 2.3 is the only text here that lists a policy's minimum contents as a numbered list. It adds two requirements about the document itself: policies "should cross-reference and align with other relevant parts of their broader risk management policies", and compliance with internal policies is assessed and reported to the board on a regular basis. Our SS1/23 guide covers the five principles.
MAS Guidelines on AI Risk Management
MAS issued its Guidelines on 7 October 2026; they apply to all financial institutions and all forms of AI and take effect on 7 October 2027, with Sections 3 and 4 expected from that date and Sections 5 and 6 by 7 October 2028. The media release summarises four expectations: oversight with clear accountabilities; identifying, assessing and managing AI risk across the lifecycle; managing third-party AI; and applying the Guidelines in a risk-proportionate manner. It adds that institutions "need not establish a dedicated AI committee solely to meet this expectation".
EU AI Act
Regulation (EU) 2024/1689 contributes two provisions. Article 4 obliges providers and deployers of AI systems to take measures for the AI literacy of staff and others operating AI on their behalf. Article 17 requires a provider of a high-risk AI system to document a quality management system in written policies, procedures and instructions covering, among other things, a strategy for regulatory compliance, design and development controls, test and validation procedures, data management and the risk management system. Which bank systems are high-risk, and from when, is on the tracker's EU AI Act page.
What do the documents say an AI policy should cover for vendor and third-party AI?
Every AI-specific document here has a third-party clause, and they converge on one sentence: the bank stays accountable. MAS says institutions "remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties", should obtain sufficient assurance from providers and, if risks cannot be brought within risk appetite, "should consider limiting, suspending or replacing the use of the third-party AI service". The OCC framework says that although development or hosting may be spread across vendors, "accountability for managing the bank's risk generally remains with the bank", and that SI third-party risk management "may supplement existing interagency third-party risk management guidance". NIST GOVERN 6.2 adds contingency processes for failures or incidents in third-party data or AI systems deemed high-risk. FSB Sound Practice 12 lists what to focus on: performance, transparency, data quality, supply chain and concentration risks, and business continuity.
In the EU the general third-party texts matter as much as the AI ones, and the newest of them is silent on AI. The EBA's Guidelines on the sound management of third-party risk (EBA/GL/2026/09), published on 18 September 2026, require a management-body-approved written policy on the use of third-party services supporting critical or important functions, reviewed at least once a year. They cover non-ICT services only, exclude ICT services because DORA governs them, do not mention artificial intelligence, and have no application date yet. Among the banks below, CVB Financial is the one whose disclosure says in terms that its AI policy extends to vendors.
What have banks disclosed about their own AI policies?
Seven banks profiled on this site state in a filing, a report or on their own site that they have an AI policy and say something about what is in it or who approves it. Each source describes the policy; none of the seven reproduces its text. The quotations were re-read in the cited documents on 11 November 2026.
| Bank | Where it is disclosed | Source date | What the bank says about its policy |
|---|---|---|---|
| Barclays | Annual report on Form 20-F for 2025 | Feb 10, 2026 | An 'Artificial Intelligence (AI) Policy', supported by an AI standard, sits in the Model Risk Framework. Its stated objectives: define Ethical AI Principles; set an enterprise-wide definition of AI and 'prohibited, high, medium and low risk uses of AI'; define governance and escalation pathways to senior management; and define a control objective for AI training and literacy. A Group AI Governance Council works under the Head of AI/ML Risk, who reports compliance with the AI Policy and AI Standard to board risk committees. |
| KeyBank | 2025 Corporate Responsibility Report | Aug 10, 2026 | The Enterprise Risk Management Committee is 'the governing and approving body for Key's Artificial Intelligence Policy'. AI systems 'are required to be identified and inventoried; undergo governed intake and risk assessment; be deployed through approved channels; and be monitored and reported' in line with risk appetite. |
| FNB | 2026 proxy statement | Mar 25, 2026 | The Board Risk Committee oversees AI governance. An 'Artificial Intelligence (AI) Policy and Model Risk Management Policy' are described as having 'a focus on transparency, model explainability, bias mitigation and governance standards'; the Director of AI and Innovation works with a Data and AI Governance Committee and a Model Risk Management Committee. |
| Citizens Business Bank | FY2025 Form 10-K and 2026 proxy statement | Apr 7, 2026 | An AI Policy 'establishes a governance framework for developing, deploying, and managing AI and Generative AI (GenAI) solutions and initiatives, including those involving vendors'. The proxy says the Policy Framework and an AI Governance Council chaired by the Chief Operating Officer govern review and approval of AI solutions, 'define the acceptable use of AI solutions', and 'provide for regular monitoring and reporting on AI activities'. |
| Banner Bank | Corporate Responsibility Report 2025 | Jul 14, 2026 | A Generative AI policy 'requires a comprehensive vetting process for any proposed Gen AI applications, overseen by our Fintech Council and evaluated against our strategic priorities, values, risk appetite and data security policies'. |
| Columbia | Corporate Citizenship Report 2025 | Sep 19, 2026 | 'We have an internal AI Policy which reinforces our commitment to responsible innovation', alongside a Responsible AI Working Group of technology, risk, compliance, legal and cybersecurity leaders and an AI asset platform the bank says aligns with the NIST AI Risk Management Framework. |
| UBS | Innovation and AI page on ubs.com (undated) | Oct 13, 2026 | 'Our Group AI policy defines clear standards and requirements for developing, adopting, and operating AI responsibly'; an AI Operating & Risk Committee oversees execution of the AI strategy, and 'all employees receive mandatory annual training in the responsible use of AI'. |
The disclosures differ most in how much of the policy they reveal. Barclays lists four objectives and places the AI Policy inside its Model Risk Framework, beside a separate Model Risk Policy. KeyBank names the management risk committee that approves its policy, and FNB places AI governance under its Board Risk Committee. CVB Financial is the only one of the seven to use the words "acceptable use". Banner's policy is limited to generative AI. Columbia and UBS confirm that a policy exists and describe the governance around it.
Set against the clause table, the seven disclosures mention definitions and risk tiers (Barclays), approval or vetting of AI uses (KeyBank, CVB Financial, Banner), an inventory (KeyBank), acceptable use (CVB Financial), monitoring and reporting (KeyBank, CVB Financial), vendors (CVB Financial) and training (Barclays, FNB, UBS). That is a count of what the banks chose to publish, not of what their policies contain. Governance bodies, named AI leaders and the rest of each bank's record are on the governance hub and on each bank's page.
What do the documents not say about AI policies?
Four absences are worth stating, because each is commonly assumed.
- No supervisor on this page has published a template or model AI policy for banks. The nearest things are the PRA's list of minimum contents for a model risk policy and NIST's GOVERN subcategories.
- No US banking agency document on this page requires an AI policy by name. The model risk guidance is non-enforceable by its own terms and excludes generative and agentic AI; the OCC framework is addressed to examiners; the NCUA's 2026 priorities letter does not mention AI.
- None of the documents sets a review frequency for an AI policy. SS1/23 says policies are reviewed "on a regular basis"; the one annual review cycle in these texts is in EBA/GL/2026/09, and it applies to the policy on non-ICT third-party services.
- No bank in the disclosure table has published the text of its AI policy, and none states how often the policy is reviewed.
Documents change. The OCC says its framework "should therefore be treated as a living document", MAS has said it intends to consult in 2027 on further guidance for agentic AI, and the EBA guidelines await an application date. The tracker pages linked from this guide carry the current status of each.
What should a bank's AI policy contain?
The published documents name thirteen clauses: scope and definitions, board approval and senior ownership, roles and approval authority, an inventory, risk classification, permitted use, development and validation standards, data governance, human oversight, monitoring and incidents, third-party AI, training, and retirement and review. Each is mapped on this page to the document that names it.
Are banks required to have an AI policy?
No document covered here requires a standalone AI policy by name. The texts expect AI risk to be covered by written policies and procedures, and the FSB and MAS both say existing ones may be used or enhanced. The EU AI Act requires written policies for providers of high-risk AI systems and treats most of that as met by a financial institution's internal governance rules.
Does the OCC require banks to have an AI policy?
Not by name. OCC Bulletin 2026-13 describes what effective model risk policies do but is non-enforceable guidance and excludes generative and agentic AI. OCC Bulletin 2026-54 gives examiners a sixteen-component framework and says it does not establish supervisory expectations for banks and that banks are not required to define a separate SI risk appetite.
What does NCUA Letter 26-CU-01 say about AI policies?
Nothing. The NCUA's 2026 supervisory priorities letter, issued January 14, 2026, does not mention artificial intelligence. Its references to policies concern capital planning and Bank Secrecy Act compliance, and it lists the 2007 letter on evaluating third-party relationships among its lending resources.
Is there a template AI policy for banks from a regulator?
None of the supervisors or standard-setters covered here has published one. The closest texts are Principle 2.3 of PRA SS1/23, which lists eight minimum contents of a model risk policy, and the GOVERN function of NIST AI 100-1, whose subcategories describe what policies and procedures should achieve.
Who approves a bank's AI policy?
PRA SS1/23 says the board should approve the model risk policy. MAS expects the board and senior management to set frameworks, policies and procedures. In bank disclosures, KeyBank names its Enterprise Risk Management Committee as the approving body, and FNB places AI governance under its Board Risk Committee.
Which banks have disclosed an AI policy?
On this site's sourced bank pages, Barclays, KeyBank, FNB, CVB Financial (Citizens Business Bank), Banner Bank, Columbia Banking System and UBS each state that they have one. Barclays gives the most detail, listing four objectives including risk tiers for AI uses; none of the seven publishes the policy itself.
Does a bank's AI policy have to cover vendor AI?
The AI-specific documents all address it. NIST GOVERN 6 calls for policies and procedures on third-party software and data, FSB Sound Practice 12 covers third-party AI dependencies, and MAS says institutions remain accountable for AI provided by third parties. CVB Financial's 10-K says its AI Policy covers initiatives involving vendors.
- OCC Bulletin 2026-54: Super Intelligence: Supervisory Framework — Office of the Comptroller of the Currency, Nov 4, 2026 (occ.gov) · our page on OCC Bulletin 2026-54
- Super Intelligence: Supervisory Framework (full text, PDF) — Office of the Comptroller of the Currency, Nov 4, 2026 (occ.gov) · our page on OCC Bulletin 2026-54
- SR 26-2: Revised Guidance on Model Risk Management — Federal Reserve Board, Apr 17, 2026 (federalreserve.gov) · our page on SR 26-2
- SR 26-2 attachment: Supervisory Guidance on Model Risk Management (interagency text) — Federal Reserve Board, OCC, FDIC, Apr 17, 2026 (federalreserve.gov) · our page on SR 26-2
- Letter to Credit Unions 26-CU-01: NCUA's 2026 Supervisory Priorities — National Credit Union Administration, Jan 14, 2026 (ncua.gov) · our page on NCUA Letter 26-CU-01
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — National Institute of Standards and Technology, Jan 26, 2023 (nvlpubs.nist.gov) · our page on NIST AI RMF 1.0
- Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report — Financial Stability Board, Oct 15, 2026 (fsb.org) · our page on FSB AI sound practices (final report, Oct 2026)
- Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report (PDF) — Financial Stability Board, Oct 15, 2026 (fsb.org) · our page on FSB AI sound practices (final report, Oct 2026)
- SS1/23: Model risk management principles for banks — Bank of England, Prudential Regulation Authority, May 17, 2023 (bankofengland.co.uk) · our page on PRA SS1/23
- Guidelines on Artificial Intelligence Risk Management for Financial Institutions — Monetary Authority of Singapore, Oct 7, 2026 (mas.gov.sg) · our page on MAS Guidelines on Artificial Intelligence Risk Management
- MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions — Monetary Authority of Singapore, Oct 7, 2026 (mas.gov.sg) · our page on MAS Guidelines on Artificial Intelligence Risk Management
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — EUR-Lex, Jul 12, 2024 (eur-lex.europa.eu) · our page on Regulation (EU) 2024/1689
- Final report: Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09) — European Banking Authority, Sep 18, 2026 (eba.europa.eu) · our page on EBA/GL/2026/09 (third-party risk)
- Barclays PLC Annual Report 2025 on Form 20-F — Barclays PLC (SEC filing), Feb 10, 2026 (sec.gov)
- KeyCorp 2025 Corporate Responsibility Report (business edition) — KeyCorp, Aug 10, 2026 (key.com)
- F.N.B. Corporation 2026 Proxy Statement (Schedule 14A) — F.N.B. Corporation (SEC filing), Mar 25, 2026 (sec.gov)
- CVB Financial Corp. Annual Report on Form 10-K for fiscal year 2025 — CVB Financial Corp. (SEC filing), Feb 27, 2026 (sec.gov)
- CVB Financial Corp. Definitive Proxy Statement for the 2026 annual meeting — CVB Financial Corp. (SEC filing), Apr 7, 2026 (sec.gov)
- Banner Bank Corporate Responsibility Report 2025 — Banner Bank, Jul 14, 2026 (bannerbank.com)
- Columbia Banking System Corporate Citizenship Report 2025 — Columbia Banking System, Sep 19, 2026 (columbiabank.com)
- Innovation and AI at UBS — UBS, Oct 13, 2026 (ubs.com)
When a supervisor or a bank moves on AI governance, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning