Bank AI is regulated by use case, not by technology. Credit scoring is the most constrained (binding EU AI Act obligations plus US adverse-action and fair-lending law); AML and fraud are the most encouraged; generative and agentic AI are the least settled. Each section below is a question-and-answer: which authorities have spoken on that use case, and which document is the one to read.
Jump to
Credit scoring & underwriting
Which rules govern AI credit scoring and underwriting?
Creditworthiness models are the most heavily regulated bank AI use case: explicitly high-risk under the EU AI Act, and subject to adverse-action, fair-lending and model-risk requirements in the US.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Financial Innovation Rule (2023) — Financial Innovation: Loan Participations, Eligible Obligations, and Notes of Liquidating Credit Unions (final rule) (Sep 21, 2023) In force 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn CFPB Innovation Spotlight on AI/ML adverse action notices (2020) — Innovation spotlight: Providing adverse action notices when using AI/ML models (Jul 7, 2020) Final ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| White House | Non-binding standards | |
| NY DFS | Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025) Superseded SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded | Binding law |
| California CPPA | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025) In force California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025) Final Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) (Jun 28, 2018) In force | Binding law |
| Massachusetts AG | Massachusetts AG Earnest Operations settlement (July 2025) — Assurance of Discontinuance: In the matter of Earnest Operations LLC (Massachusetts Attorney General, announced July 10, 2025) (Jul 10, 2025) In force Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| New Jersey DCR | NJ DCR Algorithmic Discrimination Guidance (January 2025) — Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination (Jan 9, 2025) In force | Binding law |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission guidelines on the AI system definition — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025) In force Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| ECB | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models (Jul 28, 2025) In force | Supervisory guidance |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models (Aug 4, 2023) Final EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models (Nov 11, 2021) Superseded EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| BaFin | BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Feb 18, 2022) Final BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final | Supervisory guidance |
| OSFI | Supervisory guidance | |
| MAS | MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector (Nov 12, 2018) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox++ joint circular — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026) In force HKMA BDAI consumer protection principles — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019) In force | Supervisory guidance |
| APRA / ASIC | ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI draft circular on Regulatory Principles for Management of Model Risks in Credit — Regulatory Principles for Management of Model Risks in Credit (draft circular for comments) (Aug 5, 2024) Proposed | Voluntary framework |
| FSB | FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | Non-binding standards |
Fair lending & discrimination
Which rules apply to AI bias and fair lending?
Anti-discrimination law applies regardless of how a decision was made. Regulators have said 'the algorithm did it' is not a defence.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| NCUA | NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn CFPB Innovation Spotlight on AI/ML adverse action notices (2020) — Innovation spotlight: Providing adverse action notices when using AI/ML models (Jul 7, 2020) Final ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force | Binding law |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| White House | Non-binding standards | |
| NY DFS | Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded | Supervisory guidance |
| NYC DCWP | NYC Local Law 144 (AEDT) — A Local Law to amend the administrative code of the city of New York, in relation to automated employment decision tools (Local Law 144 of 2021) and DCWP final rule (Dec 11, 2021) In force | Binding law |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded Colorado SB 21-169 and Regulation 10-1-1 — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021) In force | Binding law |
| California CPPA | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025) In force California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025) Final | Binding law |
| Texas AG | Texas TRAIGA (HB 149) — Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature) (Jun 22, 2025) In force | Binding law |
| Illinois IDHR | Illinois HB 3773 (P.A. 103-0804) — Illinois Human Rights Act amendments on artificial intelligence in employment (H.B. 3773, Public Act 103-0804) (Aug 9, 2024) In force | Binding law |
| Massachusetts AG | Massachusetts AG Earnest Operations settlement (July 2025) — Assurance of Discontinuance: In the matter of Earnest Operations LLC (Massachusetts Attorney General, announced July 10, 2025) (Jul 10, 2025) In force Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| New Jersey DCR | NJ DCR Algorithmic Discrimination Guidance (January 2025) — Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination (Jan 9, 2025) In force | Binding law |
| EU AI Act | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force | Supervisory guidance |
| EIOPA | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management (Aug 6, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| BaFin | BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final DNB SAFEST AI principles — General principles for the use of Artificial Intelligence in the financial sector (Jul 25, 2019) Final | Supervisory guidance |
| MAS | MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) Proposed MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector (Nov 12, 2018) In force | Supervisory guidance |
| HKMA | HKMA GenAI consumer protection circular — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024) In force HKMA BDAI consumer protection principles — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019) In force HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| APRA / ASIC | ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI draft circular on Regulatory Principles for Management of Model Risks in Credit — Regulatory Principles for Management of Model Risks in Credit (draft circular for comments) (Aug 5, 2024) Proposed | Voluntary framework |
AML / KYC
Which rules govern AI in AML, sanctions screening and KYC?
Regulators actively encourage machine learning in transaction monitoring, but expect the same explainability and validation as any other BSA/AML control.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| OCC | OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final | Supervisory guidance |
| FinCEN | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026) In force FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | Treasury $4B AI fraud-prevention announcement (Oct 2024) — Treasury Announces Enhanced Fraud Detection Processes, Including Machine Learning AI, Prevented and Recovered Over $4 Billion in Fiscal Year 2024 (Oct 17, 2024) Final | Voluntary framework |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA/GL/2022/15 (remote customer onboarding) — EBA/GL/2022/15 Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (Nov 22, 2022) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final | Supervisory guidance |
| BaFin | BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Feb 18, 2022) Final BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| MAS | MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025) In force | Supervisory guidance |
| HKMA | HKMA circular on AI for monitoring of suspicious activities — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024) In force | Supervisory guidance |
| Basel Committee | Non-binding standards |
Fraud detection
Which rules govern AI-based fraud detection — and AI-enabled fraud?
Two sides: banks deploying AI to catch fraud, and regulators warning about deepfakes and generative-AI-enabled scams targeting banks and their customers.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC AI Scams Customer Advisory — Customer Advisory: AI Won't Turn Trading Bots into Money Machines (Jan 25, 2024) In force | Supervisory guidance |
| FinCEN | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026) In force FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury $4B AI fraud-prevention announcement (Oct 2024) — Treasury Announces Enhanced Fraud Detection Processes, Including Machine Learning AI, Prevented and Recovered Over $4 Billion in Fiscal Year 2024 (Oct 17, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final | Voluntary framework |
| NY DFS | DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force | Supervisory guidance |
| Massachusetts AG | Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| NIST | NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final | Voluntary framework |
| EU AI Act | Commission guidelines on AI Act Article 50 transparency — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission guidelines on the AI system definition — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force | Supervisory guidance |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA/GL/2022/15 (remote customer onboarding) — EBA/GL/2022/15 Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (Nov 22, 2022) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| BaFin | BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Feb 18, 2022) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final | Supervisory guidance |
| OSFI | OSFI FIFAI II report (AGILE framework) — FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (Mar 23, 2026) Final | Supervisory guidance |
| MAS | MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025) In force MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox++ joint circular — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026) In force HKMA GenA.I. Sandbox circular — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024) In force HKMA circular on AI for monitoring of suspicious activities — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024) In force | Supervisory guidance |
| FSB | FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | Non-binding standards |
Customer-facing chatbots
Which rules apply to AI chatbots and virtual assistants in banking?
Consumer-protection law follows the customer interaction: a chatbot that gives wrong information or obstructs a dispute can be a UDAAP or compliance violation.
| Authority | Governing documents | Force |
|---|---|---|
| OCC | 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| CFPB | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance (Jun 6, 2023) Final | Binding law |
| SEC | SEC withdrawal of proposed rules (33-11377) — Withdrawal of Proposed Regulatory Actions — including the predictive data analytics conflicts proposal (Jun 12, 2025) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final | Voluntary framework |
| FINRA | FINRA Regulatory Notice 24-09 — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024) In force | Supervisory guidance |
| NY DFS | Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final | Binding law |
| California CPPA | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025) Final | Binding law |
| Texas AG | Texas TRAIGA (HB 149) — Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature) (Jun 22, 2025) In force | Binding law |
| Utah Division of Consumer Protection | Utah SB 226 (2025) — S.B. 226 Artificial Intelligence Consumer Protection Amendments (Mar 27, 2025) In force Utah AI Policy Act (SB 149) — S.B. 149 Artificial Intelligence Amendments (creating the Utah Artificial Intelligence Policy Act) (Mar 13, 2024) In force | Binding law |
| Massachusetts AG | Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| NIST | NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Commission guidelines on AI Act Article 50 transparency — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026) In force Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final | Supervisory guidance |
| ESMA | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services (May 30, 2024) Final | Supervisory guidance |
| EIOPA | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management (Aug 6, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final UK AI white paper government response (CP 1019) — A pro-innovation approach to AI regulation: government response to consultation (CP 1019) (Feb 6, 2024) In force ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| DNB / AFM | DNB SAFEST AI principles — General principles for the use of Artificial Intelligence in the financial sector (Jul 25, 2019) Final | Supervisory guidance |
| MAS | MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) Final MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector (Nov 12, 2018) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox++ joint circular — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026) In force HKMA GenA.I. Sandbox circular — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024) In force HKMA GenAI consumer protection circular — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024) In force HKMA BDAI consumer protection principles — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| Japan FSA | Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final | Voluntary framework |
| Basel Committee | Non-binding standards | |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force | Non-binding standards |
Model risk management
Which model risk management rules apply to AI and machine-learning models?
The validation, governance and 'effective challenge' framework that bank examiners test AI models against.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force | Binding law |
| SEC | Delphia / Global Predictions AI-washing settlements — SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (Mar 18, 2024) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| White House | EO 14179 — Removing Barriers to American Leadership in Artificial Intelligence (Jan 23, 2025) In force | Non-binding standards |
| FINRA | 2026 FINRA Annual Regulatory Oversight Report — 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends (Dec 9, 2025) In force FINRA Regulatory Notice 24-09 — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024) In force | Supervisory guidance |
| NY DFS | Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force | Supervisory guidance |
| NYC DCWP | NYC Local Law 144 (AEDT) — A Local Law to amend the administrative code of the city of New York, in relation to automated employment decision tools (Local Law 144 of 2021) and DCWP final rule (Dec 11, 2021) In force | Binding law |
| Colorado AI Act | SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded Colorado SB 21-169 and Regulation 10-1-1 — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021) In force | Binding law |
| California CPPA | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025) In force | Binding law |
| Illinois IDHR | Illinois HB 3773 (P.A. 103-0804) — Illinois Human Rights Act amendments on artificial intelligence in employment (H.B. 3773, Public Act 103-0804) (Aug 9, 2024) In force | Binding law |
| Massachusetts AG | Massachusetts AG Earnest Operations settlement (July 2025) — Assurance of Discontinuance: In the matter of Earnest Operations LLC (Massachusetts Attorney General, announced July 10, 2025) (Jul 10, 2025) In force | Binding law |
| New Jersey DCR | NJ DCR Algorithmic Discrimination Guidance (January 2025) — Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination (Jan 9, 2025) In force | Binding law |
| NIST | NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission GPAI model guidelines — Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act) (Jul 18, 2025) In force General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Commission guidelines on the AI system definition — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) (Dec 27, 2022) In force | Binding law |
| ECB | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models (Jul 28, 2025) In force ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force | Supervisory guidance |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models (Aug 4, 2023) Final EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models (Nov 11, 2021) Superseded EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| EIOPA | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management (Aug 6, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final UK AI white paper government response (CP 1019) — A pro-innovation approach to AI regulation: government response to consultation (CP 1019) (Feb 6, 2024) In force PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| BaFin | BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Feb 18, 2022) Final BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final DNB SAFEST AI principles — General principles for the use of Artificial Intelligence in the financial sector (Jul 25, 2019) Final | Supervisory guidance |
| FINMA | FINMA Guidance 08/2024 — FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence (Dec 18, 2024) Final | Supervisory guidance |
| OSFI | OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026) Final MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) Proposed MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) Final MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector (Nov 12, 2018) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox circular — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024) In force HKMA circular on AI for monitoring of suspicious activities — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024) In force HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| Japan FSA | Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final RBI draft circular on Regulatory Principles for Management of Model Risks in Credit — Regulatory Principles for Management of Model Risks in Credit (draft circular for comments) (Aug 5, 2024) Proposed | Voluntary framework |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Jan 6, 2026) Final BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final | Non-binding standards |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force IOSCO FR06/2021 — The use of artificial intelligence and machine learning by market intermediaries and asset managers: Final Report (Sep 7, 2021) In force | Non-binding standards |
Generative & agentic AI
Which rules cover generative AI and AI agents in banking?
The newest and least-settled area: several 2026 frameworks explicitly carve generative and agentic AI out of formal model-risk rules while signalling that dedicated guidance is coming.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final | Supervisory guidance |
| CFPB | CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance (Jun 6, 2023) Final | Binding law |
| SEC | Atkins remarks at Investor Advisory Committee (Sep 2026) — Remarks at the SEC Investor Advisory Committee Meeting on AI Technologies and the Public Markets Information Ecosystem (Sep 10, 2026) Final Atkins remarks at FSOC AI roundtable (Mar 2026) — Remarks at Financial Stability Oversight Council Artificial Intelligence Innovation Series Roundtable on Strategy and Governance Principles (Mar 4, 2026) Final Investor Advisory Committee AI disclosure recommendation — Recommendation of the SEC Investor Advisory Committee Regarding the Disclosure of Artificial Intelligence's Impact on Operations (Dec 4, 2025) Final Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final | Supervisory guidance |
| CFTC | CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force | Supervisory guidance |
| FinCEN | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026) In force FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| White House | EO 14179 — Removing Barriers to American Leadership in Artificial Intelligence (Jan 23, 2025) In force | Non-binding standards |
| FINRA | 2026 FINRA Annual Regulatory Oversight Report — 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends (Dec 9, 2025) In force FINRA Regulatory Notice 24-09 — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024) In force | Supervisory guidance |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force New York RAISE Act — Responsible AI Safety and Education (RAISE) Act, General Business Law Article 44-B (Chapter 699 of the Laws of 2025, as amended by Chapter 96 of the Laws of 2026) (Dec 19, 2025) Final DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force | Supervisory guidance |
| Colorado AI Act | HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final | Binding law |
| California CPPA | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025) In force | Binding law |
| Texas AG | Texas TRAIGA (HB 149) — Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature) (Jun 22, 2025) In force | Binding law |
| Utah Division of Consumer Protection | Utah SB 226 (2025) — S.B. 226 Artificial Intelligence Consumer Protection Amendments (Mar 27, 2025) In force Utah AI Policy Act (SB 149) — S.B. 149 Artificial Intelligence Amendments (creating the Utah Artificial Intelligence Policy Act) (Mar 13, 2024) In force | Binding law |
| NIST | CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST SP 800-218A (SSDF profile for generative AI) — Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A) (Jul 26, 2024) In force NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Commission guidelines on AI Act Article 50 transparency — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026) In force Commission GPAI model guidelines — Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act) (Jul 18, 2025) In force General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Commission guidelines on the AI system definition — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) (Dec 27, 2022) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado (Oct 14, 2025) Final ECB Guide on outsourcing cloud services — ECB Guide on outsourcing cloud services to cloud service providers (Jul 16, 2025) In force Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025) (May 14, 2025) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final | Supervisory guidance |
| ESMA | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services (May 30, 2024) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | Bailey: Frontier AI and the Question of Governance (Sep 2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026) Final FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) — Frontier AI and Cyber Resilience (Sep 2, 2026) In force HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final UK AI white paper government response (CP 1019) — A pro-innovation approach to AI regulation: government response to consultation (CP 1019) (Feb 6, 2024) In force PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force | Supervisory guidance |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final | Supervisory guidance |
| FINMA | FINMA Guidance 08/2024 — FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence (Dec 18, 2024) Final | Supervisory guidance |
| OSFI | OSFI FIFAI II report (AGILE framework) — FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (Mar 23, 2026) Final OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026) Final MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) Proposed MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025) In force MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) Final MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox++ joint circular — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026) In force HKMA GenA.I. Sandbox circular — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024) In force HKMA GenAI consumer protection circular — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 26EC32 (AI-enabled cyberattacks) — Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (Jun 2, 2026) In force SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| Japan FSA | Japan FSA/BOJ frontier AI request — Request regarding 'Short-term Responses by Financial Institutions in Light of Threat Changes from Frontier AI' (「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について) (May 22, 2026) In force Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final | Voluntary framework |
| FSB | FSB Chair's letter to G20 (Aug 2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026) Final Bowman remarks at FSB AI outreach (July 2026) — Opening remarks on sound practices for artificial intelligence (FSB virtual outreach event) (Jul 7, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force | Non-binding standards |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force | Non-binding standards |
Third-party & vendor AI
Which rules apply when a bank buys AI from a vendor?
Outsourcing does not outsource accountability: third-party risk management guidance treats AI vendors, foundation-model providers and cloud AI services as critical relationships.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final NCUA Financial Innovation Rule (2023) — Financial Innovation: Loan Participations, Eligible Obligations, and Notes of Liquidating Credit Unions (final rule) (Sep 21, 2023) In force NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | SEC v. Saniger (Nate, Inc.) — SEC Charges Founder of Nate, Inc. with Fraud Over False Claims About the Company's Use of Artificial Intelligence (Apr 9, 2025) Final Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force | Supervisory guidance |
| FinCEN | 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn | Binding law |
| U.S. Treasury | Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final | Voluntary framework |
| FINRA | 2026 FINRA Annual Regulatory Oversight Report — 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends (Dec 9, 2025) In force FINRA Regulatory Notice 24-09 — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024) In force | Supervisory guidance |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force New York RAISE Act — Responsible AI Safety and Education (RAISE) Act, General Business Law Article 44-B (Chapter 699 of the Laws of 2025, as amended by Chapter 96 of the Laws of 2026) (Dec 19, 2025) Final DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| NYC DCWP | NYC Local Law 144 (AEDT) — A Local Law to amend the administrative code of the city of New York, in relation to automated employment decision tools (Local Law 144 of 2021) and DCWP final rule (Dec 11, 2021) In force | Binding law |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final Colorado SB 21-169 and Regulation 10-1-1 — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021) In force | Binding law |
| California CPPA | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025) In force Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) (Jun 27, 2025) In force | Binding law |
| Illinois IDHR | Illinois HB 3773 (P.A. 103-0804) — Illinois Human Rights Act amendments on artificial intelligence in employment (H.B. 3773, Public Act 103-0804) (Aug 9, 2024) In force Illinois AI Video Interview Act (820 ILCS 42) — Artificial Intelligence Video Interview Act (820 ILCS 42) (Aug 9, 2019) In force | Binding law |
| Massachusetts AG | Massachusetts AG Earnest Operations settlement (July 2025) — Assurance of Discontinuance: In the matter of Earnest Operations LLC (Massachusetts Attorney General, announced July 10, 2025) (Jul 10, 2025) In force Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| New Jersey DCR | NJ DCR Algorithmic Discrimination Guidance (January 2025) — Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination (Jan 9, 2025) In force | Binding law |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST SP 800-218A (SSDF profile for generative AI) — Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A) (Jul 26, 2024) In force NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission GPAI model guidelines — Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act) (Jul 18, 2025) In force General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) (Dec 27, 2022) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB Guide on outsourcing cloud services — ECB Guide on outsourcing cloud services to cloud service providers (Jul 16, 2025) In force ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force EBA/GL/2022/15 (remote customer onboarding) — EBA/GL/2022/15 Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (Nov 22, 2022) In force | Supervisory guidance |
| ESMA | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services (May 30, 2024) Final | Supervisory guidance |
| EIOPA | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management (Aug 6, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) — Frontier AI and Cyber Resilience (Sep 2, 2026) In force BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded | Supervisory guidance |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| DNB / AFM | DNB SAFEST AI principles — General principles for the use of Artificial Intelligence in the financial sector (Jul 25, 2019) Final | Supervisory guidance |
| FINMA | FINMA Guidance 08/2024 — FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence (Dec 18, 2024) Final | Supervisory guidance |
| OSFI | OSFI FIFAI II report (AGILE framework) — FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (Mar 23, 2026) Final OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026) Final MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) Proposed MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) Final MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) In force | Supervisory guidance |
| HKMA | HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 26EC32 (AI-enabled cyberattacks) — Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (Jun 2, 2026) In force SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| Japan FSA | Japan FSA/BOJ frontier AI request — Request regarding 'Short-term Responses by Financial Institutions in Light of Threat Changes from Frontier AI' (「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について) (May 22, 2026) In force Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final RBI draft circular on Regulatory Principles for Management of Model Risks in Credit — Regulatory Principles for Management of Model Risks in Credit (draft circular for comments) (Aug 5, 2024) Proposed | Voluntary framework |
| FSB | FSB Chair's letter to G20 (Aug 2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB next steps on AI monitoring (Oct 2025) — FSB outlines next steps for authorities on AI monitoring (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force IOSCO FR06/2021 — The use of artificial intelligence and machine learning by market intermediaries and asset managers: Final Report (Sep 7, 2021) In force | Non-binding standards |
Cybersecurity
Which rules address AI-related cybersecurity risk for banks?
AI as an attack vector (deepfakes, AI-enhanced phishing) and AI as a target (model theft, data poisoning) both fall under existing cyber rules.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| FDIC | FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final | Supervisory guidance |
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force | Supervisory guidance |
| CFTC | CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| White House | Non-binding standards | |
| FINRA | 2026 FINRA Annual Regulatory Oversight Report — 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends (Dec 9, 2025) In force | Supervisory guidance |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force New York RAISE Act — Responsible AI Safety and Education (RAISE) Act, General Business Law Article 44-B (Chapter 699 of the Laws of 2025, as amended by Chapter 96 of the Laws of 2026) (Dec 19, 2025) Final Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| California CPPA | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025) In force CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025) In force | Binding law |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST SP 800-218A (SSDF profile for generative AI) — Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A) (Jul 26, 2024) In force | Voluntary framework |
| EU AI Act | DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) (Dec 27, 2022) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB Guide on outsourcing cloud services — ECB Guide on outsourcing cloud services to cloud service providers (Jul 16, 2025) In force ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA/GL/2022/15 (remote customer onboarding) — EBA/GL/2022/15 Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (Nov 22, 2022) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | Bailey: Frontier AI and the Question of Governance (Sep 2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026) Final FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) — Frontier AI and Cyber Resilience (Sep 2, 2026) In force BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final | Supervisory guidance |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final | Supervisory guidance |
| OSFI | OSFI FIFAI II report (AGILE framework) — FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (Mar 23, 2026) Final OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025) In force MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) In force | Supervisory guidance |
| HKMA | HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 26EC32 (AI-enabled cyberattacks) — Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (Jun 2, 2026) In force SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| Japan FSA | Japan FSA/BOJ frontier AI request — Request regarding 'Short-term Responses by Financial Institutions in Light of Threat Changes from Frontier AI' (「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について) (May 22, 2026) In force | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final | Supervisory guidance |
| RBI | RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final | Voluntary framework |
| FSB | FSB Chair's letter to G20 (Aug 2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
Data & privacy
Which data-protection rules constrain bank AI?
Automated-decision rights, data-governance duties and training-data provenance requirements that sit underneath every AI deployment.
| Authority | Governing documents | Force |
|---|---|---|
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| CFPB | CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final | Supervisory guidance |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| White House | Non-binding standards | |
| NY DFS | DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| Colorado AI Act | Colorado SB 21-169 and Regulation 10-1-1 — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021) In force | Binding law |
| California CPPA | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025) In force Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) (Jun 27, 2025) In force California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025) Final Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) (Jun 28, 2018) In force | Binding law |
| Texas AG | Texas TRAIGA (HB 149) — Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature) (Jun 22, 2025) In force | Binding law |
| Utah Division of Consumer Protection | Utah SB 226 (2025) — S.B. 226 Artificial Intelligence Consumer Protection Amendments (Mar 27, 2025) In force | Binding law |
| Illinois IDHR | Illinois AI Video Interview Act (820 ILCS 42) — Artificial Intelligence Video Interview Act (820 ILCS 42) (Aug 9, 2019) In force | Binding law |
| Massachusetts AG | Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| NIST | NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force | Voluntary framework |
| EU AI Act | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| ECB | ECB Guide on outsourcing cloud services — ECB Guide on outsourcing cloud services to cloud service providers (Jul 16, 2025) In force ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force | Supervisory guidance |
| EBA | EBA/GL/2022/15 (remote customer onboarding) — EBA/GL/2022/15 Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (Nov 22, 2022) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force | Supervisory guidance |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| FINMA | FINMA Guidance 08/2024 — FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence (Dec 18, 2024) Final | Supervisory guidance |
| OSFI | OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS Circular MAS/TCRS/2024/05 — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) In force | Supervisory guidance |
| HKMA | HKMA GenAI consumer protection circular — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024) In force HKMA BDAI consumer protection principles — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019) In force HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| Japan FSA | Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | Supervisory guidance | |
| RBI | RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final | Voluntary framework |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed | Non-binding standards |
| Basel Committee | Non-binding standards | |
| IOSCO | IOSCO FR06/2021 — The use of artificial intelligence and machine learning by market intermediaries and asset managers: Final Report (Sep 7, 2021) In force | Non-binding standards |
Trading & capital markets
Which rules govern AI in trading, broker-dealer and derivatives businesses?
Market regulators focus on conflicts of interest, AI-washing, and the systemic risk of many firms using the same models.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | CFTC Compute Derivatives RFC — Request for Comment on the Listing of Compute Derivatives Contracts (Aug 19, 2026) Comment period open CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Scams Customer Advisory — Customer Advisory: AI Won't Turn Trading Bots into Money Machines (Jan 25, 2024) In force CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final | Voluntary framework |
| ECB | Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| ESMA | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services (May 30, 2024) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | Bailey: Frontier AI and the Question of Governance (Sep 2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026) Final BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final | Supervisory guidance |
| Hong Kong SFC | SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models (Nov 12, 2024) In force | Supervisory guidance |
| FSB | FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force IOSCO FR06/2021 — The use of artificial intelligence and machine learning by market intermediaries and asset managers: Final Report (Sep 7, 2021) In force | Non-binding standards |
AI governance (general)
Which frameworks set overall AI governance expectations for banks?
Cross-cutting principles, sound practices and voluntary frameworks that supervisors reference when they examine a bank's overall AI program.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final | Supervisory guidance |
| CFPB | CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final | Binding law |
| SEC | Atkins remarks at Investor Advisory Committee (Sep 2026) — Remarks at the SEC Investor Advisory Committee Meeting on AI Technologies and the Public Markets Information Ecosystem (Sep 10, 2026) Final Atkins remarks at FSOC AI roundtable (Mar 2026) — Remarks at Financial Stability Oversight Council Artificial Intelligence Innovation Series Roundtable on Strategy and Governance Principles (Mar 4, 2026) Final Investor Advisory Committee AI disclosure recommendation — Recommendation of the SEC Investor Advisory Committee Regarding the Disclosure of Artificial Intelligence's Impact on Operations (Dec 4, 2025) Final Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force SEC withdrawal of proposed rules (33-11377) — Withdrawal of Proposed Regulatory Actions — including the predictive data analytics conflicts proposal (Jun 12, 2025) Final SEC v. Saniger (Nate, Inc.) — SEC Charges Founder of Nate, Inc. with Fraud Over False Claims About the Company's Use of Artificial Intelligence (Apr 9, 2025) Final Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded Delphia / Global Predictions AI-washing settlements — SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (Mar 18, 2024) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| White House | EO 14179 — Removing Barriers to American Leadership in Artificial Intelligence (Jan 23, 2025) In force | Non-binding standards |
| FINRA | 2026 FINRA Annual Regulatory Oversight Report — 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends (Dec 9, 2025) In force FINRA Regulatory Notice 24-09 — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024) In force | Supervisory guidance |
| NY DFS | DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force New York RAISE Act — Responsible AI Safety and Education (RAISE) Act, General Business Law Article 44-B (Chapter 699 of the Laws of 2025, as amended by Chapter 96 of the Laws of 2026) (Dec 19, 2025) Final Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| NYC DCWP | NYC Local Law 144 (AEDT) — A Local Law to amend the administrative code of the city of New York, in relation to automated employment decision tools (Local Law 144 of 2021) and DCWP final rule (Dec 11, 2021) In force | Binding law |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025) Superseded SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded Colorado SB 21-169 and Regulation 10-1-1 — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021) In force | Binding law |
| California CPPA | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025) In force CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025) In force Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) (Jun 27, 2025) In force California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025) Final Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) (Jun 28, 2018) In force | Binding law |
| Texas AG | Texas TRAIGA (HB 149) — Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature) (Jun 22, 2025) In force | Binding law |
| Utah Division of Consumer Protection | Utah SB 226 (2025) — S.B. 226 Artificial Intelligence Consumer Protection Amendments (Mar 27, 2025) In force Utah AI Policy Act (SB 149) — S.B. 149 Artificial Intelligence Amendments (creating the Utah Artificial Intelligence Policy Act) (Mar 13, 2024) In force | Binding law |
| Illinois IDHR | Illinois HB 3773 (P.A. 103-0804) — Illinois Human Rights Act amendments on artificial intelligence in employment (H.B. 3773, Public Act 103-0804) (Aug 9, 2024) In force Illinois AI Video Interview Act (820 ILCS 42) — Artificial Intelligence Video Interview Act (820 ILCS 42) (Aug 9, 2019) In force | Binding law |
| Massachusetts AG | Massachusetts AG Earnest Operations settlement (July 2025) — Assurance of Discontinuance: In the matter of Earnest Operations LLC (Massachusetts Attorney General, announced July 10, 2025) (Jul 10, 2025) In force Massachusetts AG AI Advisory (April 2024) — Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence (Apr 16, 2024) In force | Binding law |
| New Jersey DCR | NJ DCR Algorithmic Discrimination Guidance (January 2025) — Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination (Jan 9, 2025) In force | Binding law |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Commission guidelines on AI Act Article 50 transparency — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission GPAI model guidelines — Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act) (Jul 18, 2025) In force Commission guidelines on the AI system definition — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025) In force Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) (Dec 27, 2022) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado (Oct 14, 2025) Final ECB Guide on outsourcing cloud services — ECB Guide on outsourcing cloud services to cloud service providers (Jul 16, 2025) In force Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025) (May 14, 2025) Final ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| ESMA | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services (May 30, 2024) Final | Supervisory guidance |
| EIOPA | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management (Aug 6, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | Bailey: Frontier AI and the Question of Governance (Sep 2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026) Final FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) — Frontier AI and Cyber Resilience (Sep 2, 2026) In force HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final DSIT/DBT strategic letters to regulators (Jan 2026) — How will regulators enable safe AI-powered innovation: joint letter from DSIT Secretary of State and DBT Secretary of State (Jan 28, 2026) Final Data (Use and Access) Act 2025 — Data (Use and Access) Act 2025 (2025 c. 18) — automated decision-making reform, section 80 and new UK GDPR Articles 22A to 22D (Jun 19, 2025) In force FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final UK AI white paper government response (CP 1019) — A pro-innovation approach to AI regulation: government response to consultation (CP 1019) (Feb 6, 2024) In force PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force ICO Guidance on AI and data protection — Guidance on AI and data protection (ICO) (Mar 15, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded FCA PS22/9 Consumer Duty — PS22/9: A new Consumer Duty — Feedback to CP21/36 and final rules (with FG22/5 guidance) (Jul 27, 2022) In force | Supervisory guidance |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Feb 18, 2022) Final BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Jun 15, 2021) Final | Supervisory guidance |
| ACPR | ACPR discussion document on AI governance — Governance of Artificial Intelligence in Finance (Jun 11, 2020) Final | Supervisory guidance |
| DNB / AFM | AFM and DNB report on the impact of AI — The impact of AI on the financial sector and supervision (Apr 9, 2024) Final DNB SAFEST AI principles — General principles for the use of Artificial Intelligence in the financial sector (Jul 25, 2019) Final | Supervisory guidance |
| FINMA | FINMA Guidance 08/2024 — FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence (Dec 18, 2024) Final | Supervisory guidance |
| OSFI | OSFI FIFAI II report (AGILE framework) — FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (Mar 23, 2026) Final OSFI-FCAC AI Risk Report (2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024) Final | Supervisory guidance |
| MAS | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026) Final MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) Proposed MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) Final MAS FEAT Principles — Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector (Nov 12, 2018) In force | Supervisory guidance |
| HKMA | HKMA GenA.I. Sandbox++ joint circular — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026) In force HKMA GenA.I. Sandbox circular — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024) In force HKMA circular on AI for monitoring of suspicious activities — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024) In force HKMA GenAI consumer protection circular — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024) In force HKMA BDAI consumer protection principles — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019) In force HKMA High-level Principles on Artificial Intelligence — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019) In force | Supervisory guidance |
| Hong Kong SFC | SFC Circular 26EC32 (AI-enabled cyberattacks) — Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (Jun 2, 2026) In force | Supervisory guidance |
| Japan FSA | Japan FSA/BOJ frontier AI request — Request regarding 'Short-term Responses by Financial Institutions in Light of Threat Changes from Frontier AI' (「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について) (May 22, 2026) In force Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026) Final Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 4, 2025) Superseded | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final ASIC REP 798 — REP 798 Beware the gap: Governance arrangements in the face of AI innovation (Oct 29, 2024) Final | Supervisory guidance |
| RBI | RBI draft Guidance on Regulatory Principles for Model Risk Management — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026) Proposed RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report (Aug 13, 2025) Final RBI draft circular on Regulatory Principles for Management of Model Risks in Credit — Regulatory Principles for Management of Model Risks in Credit (draft circular for comments) (Aug 5, 2024) Proposed | Voluntary framework |
| FSB | FSB Chair's letter to G20 (Aug 2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026) Final Responses to FSB AI sound practices consultation (Aug 2026) — Public responses to consultation on Sound Practices for Responsible Adoption of Artificial Intelligence (AI) (Aug 6, 2026) Final Bowman remarks at FSB AI outreach (July 2026) — Opening remarks on sound practices for artificial intelligence (FSB virtual outreach event) (Jul 7, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB next steps on AI monitoring (Oct 2025) — FSB outlines next steps for authorities on AI monitoring (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Jan 6, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
| IOSCO | IOSCO FR/02/2026 — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026) In force IOSCO FR06/2021 — The use of artificial intelligence and machine learning by market intermediaries and asset managers: Final Report (Sep 7, 2021) In force | Non-binding standards |
AI-generated code & coding agents
Which rules apply to AI-generated code and coding agents in a bank?
No regulator has a rule for AI-written software, but New York DFS asks for human review of AI-generated code before deployment, NIST profiles the secure development life cycle for AI, and model-risk and third-party guidance decide what an examiner treats as a model or a vendor.
| Authority | Governing documents | Force |
|---|---|---|
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force | Supervisory guidance |
| NIST | CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST SP 800-218A (SSDF profile for generative AI) — Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A) (Jul 26, 2024) In force | Voluntary framework |
| BaFin | BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025) Final | Supervisory guidance |
| APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA Letter to Industry on Artificial Intelligence (AI) (Apr 30, 2026) Final | Supervisory guidance |
Navigate
Regulators move daily. So do we.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning