Bank AI is regulated by use case, not by technology. Credit scoring is the most constrained (binding EU AI Act obligations plus US adverse-action and fair-lending law); AML and fraud are the most encouraged; generative and agentic AI are the least settled. Each section below is a question-and-answer: which authorities have spoken on that use case, and which document is the one to read.
Jump to
Credit scoring & underwriting
Which rules govern AI credit scoring and underwriting?
Creditworthiness models are the most heavily regulated bank AI use case: explicitly high-risk under the EU AI Act, and subject to adverse-action, fair-lending and model-risk requirements in the US.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Financial Innovation Rule (2023) — Financial Innovation: Loan Participations, Eligible Obligations, and Notes of Liquidating Credit Unions (final rule) (Sep 21, 2023) In force 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn CFPB Innovation Spotlight on AI/ML adverse action notices (2020) — Innovation spotlight: Providing adverse action notices when using AI/ML models (Jul 7, 2020) Final ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| NY DFS | Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025) Superseded SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded | Binding law |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| ECB | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models (Jul 28, 2025) In force | Supervisory guidance |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models (Aug 4, 2023) Final EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models (Nov 11, 2021) Superseded EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force | Supervisory guidance |
| FSB | FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | Non-binding standards |
Fair lending & discrimination
Which rules apply to AI bias and fair lending?
Anti-discrimination law applies regardless of how a decision was made. Regulators have said 'the algorithm did it' is not a defence.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| NCUA | NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn CFPB Innovation Spotlight on AI/ML adverse action notices (2020) — Innovation spotlight: Providing adverse action notices when using AI/ML models (Jul 7, 2020) Final ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force | Binding law |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| NY DFS | Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded | Binding law |
| EU AI Act | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final | Supervisory guidance |
AML / KYC
Which rules govern AI in AML, sanctions screening and KYC?
Regulators actively encourage machine learning in transaction monitoring, but expect the same explainability and validation as any other BSA/AML control.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| OCC | OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final | Supervisory guidance |
| FinCEN | FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | Treasury $4B AI fraud-prevention announcement (Oct 2024) — Treasury Announces Enhanced Fraud Detection Processes, Including Machine Learning AI, Prevented and Recovered Over $4 Billion in Fiscal Year 2024 (Oct 17, 2024) Final | Voluntary framework |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final | Supervisory guidance |
| Basel Committee | Non-binding standards |
Fraud detection
Which rules govern AI-based fraud detection — and AI-enabled fraud?
Two sides: banks deploying AI to catch fraud, and regulators warning about deepfakes and generative-AI-enabled scams targeting banks and their customers.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC AI Scams Customer Advisory — Customer Advisory: AI Won't Turn Trading Bots into Money Machines (Jan 25, 2024) In force | Supervisory guidance |
| FinCEN | FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury $4B AI fraud-prevention announcement (Oct 2024) — Treasury Announces Enhanced Fraud Detection Processes, Including Machine Learning AI, Prevented and Recovered Over $4 Billion in Fiscal Year 2024 (Oct 17, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final | Voluntary framework |
| NY DFS | DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force | Supervisory guidance |
| NIST | NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final | Voluntary framework |
| EU AI Act | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force | Supervisory guidance |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final | Supervisory guidance |
| FSB | FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | Non-binding standards |
Customer-facing chatbots
Which rules apply to AI chatbots and virtual assistants in banking?
Consumer-protection law follows the customer interaction: a chatbot that gives wrong information or obstructs a dispute can be a UDAAP or compliance violation.
| Authority | Governing documents | Force |
|---|---|---|
| OCC | 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| FDIC | FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| CFPB | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance (Jun 6, 2023) Final | Binding law |
| SEC | SEC withdrawal of proposed rules (33-11377) — Withdrawal of Proposed Regulatory Actions — including the predictive data analytics conflicts proposal (Jun 12, 2025) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final | Voluntary framework |
| NY DFS | Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final | Binding law |
| NIST | NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| EBA | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final | Supervisory guidance |
| Basel Committee | Non-binding standards |
Model risk management
Which model risk management rules apply to AI and machine-learning models?
The validation, governance and 'effective challenge' framework that bank examiners test AI models against.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions (Apr 22, 2026) In force CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms (May 26, 2022) Withdrawn ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons (Oct 28, 1974) In force | Binding law |
| SEC | Delphia / Global Predictions AI-washing settlements — SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (Mar 18, 2024) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| NY DFS | Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force | Supervisory guidance |
| Colorado AI Act | SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded | Binding law |
| NIST | NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models (Jul 28, 2025) In force ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force | Supervisory guidance |
| EBA | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models (Aug 4, 2023) Final EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models (Nov 11, 2021) Superseded EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded | Supervisory guidance |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Jan 6, 2026) Final BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final | Non-binding standards |
Generative & agentic AI
Which rules cover generative AI and AI agents in banking?
The newest and least-settled area: several 2026 frameworks explicitly carve generative and agentic AI out of formal model-risk rules while signalling that dedicated guidance is coming.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force FDIC House testimony on AI and innovation (Mar 2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026) Final FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final | Supervisory guidance |
| CFPB | CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance (Jun 6, 2023) Final | Binding law |
| SEC | Atkins remarks at FSOC AI roundtable (Mar 2026) — Remarks at Financial Stability Oversight Council Artificial Intelligence Innovation Series Roundtable on Strategy and Governance Principles (Mar 4, 2026) Final Investor Advisory Committee AI disclosure recommendation — Recommendation of the SEC Investor Advisory Committee Regarding the Disclosure of Artificial Intelligence's Impact on Operations (Dec 4, 2025) Final Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final | Supervisory guidance |
| CFTC | CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force | Supervisory guidance |
| FinCEN | FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026) In force 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force | Supervisory guidance |
| Colorado AI Act | HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final | Binding law |
| NIST | CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado (Oct 14, 2025) Final Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025) (May 14, 2025) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force | Supervisory guidance |
| FSB | Bowman remarks at FSB AI outreach (July 2026) — Opening remarks on sound practices for artificial intelligence (FSB virtual outreach event) (Jul 7, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force | Non-binding standards |
Third-party & vendor AI
Which rules apply when a bank buys AI from a vendor?
Outsourcing does not outsource accountability: third-party risk management guidance treats AI vendors, foundation-model providers and cloud AI services as critical relationships.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | FDIC FIL-15-2026 — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026) In force Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-27-2021 — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021) Superseded | Supervisory guidance |
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final NCUA Financial Innovation Rule (2023) — Financial Innovation: Loan Participations, Eligible Obligations, and Notes of Liquidating Credit Unions (final rule) (Sep 21, 2023) In force NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| CFPB | FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | SEC v. Saniger (Nate, Inc.) — SEC Charges Founder of Nate, Inc. with Fraud Over False Claims About the Company's Use of Artificial Intelligence (Apr 9, 2025) Final Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force | Supervisory guidance |
| FinCEN | 2021 BSA/AML Model Risk Management Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Apr 9, 2021) Withdrawn | Binding law |
| U.S. Treasury | Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final | Voluntary framework |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final | Binding law |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final PRA AI/ML model-risk roundtable (Nov 2025) — The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies (Nov 24, 2025) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded | Supervisory guidance |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB next steps on AI monitoring (Oct 2025) — FSB outlines next steps for authorities on AI monitoring (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
Cybersecurity
Which rules address AI-related cybersecurity risk for banks?
AI as an attack vector (deepfakes, AI-enhanced phishing) and AI as a target (model theft, data poisoning) both fall under existing cyber rules.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force | Supervisory guidance |
| FDIC | FDIC 2025 Report on Cybersecurity and Resilience — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025) Final FDIC 2024 Risk Review — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024) Final | Supervisory guidance |
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force | Supervisory guidance |
| CFTC | CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (Nov 13, 2024) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models (May 21, 2026) In force DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI 100-2e2025 (Adversarial ML) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025) Final NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force | Voluntary framework |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final | Supervisory guidance |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
Data & privacy
Which data-protection rules constrain bank AI?
Automated-decision rights, data-governance duties and training-data provenance requirements that sit underneath every AI deployment.
| Authority | Governing documents | Force |
|---|---|---|
| NCUA | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force | Supervisory guidance |
| CFPB | CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B (Sep 19, 2023) Withdrawn FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores (Oct 26, 1970) In force | Binding law |
| SEC | Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded | Supervisory guidance |
| CFTC | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final | Supervisory guidance |
| U.S. Treasury | Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final | Voluntary framework |
| NY DFS | DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks (Oct 16, 2024) In force 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| NIST | NIST AI 600-1 (Generative AI Profile) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024) In force | Voluntary framework |
| EU AI Act | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions (Oct 30, 2023) Final GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling (May 4, 2016) In force | Binding law |
| ECB | ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force | Supervisory guidance |
| UK (BoE / PRA / FCA) | Supervisory guidance | |
| FSB | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed | Non-binding standards |
| Basel Committee | Non-binding standards |
Trading & capital markets
Which rules govern AI in trading, broker-dealer and derivatives businesses?
Market regulators focus on conflicts of interest, AI-washing, and the systemic risk of many firms using the same models.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final | Supervisory guidance |
| SEC | Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | CFTC Compute Derivatives RFC — Request for Comment on the Listing of Compute Derivatives Contracts (Aug 19, 2026) Comment period open CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance (Jun 18, 2025) Final CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Scams Customer Advisory — Customer Advisory: AI Won't Turn Trading Bots into Money Machines (Jan 25, 2024) In force CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final | Voluntary framework |
| ECB | Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final | Supervisory guidance |
| FSB | FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
AI governance (general)
Which frameworks set overall AI governance expectations for banks?
Cross-cutting principles, sound practices and voluntary frameworks that supervisors reference when they examine a bank's overall AI program.
| Authority | Governing documents | Force |
|---|---|---|
| Federal Reserve | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026) Final Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026) Final 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021) Superseded 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final | Supervisory guidance |
| OCC | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026) Final Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025) Final OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023) In force OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021) Superseded 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Final OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011) Superseded | Supervisory guidance |
| FDIC | Hill House oversight testimony (Jun 2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026) Final Hill 'Charting a New Course' speech — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025) Final FDIC FIL-29-2023 — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023) In force FDIC FIL-20-2021 — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021) Final | Supervisory guidance |
| NCUA | Hauptman Senate testimony (Feb 2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) Final NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) In force NCUA Board AI briefing (Jul 2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) Final NCUA testimony to House AI Task Force (2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) Final | Supervisory guidance |
| CFPB | CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (May 12, 2025) In force CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Aug 12, 2024) Final Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr 25, 2023) Final | Binding law |
| SEC | Atkins remarks at FSOC AI roundtable (Mar 2026) — Remarks at Financial Stability Oversight Council Artificial Intelligence Innovation Series Roundtable on Strategy and Governance Principles (Mar 4, 2026) Final Investor Advisory Committee AI disclosure recommendation — Recommendation of the SEC Investor Advisory Committee Regarding the Disclosure of Artificial Intelligence's Impact on Operations (Dec 4, 2025) Final Division of Examinations FY2026 Priorities — Examination Priorities: Fiscal Year 2026 — Division of Examinations (Nov 17, 2025) In force SEC withdrawal of proposed rules (33-11377) — Withdrawal of Proposed Regulatory Actions — including the predictive data analytics conflicts proposal (Jun 12, 2025) Final SEC v. Saniger (Nate, Inc.) — SEC Charges Founder of Nate, Inc. with Fraud Over False Claims About the Company's Use of Artificial Intelligence (Apr 9, 2025) Final Presto Automation AI-washing order — SEC Charges Restaurant-Technology Company Presto Automation for Misleading Statements About AI Product (Jan 14, 2025) Final Division of Examinations FY2025 Priorities — Examination Priorities: Fiscal Year 2025 — Division of Examinations (Oct 21, 2024) Superseded Delphia / Global Predictions AI-washing settlements — SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (Mar 18, 2024) Final Gensler 'AI washing' remarks at Yale (Feb 2024) — AI, Finance, Movies, and the Law — Prepared Remarks Before the Yale Law School (Feb 13, 2024) Final SEC Predictive Data Analytics proposal (34-97990) — Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers — proposed rule (Jul 26, 2023) Withdrawn | Supervisory guidance |
| CFTC | CFTC Innovation Task Force — Chairman Selig Announces Formation of New Innovation Task Force (Mar 24, 2026) In force CFTC Staff Advisory 24-17 on AI — Staff Advisory on the Use of Artificial Intelligence in CFTC-Regulated Markets (CFTC Letter No. 24-17) (Dec 5, 2024) In force Johnson Statement on AI in Derivatives Markets (Dec 2024) — Statement of Commissioner Kristin N. Johnson on Future-Proofing Financial Markets: Assessing the Integration of Artificial Intelligence in Global Derivatives Markets (Dec 5, 2024) Final CFTC TAC Responsible AI Report — Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks & Recommendations (May 2, 2024) Final CFTC AI Request for Comment (2024) — Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets (Jan 25, 2024) Final | Supervisory guidance |
| FinCEN | 2026 AML/CFT Program Proposed Rule — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2026) (Apr 10, 2026) Proposed 2024 AML/CFT Program Proposed Rule (withdrawn) — Anti-Money Laundering and Countering the Financing of Terrorism Programs (Notice of Proposed Rulemaking, 2024) (Jul 3, 2024) Withdrawn Anti-Money Laundering Act of 2020 — Anti-Money Laundering Act of 2020 (Division F of the National Defense Authorization Act for Fiscal Year 2021) (Jan 1, 2021) In force FinCEN Innovation Hours — FinCEN's Innovation Initiative: Implementation of FinCEN Innovation Hours; Invitation to Request Innovation Hours Meeting (May 1, 2019) In force 2018 Joint Statement on BSA/AML Innovation — Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (Dec 3, 2018) In force | Binding law |
| U.S. Treasury | FSOC AI Innovation Series (Mar–May 2026) — Artificial Intelligence Innovation Series — FSOC and Treasury AI Transformation Office roundtables (Jun 24, 2026) Final Treasury FS AI RMF and AI Lexicon (Feb 2026) — Financial Services AI Risk Management Framework (FS AI RMF) and Artificial Intelligence Lexicon (Feb 19, 2026) Final FSOC 2025 Annual Report — Financial Stability Oversight Council 2025 Annual Report — Section 3.4, Harnessing Artificial Intelligence to Promote Financial Stability (Dec 11, 2025) Final Treasury AI in Financial Services report (Dec 2024) — Artificial Intelligence in Financial Services — Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector (Dec 19, 2024) Final FSOC 2024 Annual Report — Financial Stability Oversight Council 2024 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 6, 2024) Superseded Treasury AI RFI (June 2024) — Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (Jun 12, 2024) Final Treasury AI cybersecurity risks report (Mar 2024) — Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector (Mar 27, 2024) Final FSOC 2023 Annual Report — Financial Stability Oversight Council 2023 Annual Report — Section 3.3.3, The Use of Artificial Intelligence in Financial Services (Dec 14, 2023) Superseded | Voluntary framework |
| NY DFS | DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (May 21, 2026) In force Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing (Dec 16, 2025) Final Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jul 11, 2024) In force DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) (May 30, 2024) In force DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (Jan 17, 2024) Superseded 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (Second Amendment) (Nov 1, 2023) In force | Supervisory guidance |
| Colorado AI Act | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026) Comment period open HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026) Final SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026) Final SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025) Superseded SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024) Superseded | Binding law |
| NIST | AI RMF critical-infrastructure profile (concept note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026) Proposed CAISI RFI on AI agent security (2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026) Proposed NIST IR 8596 (Cyber AI Profile) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025) Proposed NIST COSAiS control overlays — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025) Proposed NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023) In force | Voluntary framework |
| EU AI Act | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026) In force Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026) Proposed EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025) Final Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025) In force Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024) In force | Binding law |
| ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026) In force Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026) Final Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026) Final Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025) Final SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025) In force Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado (Oct 14, 2025) Final Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025) (May 14, 2025) Final ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices (Jul 11, 2024) In force Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone (Jul 4, 2024) Final ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) (May 1, 2024) Final | Supervisory guidance |
| EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026) In force EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector (Nov 21, 2025) Final EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT (Nov 21, 2025) Final EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities (Oct 1, 2025) In force EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector (Sep 25, 2025) Final EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring (May 29, 2020) In force EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics (Jan 13, 2020) Final | Supervisory guidance |
| UK (BoE / PRA / FCA) | HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan (Jul 14, 2026) Final BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026) In force BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026) Final BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026) Final DSIT/DBT strategic letters to regulators (Jan 2026) — How will regulators enable safe AI-powered innovation: joint letter from DSIT Secretary of State and DBT Secretary of State (Jan 28, 2026) Final FPC Financial Stability in Focus: AI (Apr 2025) — Financial Stability in Focus: Artificial intelligence in the financial system (Apr 9, 2025) Final 2024 BoE/FCA AI survey — Artificial intelligence in UK financial services – 2024 (Nov 21, 2024) Final FCA AI Update (Apr 2024) — Artificial Intelligence (AI) update – further to the Government's response to the AI White Paper (Apr 22, 2024) Final PRA SS1/23 — Supervisory Statement 1/23: Model risk management principles for banks (May 17, 2023) In force 2022 BoE/FCA ML survey — Machine learning in UK financial services (2022 survey) (Oct 11, 2022) Superseded | Supervisory guidance |
| FSB | Responses to FSB AI sound practices consultation (Aug 2026) — Public responses to consultation on Sound Practices for Responsible Adoption of Artificial Intelligence (AI) (Aug 6, 2026) Final Bowman remarks at FSB AI outreach (July 2026) — Opening remarks on sound practices for artificial intelligence (FSB virtual outreach event) (Jul 7, 2026) Final FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026) Proposed FSB AI monitoring report (Oct 2025) — Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Oct 10, 2025) Final FSB next steps on AI monitoring (Oct 2025) — FSB outlines next steps for authorities on AI monitoring (Oct 10, 2025) Final FSB AI financial stability report (Nov 2024) — The Financial Stability Implications of Artificial Intelligence (Nov 14, 2024) Final FSB third-party risk toolkit (2023) — Final Report on Enhancing Third-party Risk Management and Oversight: A toolkit for financial institutions and financial authorities (Dec 4, 2023) Final FSB 2017 AI/ML report — Artificial intelligence and machine learning in financial services: Market developments and financial stability implications (Nov 1, 2017) Final | Non-binding standards |
| Basel Committee | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices (Jun 2, 2026) Final BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Jan 6, 2026) Final BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk (Dec 10, 2025) In force BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025) In force BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022) Final BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience (Mar 31, 2021) In force | Non-binding standards |
Navigate
Regulators move daily. So do we.
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →