AI for bank executives:
the 2026 briefing.

What changed in 2026 that a bank board must know?

Six moves, in date order. Each one is a standing page on this tracker with the primary source linked.

What do bank regulators expect of the board and senior management on AI?

No banking regulator has written an AI-specific board rule, but at least eight of them have already told boards what they expect, using law and guidance that is in force today. The pattern is consistent across jurisdictions: the board owns the AI strategy and risk appetite, a named senior executive is accountable for model and AI risk, the use of vendors does not transfer that accountability, the data feeding AI is a board-level responsibility, and — since 2026 — AI-enabled cyber threats belong on the board agenda with a dated action plan. Supervisors test these expectations through existing examinations rather than new AI exams.

The US federal position is deliberately not AI-specific: Vice Chair Bowman said in May 2026 that existing frameworks, regularly reviewed, should accommodate AI's evolution, and the OCC's Spring 2026 Risk Perspective observed that banks are taking a 'measured approach' to generative and agentic AI with guardrails and human-in-the-loop accountability. What that means for a board is that AI is examined through the model-risk, third-party, BSA/AML, fair-lending and cyber lenses that already exist — and that an AI program which cannot be described in those terms will not survive an examination.

Europe and the UK are more explicit about accountability. The PRA names a Senior Management Function holder; the ECB's Supervisory Board says accountability for outcomes sits with the bank regardless of how the technology performs; New York makes the CEO and CISO sign. The FSB's 12 practices, once final, will give every supervisor a common checklist — and its first two items are written for the board.

WHAT THIS MEANS IN PRACTICE

• Minute an AI risk appetite: which decisions AI may make or materially influence, at what autonomy level, and which it may not.
• Name the accountable executive for AI and model risk, and confirm internal audit has AI in its plan — supervisors ask for both by name.
• Ask for the inventory: every AI system that touches a customer decision, its owner, its vendor, and whether it sits inside or outside model risk management.
• Put AI-enabled cyber on the board calendar with a dated plan — the ECB, NY DFS and the UK authorities have each asked for one in 2026.
• Make AI literacy a board item, not only a staff item: the EU AI Act's Article 4 duty and NY DFS's training expectations both reach the top.

Which ten questions should a bank board ask about AI?

Each question comes with what a good answer contains and the documents it should reference. A management team that can answer all ten in writing has, in effect, the AI governance program supervisors describe.

Which AI rules apply to my bank?

It depends on charter, size and where your customers are. The strictest rules follow the use case, not the technology; the use-case matrix maps every system type to its governing documents. This is the executive summary by footprint.

Should a bank deploy AI agents in 2026, and what will supervisors expect if it does?

Supervisors are not stopping banks from deploying agents; they are telling banks that agents fall outside the model-risk rulebook and inside everything else. The revised US model risk guidance excludes agentic AI by name and points to the bank's broader governance; the OCC reports that banks are keeping agents to specific use cases with guardrails and human-in-the-loop accountability; the FSB's proposed practices ask for extra human oversight of highly autonomous agents and name agentic memory poisoning and AI-generated code defects as risks. The executive decision is therefore not 'agents or no agents' but which autonomy level each use case is allowed, who approves the step up, and whether the bank has one set of controls every agent inherits rather than controls rebuilt per project.

The practical shape of that answer is an operating model rather than a policy: an identity and entitlement per agent, an action gateway that limits what agents may do, entitlement-aware data access with lineage, a budgeted and sandboxed runtime, observability, and human escalation. The agents section of this site lays out that control plane layer by layer, with every regulator's documented position on agents and a lifecycle from use-case approval to retirement.

WHAT THIS MEANS IN PRACTICE

• Adopt an autonomy ladder and require a named approver for every step up — it is the single control every supervisor's language maps to.
• Insist on a kill switch that revokes an agent's entitlements in one step, and test it.
• Ask whether new agents inherit the bank's controls by default or re-implement them; the answer tells you whether you have a platform or a pile of pilots.

How can a bank executive get up to speed on AI regulation in 30 days?

Twelve primary documents in four weeks, three a week, in an order that builds: the frame, then the law, then the threat, then the dependencies. Each document has a standing page here with the direct answer first and the official source linked, and each week ends with one question to put to the executive team.

12 documents · all 164 in the library →

Which AI regulatory dates should be on the board calendar?

Recomputed daily from the tracker. The full calendar → · The checklist, quarter by quarter →