How does First Citizens govern AI and manage its risks?
First Citizens says it set up a framework for responsible AI adoption and governance before scaling use cases, and in September 2026 described its operating principles as internal-facing use cases, keeping humans in the loop, and masking and filtering sensitive data. A cross-functional leadership group spanning business units, technology, cyber security, data, privacy, resilience, legal, compliance and risk reviews AI implementations, and the July 2026 Frontier AI Fact Sheet adds that enterprise AI platforms are configured so client data is not used for public LLM training. At board level, a Technology Committee created in April 2025 and chaired by Dr. Eugene Flood, Jr. oversees technology strategy, emerging technology, data and cybersecurity; it met twice in 2025. The bank's filings show the topic growing: the 2023 10-K mentioned AI as regulation and as a cyber-risk driver, the 2024 10-K gave it its own regulatory section, and the 2025 10-K (February 2026) added a risk factor on third-party models, incorrect or biased generative-AI outputs and explainability. No published AI principles document, model inventory or fairness testing has been disclosed.[1][2][3][4][5][6]
Data as of Oct 16, 2026 · First Citizens profile updated Oct 13, 2026 · 13 sources cited on this page · 140 banks profiled on this site · Markdown
Who oversees AI at First Citizens?
Management and board bodies as the bank describes them. The proxy does not mention AI by name; the Technology Committee's remit covers emerging technology and data.
| Body or control | What it does | Who | Since |
|---|---|---|---|
| Responsible-AI framework | Framework for responsible AI adoption and governance, set up before the bank looked for AI use cases | Data and analytics organisation | Before September 2026[1] |
| Cross-functional AI leadership group | Business units, technology, cyber security, data, privacy, resilience, legal, compliance and risk review AI implementations to protect clients and assets | Management | Described September 2026[1] |
| Operating principles | Internal-facing use cases; humans in the loop; masking and filtering sensitive data to prevent data loss | Management | Described September 2026[1] |
| Closed-loop enterprise AI | Enterprise AI platforms configured to support closed-loop protections and prevent client data being used for public LLM training | Management | July 2026[2] |
| Board Technology Committee | Oversees technology operations, strategy, investments, innovation, 'emerging technology trends', information security, cybersecurity, data and data privacy, and technology risk management; 75% independent; 2 meetings in 2025 | Chair Dr. Eugene Flood, Jr.; Ellen R. Alemany, Robert E. Mason IV, Diane E. Morais (from July 1, 2025) | April 2025[3] |
| Technology & Security Risk Committee | Subcommittee of the Enterprise Risk Oversight Committee (EROC, composed of management); reports to the board Technology Committee | Management | In place 2026[3] |
| Board Risk Committee | Receives management reports on operational risk, including losses or reputational harm from 'inadequate or failed systems or technology' | Board | In place 2026[3] |
What do First Citizens' SEC filings say about AI risk?
How the AI language in the annual report grew, and where it appears in 2026 quarterly filings.
| Filing | What it says about AI | Filed |
|---|---|---|
| 2023 Form 10-K | Notes the October 2023 executive order on AI requiring agencies including the CFPB to address discrimination; cites generative AI among technologies raising cyber risk for large banks | February 23, 2024[4] |
| 2024 Form 10-K | New 'Artificial Intelligence' regulatory section: interagency AVM quality-control rule (June 24, 2024), Treasury's AI cyber report (March 27, 2024), DOJ guidance expecting AI risk assessments (September 23, 2024), revocation of EO 14110 (January 20, 2025), California and NYDFS initiatives | February 21, 2025[5] |
| 2025 Form 10-K | Adds 'The use of AI presents its own unique risks': third-party model development, an uncertain legal environment, generative AI that may 'produce incorrect outputs, release confidential information, reflect biases, infringe intellectual property', and difficulty meeting documentation or explanation requirements; also EO 14365 (December 11, 2025) on state AI laws | February 24, 2026[6] |
| 2024 and 2025 Forms 10-K | Fraud threats include 'use of AI to facilitate the perpetration of social engineering and impersonation schemes and identity theft' | 2025; 2026[5][6] |
| Q1 and Q2 2026 Forms 10-Q | 'The impact of artificial intelligence on various industries' among emerging risks monitored in credit-loss scenarios; June 30 allowance $1.48 billion in a $1.21-2.06 billion range | May 8 and August 7, 2026[7][8] |
| Q2 2026 earnings release | 'The effect of technological change, including artificial intelligence and digital assets' among forward-looking risk factors | July 23, 2026[9] |
What does First Citizens tell clients about AI risk?
The Frontier AI Fact Sheet's advice to commercial clients includes enabling multifactor authentication, 'Constrain and audit AI agent access' and enforcing zero-trust controls; the bank says it aligns its layered defense with FFIEC guidance and NIST 800-53 and the NIST Cybersecurity Framework.[2]
Its fund-banking guidance for private-fund CFOs (October 2026) says AI tools make sophisticated attacks easier, from deepfakes of executives' voices to generated malware, but that AI-driven monitoring is 'not foolproof' and internal controls remain critical.[10]
Consumer guidance (May 2026) warns that AI and caller-ID spoofing make phone scams harder to recognise and that fraudsters may use AI to impersonate a family member in distress; a June 2025 webinar with McKinsey said AI is being integrated into fraudsters' playbooks.[11][12]
What does the First Citizens profile record on this topic?
The rows below are the entries of the First Citizens AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 27 dated moves, 14 use cases and 31 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Responsible-AI framework | A framework for responsible AI adoption and governance, established before the bank set out to scale AI use cases; benefits are tracked for every AI use case. | In production | [1] |
| AI risk-factor and regulatory disclosure | 10-K covers third-party model development risk, generative-AI errors, bias and data leakage, explainability and documentation, and evolving federal and state AI law. | In production | [6] |
| AI-disruption lens on software and credit-loss scenarios | Management quantified $8.1 billion of on-balance-sheet software exposure in April 2026 and the 10-Qs track AI's impact on industries in credit-loss scenarios. | In production | [13][7][8] |
| Layered defence aligned to FFIEC and NIST | The fact sheet describes detect, respond and prevent layers with 24/7 monitoring and zero-trust controls, and advises commercial clients to constrain and audit AI agent access and to limit third-party data sharing. | In production | [2] |
| Cross-functional AI leadership group | A group spanning business units, technology, cyber security, data, privacy, resilience, legal, compliance and risk reviews AI implementations; benefits are tracked in revenue, cost, speed and risk categories. | In production | [1] |
| Closed-loop enterprise AI and data masking | Enterprise AI platforms are configured so client data is not used for public LLM training; the bank keeps use cases internal-facing, keeps humans in the loop and masks and filters sensitive data. | In production | [2][1] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Aug 7, 2026 | Q2 2026 10-Q: AI's impact on industries tracked in credit-loss scenarios | AI listed among emerging risks monitored alongside geopolitics and energy prices; allowance set at $1.48 billion within a $1.21–2.06 billion scenario range. | [8] |
| May 8, 2026 | Q1 2026 10-Q: AI's impact on industries monitored for credit losses | AI listed among emerging risks assessed on an ongoing basis; allowance estimates ranged from $1.32 billion to $1.98 billion across scenarios at March 31, 2026. | [7] |
| Feb 24, 2026 | 2025 10-K: AI regulation section and AI risk factor | Third-party model risk, incorrect or biased generative-AI output, explainability and a fast-changing legal environment; AI-enabled impersonation named among fraud threats. | [6] |
Does First Citizens have published AI principles?
Not as a standalone document. The closest are the July 2026 Frontier AI Fact Sheet (conservative build, human in the loop, closed-loop enterprise AI platforms that keep client data out of public LLM training) and the September 2026 Q&A, which lists internal-facing use cases, humans in the loop and masking sensitive data as core principles and says a responsible-AI framework came first.
Which board committee oversees AI at First Citizens?
The Technology Committee, a joint committee of the holding company and bank boards established in April 2025 and chaired by Dr. Eugene Flood, Jr. Its remit covers technology strategy and investments, emerging technology trends, data, cybersecurity and technology risk. It met twice in 2025 and is 75% independent, per the 2026 proxy. The proxy does not mention AI by name.
What AI risks does First Citizens disclose in its 10-K?
The 2025 10-K, filed February 24, 2026, says AI 'presents its own unique risks': limited visibility into how third-party models are trained, an uncertain and fast-changing legal environment, and generative AI that may produce incorrect outputs, leak confidential information, reflect biases or infringe IP, plus difficulty explaining outputs. It also lists AI-enabled impersonation among fraud threats.
Does First Citizens use client data to train AI models?
The bank says its enterprise AI platforms are configured to support closed-loop protections and prevent client data from being used for public Large Language Model training, per its July 2026 fact sheet. It also masks and filters sensitive data and keeps use cases internal-facing. It has not said whether client data trains any internal models.
How has First Citizens' AI disclosure changed over time?
It has grown each year. The 2023 10-K mentioned AI only through a federal executive order and as a cyber-risk factor. The 2024 10-K, filed February 2025, added a dedicated AI regulatory section. The 2025 10-K, filed February 2026, added a specific AI risk factor, and both 2026 10-Qs list AI's impact on industries as a credit-loss consideration.
- A Q&A With Scott Richardson: AI at First Citizens Bank
- Frontier AI Fact Sheet
- First Citizens BancShares 2026 Annual Proxy Statement (DEF 14A)
- First Citizens BancShares Annual Report on Form 10-K for 2023
- First Citizens BancShares Annual Report on Form 10-K for 2024
- First Citizens BancShares Annual Report on Form 10-K for 2025
- First Citizens BancShares Quarterly Report on Form 10-Q for the period ended March 31, 2026
- First Citizens BancShares Quarterly Report on Form 10-Q for the period ended June 30, 2026
- First Citizens BancShares Form 8-K, second quarter 2026 earnings release (Exhibit 99.1)
- 5 Cyber Risk Questions Private Funds CFOs Should Ask in 2026
- Top 10 financial scams targeting consumers
- Fraud counterattack: Protecting your business from threats
- First Citizens BancShares Inc (FCNCA) Q1 2026 Earnings Call Highlights
When First Citizens moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning