US state supervisors write down what Washington leaves open on AI agents

On 16 September 2026, the Conference of State Bank Supervisors (CSBS), the association of US state banking regulators, published an examination framework for artificial intelligence at banks and non-bank financial firms. The CSBS Artificial Intelligence Supervisory Framework comes as five documents: a guide for examiners, a work programme setting out each examination step, supplements for non-banks, an optional worksheet for rating the risk of individual use cases and a list of sources. It opens with eight scoping questions, runs through 21 examination procedures and contains a dedicated procedure for AI agents.

The obvious reading is that this is a voluntary checklist with no consequences. The CSBS itself says the framework creates no new obligations, and a review of press coverage, law firm briefings and CSBS announcements found no state that had publicly adopted it by mid-October. What gives it weight is what is missing in Washington. In April the federal banking agencies expressly removed generative AI and agents from their newly revised model risk guidance, and a consultation on AI in model risk that they announced had not appeared by mid-October. The questions an examiner can ask about AI agents, and the documents an examiner can request, have therefore been written down by the states rather than by Washington. The framework closes a gap in the wording. The obligations were already there.

Washington has moved agents into a footnote

On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued a revised version of their joint guidance on model risk. In its own words, the Federal Reserve's letter SR 26-2 supersedes and replaces SR 11-7, the 2011 guidance that served as the benchmark for model validation in American banks for a decade and a half. The new text carries a footnote that matters more to the AI debate than most of the main text: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” According to the same footnote, the principles apply to traditional statistical models and to AI models that are neither generative nor agentic.

This does not leave a vacuum. The footnote points to a bank's general risk management and governance practices, which are meant to determine the appropriate controls for anything the guidance does not cover. Michelle W. Bowman, the Federal Reserve's Vice Chair for Supervision, made the intent plain in a speech delivered on 27 April and published on 1 May. Over time, she said, supervisors had stretched the earlier guidance beyond its original purpose, and other risk management and governance practices should now support the adoption of generative and agentic AI in a way that encourages innovation. However, none of the three agencies has since said in guidance which practices those are. In OCC Bulletin 2026-13, which accompanied the revision, the three agencies said they planned to issue a request for information (RFI) on model risk that would look specifically at generative AI and agents, and would do so “in the near future”. By mid-October it had not appeared in the Federal Register.

One element Michelle W. Bowman did name explicitly, revised guidance on third-party risk, now exists in draft. On 15 September 2026, one day before the CSBS framework, the OCC, the Federal Reserve, the FDIC and the National Credit Union Administration (NCUA), which supervises credit unions, published draft guidance on third-party risk in the Federal Register. The draft runs to roughly 9,000 words and, according to a full-text search carried out for this article, does not mention artificial intelligence, generative models or agents once. A bank that buys AI services from third parties will find rules for service providers in general, but not a single sentence on models a vendor has built into its product. The agencies are accepting comments until 16 November 2026.

The framework starts by asking whether there is any AI in the bank at all

The state framework begins one step earlier than any model validation. The first of the eight scoping questions in the examiner guide reads: “Does the institution use artificial intelligence in any products, services, operations, compliance activities, or internal support functions?” The others ask about an inventory, about customer-facing and decision-support use, about reliance on third parties, about AI embedded in purchased products, about generative AI, about whether use cases are differentiated by risk and, finally, about whether customer or confidential data passes through AI systems or third-party platforms. Only then come the 21 examination procedures proper: seven on governance, six on the inventory and eight on generative AI and emerging uses.

Notably, the framework distrusts a quick “no”. If the answer to the first question is negative or unclear, the guide says the examiner may check it against the vendor inventory, the software inventory, approved tools and recent product changes before concluding that the framework does not apply. The work programme gives the reason: AI is easily missed when it is embedded in software or treated as a feature rather than a system in its own right. Anyone who has maintained limit systems on a trading floor will recognise the pattern, because the risk nobody booked never shows up in a limit report. At this point in an examination, an inventory covering only in-house models soon turns into a list of what is missing.

One sentence covers agents, and it is precise

The section on generative AI contains eight procedures. The sixth examines how an institution deals with inaccuracy, hallucination, prompt injection, meaning the smuggling of outside instructions into a language model's input, and data exposure. The eighth, GE-8, is headed Agentic AI Controls in the work programme and consists of a single sentence in the guide. It names five things to examine in systems that act with limited human direction: the actions they are permitted to take, the human checkpoints, the logging, reversibility and the ability to restrict or halt the system.

For each of the five, a bank either has a document or it does not. Reversibility, for instance, answers the first question anyone asks after an error: can what the agent did be undone? In trading that means cancelling a faulty order. For an agent that changes master data or triggers payments, a bank first has to decide what undoing even means. The guide also lists the documents an examiner may request. The list runs from AI policies and committee minutes through the AI inventory and a list of purchased products with embedded AI to samples of what AI has produced for customers, explicitly including customer notices and chatbot transcripts. Examiners may also ask for contract clauses on whether a vendor may use, retain, share or train its systems on customer data. Going through this list before an examination shows which evidence a bank already holds and which it would still have to produce.

The rating follows the worst factor

The risk-rating worksheet is expressly optional, and its closing sentence says it should not be read as official regulatory guidance from a state agency. It is instructive all the same, because it settles a question every AI framework has to answer. Each use case is rated low, moderate or high on four factors: consumer impact, human oversight, harm potential and data sensitivity. There is no scoring system that offsets good marks against bad ones. Under the worksheet, the highest-rated factor should generally set the preliminary tier. A chatbot with limited consumer impact that processes sensitive data therefore lands provisionally in the top tier.

The worksheet describes the top tier as use cases with direct consumer outcomes, sensitive personal data, limited human review, significant operational reliance or material potential harm from errors or outages. A high rating for human oversight means, according to the worksheet, that actions are taken automatically on the basis of the AI output alone, or that a human reviews them only after they have already reached the customer. Departures from the preliminary tier are allowed but need a documented rationale, and any downgrade should be approved through the institution's governance. The controls build on each other: nine for the lowest tier, eight more for the middle tier and seven more for the top tier, among them independent model validation, a dedicated AI incident process and reporting to senior management and the board.

Voluntary does not mean without consequence

The strongest objection to the framework's significance comes from the framework itself. On the CSBS website it presents itself as a tool used at examiners' discretion, and it sends them back to existing resources on vendors, model risk, consumer protection and operational risk for any deeper review. At its core it therefore says the same as the federal footnote: institutions should rely on their existing governance. And no public adoption by a state agency can be found in press coverage, law firm briefings or CSBS announcements.

That is less reassuring for banks than it sounds. A discretionary tool needs no formal adoption for an examiner to use it. On its website the CSBS also addresses institutions directly, saying they can use the framework to prepare for examinations. American supervision is also dual. According to the CSBS, 79 per cent of US banks hold a state charter, and those banks are supervised by their state together with either the Federal Reserve or the FDIC. In the same bank, an examiner for whom generative AI sits outside the model risk guidance can therefore meet one who brings the agent procedure. The framework is not aimed at Washington, though: the CSBS lists the new federal guidance among its sources, and its president, Brandon Milhorn, praised the partnership between the Federal Reserve and state supervisors on 6 October.

Meanwhile, according to Reuters, Washington has started asking as well. According to a Reuters report on 13 October, citing people familiar with the matter, the Federal Reserve, the OCC and the FDIC have been sending written and verbal inquiries to large, mid-sized and smaller banks. The questions reportedly include what limits apply to systems, how their actions are monitored and approved, whether banks can track and audit the decisions of AI agents and how they can shut down autonomous systems. The agencies declined to comment. According to the report, supervisors are still gathering information rather than prescribing anything. No link to the CSBS framework has been shown, but the overlap with its agent procedure is plain. At federal level there is still no published version of these questions. The states have had one in print since 16 September.

Almost the same definition of a model, different treatment of generative AI

For readers in Germany, the comparison with the Minimum Requirements for Risk Management (MaRisk) of the Federal Financial Supervisory Authority (BaFin) is an obvious one, and it is more revealing than it first appears. Both supervisors define a model in almost the same way. In its explanatory notes on AT 4.3.4, BaFin speaks of a quantitative method, system or approach that applies statistical or mathematical theories to process input data into quantitative estimates. The American guidance uses the same construction with statistical, economic or financial theories. From almost the same definition, the two sides reach different conclusions on generative AI.

BaFin names artificial intelligence expressly in its section on models, and has done so since before the latest amendment. Circular 06/2024, issued on 29 May 2024, stated in AT 4.3.5 that the requirements also apply to automated models, technology-driven innovation and artificial intelligence, and required such models to be sufficiently explainable. The ninth amendment, Circular 06/2026 dated 30 June 2026, confirmed the requirements as AT 4.3.4. Its explanatory notes state that a model counts as explainable if the relationships between input and output variables can be shown. In the same half-year, the US agencies removed generative AI and agents from their guidance.

The comparison has two limits, and both sharpen the finding rather than undo it. First, on both sides it is open whether a language model that produces text delivers quantitative estimates at all and so falls within the definition. The US agencies call generative AI and agents models in their own footnote and still exclude them, while BaFin leaves the question open. Second, since the ninth amendment MaRisk no longer applies to the significant institutions directly supervised by the European Central Bank (ECB), such as Deutsche Bank, DZ BANK or Landesbank Baden-Württemberg (LBBW), which run operations in the US. Anyone running a major bank in Frankfurt therefore typically has three points of reference: the ECB for the group, the Federal Reserve for the US holding company and, where a subsidiary holds a state charter, a state supervisor. The CSBS framework concerns only the third, but it brings written questions on agents of a kind still missing at federal level.

At least one German bank is already among those addressed

At least one German bank is among those the framework addresses. According to Deutsche Bank's annual report to the US Securities and Exchange Commission (Form 20-F), Deutsche Bank Trust Company Americas is a New York state-chartered bank, supervised by the Federal Reserve and the New York State Department of Financial Services (NYDFS). It therefore falls among the state-chartered banks the framework addresses. Whether the framework also extends to the state-licensed New York branches of foreign banks, such as those of DZ BANK or LBBW, the documents do not say. They name state-chartered banks and state-licensed non-bank financial institutions and do not mention branches of foreign institutions. For the banks concerned, this is a question worth raising in the next supervisory meeting with the NYDFS, before the NYDFS raises it.

What this means in practice

For those responsible for AI governance, risk management and internal audit, the framework suggests five starting points. None requires a new structure, and all of them build on documents an examiner may request under the guide.

Glossary

Christian Schablitzki – the agentic banker

Strategy & Management Consultant · Agentic AI expert for financial institutions

More than 20 years in investment banking and derivatives trading, followed by over 10 years advising financial institutions. Currently a Partner at Infosys Consulting in Germany. Certified as Claude Partner – Claude Code (Anthropic), as well as in Google AI, Generative AI Leader (Google Cloud) and IBM RAG and Agentic AI.

LinkedIn profile → · agenticbanker.ai →