What Bank and Credit Union Examiners Now Ask About AI
Sometime in the first half of 2026, AI stopped being a special topic in bank exams and became a routine one. Examiners from the OCC and the Federal Reserve now ask about it in standard examinations, according to Reuters reporting in June.
Most of the questions are what you would expect: where AI is used, who governs it, which vendors supply it. One of them is harder than it sounds, and most institutions answer it with the wrong document. Examiners want to know whether your AI systems can access data beyond what they are authorized to see.
This piece covers what examiners are asking, what the current guidance says and leaves out, how the picture differs for credit unions and state-chartered banks, and the questions worth having answers to before your next exam.
AI is now part of routine exams
On June 12, 2026, Reuters reported, citing people familiar with the matter, that OCC and Federal Reserve examiners had begun asking about AI in routine bank examinations. Per PYMNTS's account of that report, the questions cover controls and protections for client data, governance frameworks, third-party and vendor oversight, exposure through subcontractors, and contingency plans for AI failures. Examiners are focused on higher-risk uses: lending, know-your-customer checks, and sanctions screening.
Three concerns stand out in the reporting:
- Whether AI systems can access or infer "data beyond their authorized limits."
- Whether a bank can shut an AI system off if it behaves unexpectedly.
- Whether vendors, and their subcontractors, meet the same governance and security standards the bank does.
The questions are described as fact-finding, a way for supervisors to understand how banks use AI, not a new rulebook. The Fed declined to comment on the report.
Fact-finding still has consequences. What an examiner learns in this round shapes what they expect in the next one, and banks are not well prepared for some of it. In Wolters Kluwer's US Banking AI Risk and Governance Index, published in May 2026 from a survey of 230 banking professionals, 72% said their institution was least prepared for reporting or shutting down an AI incident, and about a third said they had no kill-switch protocols in place at all.
The April guidance left generative AI out
On April 17, 2026, the Federal Reserve, OCC and FDIC issued updated model risk management guidance, published by the Fed as SR 26-2. It replaces SR 11-7, the framework banks have used for model risk since 2011.
The most important line for this conversation sits in a footnote. Generative AI and agentic AI are described as "novel and rapidly evolving" and placed outside the guidance's scope. Banks are told to govern them with their existing risk management and governance practices. The guidance also states that it creates no new enforceable requirements, and it is aimed mainly at larger institutions, generally those above $30 billion in assets.
Fed Vice Chair for Supervision Michelle Bowman described the same situation in remarks at an FSOC roundtable on April 27: "Today, banks are relying on existing risk-management frameworks to guide their use of AI." She noted that the Fed had amended its model risk guidance "to clarify that it does not apply to generative or agentic AI," and said "we should assess whether our supervisory guidance is fit for the future." She also left an open question on the table: "How should we consider third-party risk-management expectations for vendor-provided AI tools or partnerships?"
In April the agencies said they would issue a request for information on AI "in the near future." As of early October it had not been published.
So for the tools staff actually use, ChatGPT, Claude, Gemini and Copilot, there is no AI-specific rulebook. There are examiners asking questions, and a set of older rules that still apply.
The rules that already apply to your AI vendor
No AI guidance does not mean no obligations. Two existing frameworks do most of the work, and both turn on data.
The first is the Interagency Guidelines Establishing Information Security Standards, which implement the Gramm-Leach-Bliley Act for banks. They require an information security program designed to "protect against unauthorized access to or use of" customer information. They define a service provider as any entity that "maintains, processes, or otherwise is permitted access to customer information" through services provided to the bank. And they require banks to exercise due diligence in selecting service providers, require appropriate safeguards by contract, and monitor them where the risk assessment calls for it.
Read that definition next to how a typical AI tool works. When an employee puts a loan file or a customer spreadsheet into a model, the model provider processes that customer information. On the plain language of the guidelines, that provider looks like a service provider, with everything that follows from it.
The second is the Interagency Guidance on Risk Management of Third-Party Relationships, issued June 6, 2023 by the Fed, FDIC and OCC. It says a banking organization is "ultimately responsible for conducting its activities," including activities conducted through a third party, and it lists the third party's information security program among the things due diligence should review.
Neither framework mentions AI. Both describe exactly the question examiners are now asking.
Why a vendor contract doesn't answer the question
Most institutions answer the data question with a contract. The enterprise agreement says the provider won't train on your data, will delete it after a set period, and will protect it while it holds it. These are real protections, and a bank should have them.
But they answer a different question. A no-training clause controls what the provider does with your data after it receives it. A retention limit controls how long the provider keeps it. Neither changes the fact that the provider receives readable customer data every time someone uses the tool on it. The contract governs the provider's behavior. It does not change what the model sees.
That distinction matters because of how the examiner question is framed. "Can your AI access data beyond its authorized limits" is a question about access, and access is decided by architecture: what leaves your environment, in what form, and who can read it when it arrives. A contract can promise that authorized access won't be misused. It can't make the access smaller than it is.
There is a second problem. Many AI capabilities now arrive embedded in tools a bank already licenses: the core provider's chatbot, the loan origination system's summarizer, the productivity suite's assistant. Each may sit on top of a foundation model from another company. That is the subcontractor exposure examiners are asking about, and it is easy to miss in a vendor inventory that only lists direct relationships.
Credit unions: the same questions, a narrower toolkit
NCUA's position is that AI needs no special rules. Its AI page, last updated in April 2026, says: "Yes. Credit unions may use AI tools and technologies," and that "existing regulations are technology-neutral and apply to AI use." Examiners review AI within the existing supervisory framework, including internal controls and third-party due diligence, and a credit union using an AI vendor "must conduct appropriate due diligence," including understanding the vendor's safeguards and controls.
The difference is in what NCUA can see. In a May 2025 report, the GAO found that NCUA cannot examine technology service providers, even as credit unions rely on them more for AI-driven services, and that its model risk guidance is "limited in scope and detail." GAO has recommended since 2015 that Congress give NCUA authority to examine those vendors. That recommendation is still open.
In practice, that puts more weight on the credit union itself. If the examiner can't examine your AI vendor, your own documentation of what member data that vendor can read is most of what the examiner has to go on.
State examiners now have a playbook
On September 16, 2026, the Conference of State Bank Supervisors released an AI Supervisory Framework for state examiners. State regulators supervise nearly 80% of FDIC-insured institutions, so for most community banks this is the closest thing to an AI exam manual that exists.
The framework is voluntary and creates no legal requirements, and each state decides whether and how to use it. It includes a core examiner guide with scoping questions and a document request list, an examiner work program, supplements on third-party oversight, model risk and consumer protection, and a worksheet for tiering AI use cases by risk.
Two parts are directly about data. The risk-tiering worksheet treats data sensitivity as a factor and puts uses involving sensitive personal data in the highest tier. And the third-party supplement covers AI "provided, supported, hosted or embedded by third parties," with due diligence factors that include "data provenance, privacy, security, explainability limits and vendor dependencies."
Questions to have answers to before your next exam
Based on what examiners are reported to be asking, and on the frameworks they are working from, these are the questions I would want documented answers to before the next exam:
- Where is AI in use today, including inside vendor products we already license?
- For each use, what customer or member data does the model receive, and in what form?
- Which companies can read that data when it arrives, including the foundation model behind a vendor's tool?
- Does our information security program treat each of those companies as a service provider, with due diligence, contract terms and monitoring to match?
- Can staff put customer data into an unapproved tool, and how would we know?
- Who can shut each AI system off, and how fast?
- If an AI vendor is compromised, how quickly can we cut it off?
Most institutions can answer the first question. The second and third are where answers usually turn into a description of the contract instead of a description of the data path.
Where this gets solved
The question "can the model access data beyond its authorized limits" goes away when the model never receives the underlying values at all.
That is how Nera works. Customer and member data is encrypted on the institution's side before anything leaves its environment. ChatGPT, Claude or Gemini receives the question and works on it without ever seeing the actual values, and only the institution can read the results. Nera can't read the data either. For an examiner, the answer to the data question stops being a contract and becomes a description of what the model received: the query, not the data.
If this is your world
If you sit in model risk, compliance or the CISO seat at a bank or credit union, and the AI question in your last exam was answered with a vendor contract, I'd like to hear what the examiner asked. You can see how Nera works for financial institutions, or book 20 minutes with me.
Rami Akeela, Ph.D., is Founder and CEO of Nera Systems, a confidential AI infrastructure company. He holds PhDs in Electrical Engineering (Santa Clara University) and Computer Engineering (Lehigh University), and has spent 20+ years in engineering and applied research, including founding DZK, the first company to build an FPGA-accelerated, end-to-end zero-knowledge proof system. Nera Systems builds confidential AI infrastructure for organizations that can't afford for their most sensitive data to be exposed to a model, a vendor, or each other.