Resources / Regulation Maps / Financial Services
Regulation MapsFinancial ServicesCommercial Banks
AI Regulation Map for Commercial Banks
The federal and state rules that govern AI at commercial banks, from fair lending and model risk to third-party oversight, and what examiners expect.
The short answer
Commercial banks have no single AI law, but existing rules already reach most AI uses. Fair lending law applies to AI in credit decisions, model risk management guidance applies to AI models, third-party risk guidance applies to AI vendors, and GLBA applies to customer data. State automated decision rules arriving in 2027 add disclosure duties for some lending decisions.
Rules at a glance
| Rule | What it covers | What it means for AI |
|---|---|---|
| Equal Credit Opportunity Act and Regulation B | Discrimination in credit, and adverse action notices | AI in credit decisions must be tested for fair lending risk and must support specific reasons for denials. |
| Fair Credit Reporting Act | Use of consumer reports | AI that uses consumer report data must follow permissible purpose and adverse action rules. |
| Model risk management guidance (SR 11-7) | Development, validation, and use of models | AI models need independent validation, documentation, and ongoing monitoring. |
| Interagency guidance on third-party relationships | Risk management for vendors | AI vendors need due diligence, contract protections, and ongoing oversight. |
| Gramm-Leach-Bliley Act | Customer financial information | AI tools that receive customer data must fit your information security program. |
| UDAAP | Unfair, deceptive, or abusive acts or practices | AI chatbots and marketing must not mislead customers. |
Where AI is lowest and highest risk
- Lower risk: internal document drafting and research without customer data
- Moderate risk: customer service chatbots, fraud alerts, and AML monitoring, with human review and clear escalation
- Highest risk: AI in underwriting, pricing, and credit line decisions
What to do now
- Bring AI models into your model inventory and validation schedule
- Test AI used in credit decisions for fair lending risk, including vendor models
- Add AI-specific terms to vendor contracts: data use, model changes, audit support, and incident notice
- Confirm your adverse action process can explain AI-influenced decisions
Frequently asked questions
Does model risk guidance apply to generative AI?
Banking regulators expect the same disciplined risk management for AI tools as for other models: an inventory, validation proportionate to risk, documentation, and monitoring. Many banks extend their model risk programs to cover generative AI uses.
Are we responsible for a vendor’s AI model?
Yes. Using a vendor model doesn’t transfer your fair lending or consumer protection obligations, so you need enough information from the vendor to test and explain the model’s results.
Sources
- Equal Credit Opportunity Act and Regulation B, 12 CFR Part 1002
- Fair Credit Reporting Act, 15 U.S.C. 1681
- Federal Reserve and OCC Supervisory Guidance on Model Risk Management (SR 11-7)
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
- Gramm-Leach-Bliley Act, 15 U.S.C. 6801
- Dodd-Frank Act prohibition on unfair, deceptive, or abusive acts or practices, 12 U.S.C. 5531
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Regulation Map for Commercial Banks. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-regulation-map-commercial-banks
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
Fair Lending AI Testing
Independent fair lending testing of AI used in credit decisions, with results ready for examiners and boards.
AI Vendor Risk Management Program
An ongoing program to vet, approve, and monitor the AI vendors and AI features your organization relies on.
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.