Your Bank Has an AI Policy. Can You Demonstrate That It's Being Followed?

An AI policy explains how your bank expects artificial intelligence to be used. But what evidence shows those expectations are being followed?

For community and regional banks, AI governance is becoming less about whether a written policy exists and more about how that policy is implemented across everyday operations.

Employees may use AI to summarize documents, draft communications, analyze information, or complete administrative tasks. AI capabilities may also be embedded within software the bank already uses.

The challenge is maintaining visibility into those activities while protecting sensitive information and ensuring appropriate oversight.

According to the Conference of State Bank Supervisors' 2026 Annual Survey of Community Banks, approximately 53% of responding community bankers reported piloting AI or using it in limited functions.

As adoption expands, bank leadership needs more than a policy outlining acceptable behavior. It needs a practical way to demonstrate how AI-related risks are identified, evaluated, monitored, and managed.

An AI policy documents expectations. Evidence demonstrates how those expectations are being put into practice.

Why AI Governance Documentation Matters Now

Recent developments are reinforcing the importance of documented AI oversight.

On September 16, 2026, the Conference of State Bank Supervisors (CSBS) released its Artificial Intelligence Supervisory Framework.

The framework provides state examiners with a structured resource for identifying AI use, assessing associated risks, and determining whether additional review may be appropriate.

It includes examination resources addressing governance and oversight, AI inventories, use cases, and emerging AI applications.

The framework is discretionary, not a new universal regulatory requirement. Each state agency determines whether and how to incorporate it into its supervisory activities.

Then, on October 15, 2026, the Financial Stability Board (FSB) published its Sound Practices for Responsible Adoption of Artificial Intelligence.

The FSB's 12 sound practices emphasize organization-wide governance, defined responsibilities, documentation, risk assessments, human oversight, and third-party risk management.

These practices are guidance rather than new binding requirements for U.S. community banks. However, they provide another useful reference for institutions evaluating their AI governance programs.

Together, these resources reinforce a practical question:

If bank leadership were asked to explain how its AI governance program operates, what evidence could it provide?

The answer should go beyond producing an acceptable-use policy.

Six Areas Where Banks Should Be Able to Demonstrate AI Governance

A functioning governance program should produce documentation appropriate to the bank's size, complexity, AI use, and risk profile.

The following six areas provide a practical starting point.

1. Approved AI Tools: Can You Show What Your Bank Is Actually Using?

A bank may maintain a list of approved AI applications, but that list is only useful if it reflects the tools and capabilities employees actually use.

Consider a bank that has approved Microsoft Copilot for certain business activities.

Employees may also have access to browser-based AI applications, personal AI accounts, or AI features introduced through existing software vendors.

Without appropriate visibility, leadership may not know whether actual usage aligns with its approved-tool requirements.

What evidence should the bank maintain?

• An inventory of known AI applications and AI-enabled services.
• Records identifying approved, restricted, and prohibited tools.
• Documentation of the business purpose and authorized users for approved applications.
• Records of approval decisions and relevant exceptions.
• Available usage information that helps identify differences between approved tools and actual activity.

The inventory should also account for AI capabilities that vendors introduce into existing products.

For example, when a software provider adds an AI-powered feature, the bank should determine whether that feature changes how information is accessed, processed, or shared.

The goal is not to prohibit every new AI tool. It is to establish a consistent process for understanding and approving its use.

2. Roles and Responsibilities: Can You Identify Who Makes AI Decisions?

A policy might state that employees must receive approval before adopting new AI applications.

But who grants that approval?

Does the IT department evaluate technical security? Does the Risk Officer review business exposure? Who determines which information an application may access?

Without clear responsibilities, important decisions can become inconsistent or remain undocumented.

The FSB's October 2026 sound practices specifically emphasize defined governance responsibilities and the role of board and senior management oversight.

What evidence should the bank maintain?

• Documented responsibility for approving new AI applications and use cases.
• Defined roles for IT, information security, risk management, compliance, and relevant business units.
• Records of significant AI-related decisions and approvals.
• Procedures for escalating security, privacy, or operational concerns.
• Appropriate management or board reporting on material AI risks.

A community bank does not necessarily need an entirely new committee dedicated to AI governance.

Depending on its structure and risk profile, existing risk-management, technology, or governance processes may provide an appropriate starting point.

The important consideration is whether responsibilities are clearly assigned and decisions can be explained.

3. AI Risk Assessments: Can You Explain How Risks Were Evaluated?

Not every AI application creates the same level of risk.

An application used to improve internal writing may present a different risk profile from one connected to sensitive customer information or involved in an important operational decision.

Banks should evaluate AI use cases based on their purpose, the information involved, the systems they access, and the potential impact if something goes wrong.

That evaluation should occur before significant new AI use cases are introduced and should be revisited when circumstances change.

What evidence should the bank maintain?

• Documented evaluations of material AI use cases.
• Identification of the data and systems involved.
• Consideration of cybersecurity, privacy, operational, and third-party risks.
• Records of mitigating controls and unresolved concerns.
• Documented decisions regarding approval, restrictions, or additional review.

The CSBS framework includes an optional AI Use Case Risk Tiering Worksheet to help support risk-based evaluations.

Banks can use resources like this to inform their own assessment processes without assuming every AI application requires the same level of review.

The objective is to demonstrate that AI-related decisions are informed by the risks involved, rather than made solely on convenience or perceived productivity benefits.

4. Third-Party AI Vendors: Can You Demonstrate Appropriate Review?

AI governance does not stop with applications employees access directly.

A bank may rely on technology vendors that incorporate AI into existing products and services.

Those capabilities can change over time, sometimes without the bank purchasing an entirely new application.

For example, a vendor might introduce AI-powered document analysis or automated workflows into an established service.

The bank should understand whether those changes affect its information-security requirements, customer-data exposure, or operational dependencies.

What evidence should the bank maintain?

• Records of relevant AI vendor reviews and risk assessments.
• Documentation of what information the vendor's AI capabilities may access or process.
• Review of applicable contractual, security, privacy, and data-handling provisions.
• Evaluation of relevant third-party dependencies and integrations.
• Records of significant changes to vendor capabilities and resulting risk decisions.

The FSB's sound practices specifically address risks arising from third-party AI dependencies.

For community banks, those considerations can be incorporated into existing vendor-risk management processes.

The important question is whether the bank has enough information to understand and manage its exposure.

5. Human Oversight: Can You Show Where People Remain Accountable?

AI-generated information can be useful, but its output may be inaccurate, incomplete, or unsuitable for a particular business decision.

That makes human oversight an important part of an AI governance program.

Banks should determine which AI-assisted activities require employee verification, supervisory approval, or additional controls.

The level of oversight should reflect the use case and its potential impact.

For example, AI-generated internal meeting notes may require different review procedures than AI-generated recommendations used to support consequential business decisions.

What evidence should the bank maintain?

• Defined review requirements for relevant AI use cases.
• Documentation identifying which decisions require human approval.
• Procedures for validating AI-generated information where appropriate.
• Records of significant errors, exceptions, or escalations.
• Evidence that employees understand their responsibilities when using AI.

The FSB includes effective human oversight among its sound practices.

For banks, this means considering not only whether an AI tool performs its intended function, but also whether appropriate people remain accountable for how its output is used.

6. Ongoing Monitoring: Can You Demonstrate That Your Controls Continue to Work?

AI governance is not a one-time project.

Applications change. Employees adopt new workflows. Vendors introduce capabilities. Information-access requirements evolve.

A policy that accurately reflected the bank's environment six months ago may no longer address every AI use case in operation today.

Ongoing monitoring helps leadership understand whether actual usage continues to align with the bank's policies and risk tolerance.

What evidence should the bank maintain?

• Periodic reviews of approved AI applications and active use cases.
• Available reporting on AI usage and relevant policy activity.
• Documentation of identified exceptions and corrective actions.
• Records of policy updates and changing risk assessments.
• Management reporting that summarizes material AI-related risks and outstanding decisions.

Where supported by the bank's technology environment, technical safeguards can also help reinforce acceptable-use requirements.

For example, defined controls may warn users or restrict certain activities when sensitive information is submitted to an AI application.

Those controls should be evaluated as part of the broader governance program, with attention to their coverage, limitations, and effectiveness.

Monitoring provides the information needed to determine whether policies are working and where improvements may be necessary.

What Does AI Governance Evidence Look Like in Practice?

Governance evidence does not have to mean producing a large collection of disconnected reports.

It means maintaining useful records that connect the bank's policies to actual activities and decisions.

For example:

These are practical examples, not a universal regulatory checklist. The appropriate documentation depends on the institution's activities, risk profile, and applicable supervisory expectations.

The strongest programs connect these records.

For instance, an identified AI application should have an appropriate approval status, a documented business purpose, relevant risk considerations, and a designated owner.

If the application changes or introduces additional risk, the bank should have a process for reviewing that change.

This creates a governance record that can be maintained and updated rather than reconstructed when questions arise.

But what does it take to build a governance program that produces this kind of evidence? It starts with clearly defined responsibilities, documented risk assessments, vendor oversight, and processes that connect written policies to everyday AI use. For a closer look at building that foundation, read AI Governance for Community Banks: How to Turn an AI Policy Into a Defensible Program.

How Can Banks Identify Gaps Between Their AI Policy and Actual Practices?

A bank does not have to wait for an examination to evaluate whether its governance program is functioning as intended.

A useful starting point is comparing the bank's documented expectations against the technology and workflows currently in use.

Leadership can begin with several practical questions:

1. Do we have an accurate picture of the AI applications and capabilities being used?
2. Can we identify which tools have been approved and who is responsible for them?
3. Have we evaluated the risks associated with our important AI use cases?
4. Do our vendor reviews account for relevant AI capabilities and dependencies?
5. Have we established appropriate human oversight for AI-assisted activities?
6. Can we produce records showing how AI-related risks, exceptions, and policy requirements are monitored and addressed?

An unclear answer does not automatically mean a bank has a regulatory violation.

It may, however, identify an area where additional visibility, documentation, or controls would improve the institution's ability to manage AI risk.

For banks looking to establish that baseline, an AI governance assessment can help evaluate existing AI use and identify areas requiring attention.

Building an AI Governance Program That Can Be Demonstrated

The goal of AI governance should not be to create more paperwork or discourage employees from using useful technology.

It should be to help the bank adopt AI responsibly while maintaining appropriate visibility, accountability, and control.

That requires connecting written policies to the applications employees use, the information those applications access, the decisions leadership makes, and the monitoring processes that support continued oversight.

AvTek Solutions works with organizations to evaluate AI-related cybersecurity and business risks and establish practical governance processes.

Through its AI Governance Services, AvTek helps organizations assess current AI usage, develop acceptable-use policies, establish approved-tool standards, define responsibilities, strengthen data-protection practices, and support ongoing governance.

For community and regional banks, these activities can help identify gaps between documented expectations and actual AI use.

A policy is an important starting point.

The next step is understanding whether your bank has the visibility, controls, and supporting evidence needed to put that policy into practice.

Does Your Bank Know Whether Its AI Policy Is Being Followed?

If your bank has established AI usage policies but has limited visibility into the applications, activities, and risks behind them, an assessment can help identify where improvements may be needed.

Talk with AvTek about an AI Governance Assessment.

Understand how AI is currently being used in your environment, identify potential governance gaps, and determine practical next steps for managing AI-related risk.