Artificial Intelligence: Slowly, the rules are starting to take form

Lawmakers and bank regulators are finally starting, if even by small measures, to keep pace with artificial intelligence tools designed to give community banks a competitive edge. Meaningful laws and regulations are taking shape, but they are far from being fully formed..For several years, the zeitgeist has insisted banks adopt AI or lose market share, while safety and security concerns give way to the “move fast and break things” ideology of modern tech. Community banks are not known for moving fast or breaking things. They also have limited resources. Bank regulators express confidence in their ability to keep a lid on the risks posed by AI, but in reality the rules surrounding its use remain in flux. The power of AI tools grows by the day. Laws and regulations do not. This largely remains new territory for everyone involved.AI has already been stuffed into every nook and cranny of traditional, legacy software like Microsoft Office right up to cutting edge, industry specific niches, including many tools for community banks. With the speed at which AI tech is advancing, only snapshots of the evolution can be taken, and those can be outdated quickly. So at this moment, how much does AI for community banks still look like the wild west?“I’d push back slightly on the ‘wild west’ framing, as that may have been true 18 months ago,” said Rafael DeLeon, senior vice president, industry engagement for Ncontracts, a fintech specializing in risk and compliance management. DeLeon pointed out that in February, the U.S. Treasury released a Financial Services AI Risk Management Framework “with 230 control objectives, specifically tailored to the banking sector.”“In April, the Fed, OCC and FDIC updated the model risk management guidance that’s governed this space since 2011,” DeLeon said. “In their joint press release, the regulators stated that they plan to issue a request for information addressing model risk management and consider banks’ use of AI, including generative AI, agentic AI, and AI-based models. So, the regulatory frameworks aren’t missing anymore.”AI, if not totally wild, is at least an identifiable whirlwind. In June, the White House issued an executive order on the subject, stating the U.S. should be in the international pole position when it comes to integrating AI. The order included a demand for rules that specifically named community banks. Independent Community Bankers of America President and CEO Rebeca Romero Rainey said the order’s explicit inclusion of community banks “directly aligns with ICBA’s ongoing advocacy for equitable access to federal AI security resources and coordination.” Reacting to the same executive order, American Bankers Association President and CEO Rob Nichols said banks “already invest heavily in protecting customers, safeguarding sensitive information, and defending against increasingly sophisticated fraud and cyber threats.”Nichols added that success will depend on “ensuring that organizations of all sizes, including community banks, have timely access to actionable threat intelligence, effective cybersecurity tools and practical mechanisms for coordinated response.”Regulators are paying attention and taking care not to paint the banking industry with a broad brush when it comes to AI. Federal Reserve Vice Chair for Supervision Michelle Bowman said in July that supervision and regulation regarding the use of AI should be based on a bank’s size and level of risk. “What works or is a consideration for larger institutions using AI in complex applications is not appropriate for smaller institutions with less complex AI uses,” Bowman said while speaking at a Financial Stability Board event.While federal law-making grinds along at its usually slow pace, DeLeon said community banks should be more focused on what’s happening at the state level.“And this is the part community banks need to hear,” DeLeon said. “First, the new model risk guidance explicitly carves out generative and agentic AI from its formal scope, as they are novel and rapidly evolving. But it also says, in the same breath, that broader risk management practices still cover those systems. So the tools spreading fastest inside your bank are the ones sitting in the widest gap and it’s creating potential exposure.”DeLeon said the enforcement pressure isn’t coming from where community banks are looking. He said the most active AI enforcers in the country right now are state attorneys general, using consumer protection and breach notification laws they’ve had all along.“A community bank that has an AI-related data exposure touching more than 500 residents, in Pennsylvania, for example, owes notice to the state AG, concurrent with customer notice, plus a year of credit monitoring depending on certain triggers,” DeLeon said. “Banks are preparing for a slow federal rulemaking while the actual exposure is fast, state-level, and already here.”Phil Goldfeder, CEO of the American Fintech Council, agrees that current federal regulation overlaps and broadly covers the adoption of untested AI for banks, but it’s a blunt tool.“We have unfortunately witnessed what happens when nefarious technology companies defraud banks and the consumer impact when some banks move too quickly without the appropriate due diligence,” Goldfeder said. “Historically, regulators have miscategorized true risk and have been slow to adopt the supervisory technology in order to keep pace with the very institutions they oversee.”Goldfeder thinks that is changing. FDIC Chairman Travis Hill, Comptroller Jonathan Gould, and the Fed’s Bowman “have been a breath of fresh air and have refocused their agencies to better communicate and understand the latest fintech tools and better prepare their agencies to manage the AI evolution. This is a recognition that true risk is not simply about asset size but rather how banks are embracing and treating their new innovative tools.”Goldfeder stressed that the federal government needs to identify an operating framework for AI. “Congressional action could also provide unified framework and clarity. Durable policy must be bipartisan if we want it to survive and it needs to include industry collaboration. Large legislative and regulatory fluctuations do not help innovators or consumers,” he said.There may still be more questions than answers for community banks in terms of AI, but the industry can take advantage of AI’s powers while maintaining the high level of trust it enjoys with commercial and retail customers.“Ultimately, while the AI tools grabbing everyone’s attention matter, it is the people developing and implementing them that matter most,” Goldfeder said. “The responsible innovators that get it right won’t be the ones that moved the fastest, they will be the ones who moved the most deliberately.”