AI in banking just became a supervisory problem

The story about artificial intelligence in banking has changed. It is no longer only about productivity. In June 2026, US bank regulators, including the Office of the Comptroller of the Currency and the Federal Reserve, began asking detailed questions about AI during routine examinations. No new AI law was passed. Supervision arrived through the tools regulators already have.

From innovation story to supervision story

Examiners are asking how banks control AI: who can access what data, whether a model can infer beyond its authorised limits, whether the bank can shut a system down if it needs to, and whether third-party vendors and their subcontractors meet the same governance bar as the bank itself. These are conduct and control questions, not productivity questions.

The bar is here now

Regulators are leaning on frameworks that already exist: model risk management, third-party risk oversight, and consumer protection law. That matters, because it removes the most common excuse. "There is no specific AI rule yet" is not a defence when the supervisor is applying rules that have been in force for years. The OCC, the Federal Reserve and the FDIC have also signalled a formal request for information on banks' use of generative and agentic AI, so the direction of travel is clear.

The step most firms have skipped

Where AI affects credit, pricing or access to financial services, the decisions it influences carry fundamental-rights weight. Under the EU AI Act, AI in finance and insurance triggers a fundamental rights impact assessment on top of the standard requirements. Most firms have not run one. It is the finance-specific control that turns a general AI policy into something you can defend.

What risk teams should do

Map every AI use case to four things: the data controls around it, the oversight of vendors and their subcontractors, a shutdown or contingency plan, and a clear incident-escalation route. If you can show a supervisor that map, with the evidence behind it, you are in a very different position from a bank that is still describing its AI in slideware.