CSBS Releases AI Supervisory Framework: Need to Know

The Conference of State Bank Supervisors (“CSBS”) has released a new Artificial Intelligence Supervisory Framework (“CSBS Framework”) designed to give state regulators a common approach for reviewing AI use by state-chartered banks and state-licensed nonbank financial institutions.

For mortgage executives, the framework matters.

It does not create new legal obligations, and individual states will decide whether and how to use it. But CSBS has effectively published a roadmap for AI examinations: the questions regulators are likely to ask, the documents they are likely to request, and the risks they are likely to scrutinize.

That makes the CSBS Framework a useful examination-readiness checklist, especially when used in conjunction with other requirements that have evolved recently.  See, e.g., our discussions of Freddie Mac’s requirements here and state enforcement developments here. 

What Should Mortgage Executives Do Now?

The CSBS Framework gives mortgage companies an opportunity to test their AI programs before an examiner does.

At a minimum, leadership should consider at least seven steps.

1.  Build or Refresh the AI Inventory

Identify internal AI tools, generative AI, models, and vendor-embedded AI across origination, servicing, and corporate functions.

Do not limit the exercise to products marketed as “AI.” Review existing platforms for newly added AI functionality.

Assign a business owner to each material use case.

2.  Risk-Tier Use Cases

Not all AI presents the same risk.

A tool summarizing internal meetings should not receive the same oversight as AI influencing underwriting, pricing, servicing, fraud decisions, adverse action, or consumer communications.

Companies should distinguish lower-risk productivity tools from systems that could materially affect consumers, regulatory compliance, or operations.

3.  Review Governance and Executive Reporting

Management should know:

• Who approves new AI use cases?

• Who can stop one?

• Who owns AI risk?

• Who evaluates material vendor changes?

• Who determines whether a use case raises fair lending, privacy, cybersecurity, or consumer protection concerns?

For higher-risk applications, companies also should consider whether board-level reporting or oversight is appropriate.

4.  Revisit Vendor Management and Contracts

Identify which vendors use AI and what company or borrower data they receive.

Determine whether that data can be used to train or improve vendor models.

Review requirements involving model changes, monitoring, audit rights, incident notification, termination, and contingency planning.

For material systems, understand what happens if the vendor's AI becomes unavailable, changes significantly, or produces unreliable results.

5.  Scrutinize Consumer-Facing AI

Pay particular attention to AI affecting underwriting, eligibility, pricing, marketing, servicing, collections, complaints, fraud, and adverse action.

Understand both what the system is designed to do and how employees actually use its output.

If AI influences a consequential consumer decision, the mortgage company should be able to explain that decision and evaluate resulting outcomes for fair lending, UDAAP, and other consumer protection risks.

6.  Tighten Generative AI Controls

Establish clear rules for employee use of generative AI.

Those rules should address:

• Which tools are approved.

• What data may be entered.

• How AI-generated output must be reviewed.

• When AI-generated material may be used externally.

• How unauthorized “shadow AI” use will be identified and addressed.

7.  Mock Exam

The most useful step could be to turn the CSBS Framework into an internal examination checklist.

Ask whether the mortgage company could promptly produce:

• A current AI inventory.

• AI policies and procedures.

• Risk assessments.

• Vendor AI due diligence.

• Approval and governance records.

• Training materials.

• Testing and monitoring results.

• Consumer-impact analysis.

• Generative AI controls.

• Evidence of management oversight.

Any significant gaps identified through that exercise become a practical AI governance roadmap.

Bottom Line

The CSBS Artificial Intelligence Supervisory Framework is not a new AI regulation.

But its practical significance should not be underestimated.

State regulators have now given mortgage companies a detailed preview

There is a lot more to know.  Contact troy@garrishorn.com and let’s discuss it.