Bank Regulatory Rules Perilously Bereft of AI Guidance

On April 17, the Fed, OCC, and FDIC issued a revamped model risk rulebook that had governed the largest U.S. banks since 2011. The new guidance reorganized how examiners evaluate banking models. The most consequential decision was not what the guidance covered. It was what it left out.

Generative and agentic artificial intelligence were excluded from the new framework. The agencies promised a future request for information on AI governance, but provide no timeline. Until then, firms are told to rely on existing model risk practices.

Just as banks are embedding AI into lending decisions, trading operations, and risk management, regulators updated the rulebook and carved AI out of it. The result is a rulebook that no longer covers what banks actually do.