US Bank Regulators Deepen AI Risk Scrutiny, Targeting Cybersecurity and Human Oversight

US bank regulators are intensifying their oversight of artificial intelligence risks within the financial sector, with a particular focus on cybersecurity, the autonomy of AI systems, and the necessity of human oversight. The Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) are actively gathering information on how banks are managing these advanced technologies.

Regulators are reportedly asking specific questions about “kill switches” for AI systems and seeking assurance that adequate human intervention capabilities are in place. This intensified focus follows a series of cybersecurity incidents involving AI agents, including breaches linked to AI agents developed in China that affected South Korean banks, and separate incidents involving agents from OpenAI. These events underscore concerns that autonomous software can create new attack surfaces, whether as a tool for attack or as a vulnerability to be exploited.

Beyond cybersecurity, regulators are examining the increasing autonomy of AI systems and the potential for “AI overreach.” This includes scrutinizing third-party technology dependencies, with inquiries extending to the origins and inner workings of software licensed by banks, including tools developed in China. The current inquiries are described as broad information-gathering efforts, rather than targeting specific institutions.

This regulatory push builds upon earlier guidance. Federal agencies revised their model risk management guidance on April 17, 2026. However, this update notably excluded generative and agentic AI, citing the rapid pace at which these technologies are evolving. In parallel, state regulators, through the Conference of State Bank Supervisors (CSBS), have introduced an AI Supervisory Framework around September 16, 2026. This framework is designed to provide examiners with a structure for assessing AI risks at state-chartered banks, though it is discretionary for examiners.

Internationally, regulators are also pressing banks on AI resilience. The Bank of England and the European Central Bank are focusing on how quickly financial institutions can recover from AI-related failures, indicating a global trend toward increased AI oversight.

Broader Context

Source materials place the factual news in this context: America’s top bank regulators want to know what the robots are doing inside the vault.

Implications for Banks

The immediate implication for banks is likely to be increased compliance spending. Institutions will probably face higher costs associated with documenting AI governance, mapping vendor dependencies, and developing or testing shutdown mechanisms. Vendor risk management is expected to become a more significant area of focus, as banks may need to possess a deeper understanding of the provenance and internal operations of the AI software they utilize.

Future Outlook and Uncertainties

Despite the heightened scrutiny, several uncertainties remain. It is unclear whether federal agencies will issue formal guidance specifically for generative and agentic AI. Additionally, it is yet to be determined if the current broad information requests will narrow into more specific investigations of particular banks or vendors. The extent of international coordination on AI regulatory expectations for global banks also remains a point to watch.

Banks that establish strong AI controls and clear compliance strategies could potentially gain a competitive advantage, both with regulators and with investors who view robust governance as a proxy for operational discipline.