What bank regulators have said about generative AI, 2024 to 2026

The revised interagency guidance on model risk of 17 April 2026 says: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance" [13]. Generative AI is AI that writes text, images or code. Agentic AI is AI that takes actions on its own, such as calling other software, to reach a goal. The agencies promised a request for information on these tools, and this guide found none in the Federal Register as of 26 October 2026.

So a bank that wants to know what its supervisors expect for generative AI has to read what they have said in reports, speeches and public statements. None of these documents is a rule. Each one shows what its author expects or is concerned about. This page collects them in date order, as part of the guide on AI in banking. A bank should confirm with its own counsel and its examiners how any of them applies to it.

The statements in date order

In the table, the Fed is the Federal Reserve Board, the OCC is the Office of the Comptroller of the Currency, and the FDIC is the Federal Deposit Insurance Corporation. The BIS is the Bank for International Settlements, the FCA is the UK's Financial Conduct Authority, and OSFI is Canada's Office of the Superintendent of Financial Institutions.

Date	Who	What it is	Binding?
March 2024	US Treasury	Report on AI cybersecurity risks in financial services, from 42 interviews [1]	No
14 November 2024	Financial Stability Board	Report on the financial stability effects of AI [4]	No
12 December 2024	BIS Financial Stability Institute	Paper on regulating AI in the financial sector [10]	No; authors' views
December 2024	US Treasury	Report on AI in financial services, after a public request for information [3]	No
9 April 2025	Bank of England Financial Policy Committee	Financial Stability in Focus on AI [9]	No
17 April 2026	Fed, OCC, FDIC	Revised model risk guidance, with generative and agentic AI out of scope [13]	No enforceable standards
7 May 2026	OCC	Semiannual Risk Perspective, Spring 2026 [8]	No
7 July 2026	Fed Vice Chair for Supervision Michelle W. Bowman	Opening remarks on sound practices for AI [7]	No; her own views
2 October 2026	FCA	Our approach to AI, last updated [11]	No new rules
15 October 2026	Financial Stability Board	Final sound practices for responsible AI adoption [5]	No
15 October 2026	OSFI	Statement endorsing the FSB sound practices [6]	No

The US Treasury's two reports of 2024

In March 2024 the US Treasury published a report on AI cybersecurity risks in financial services. It says: "The report's findings are based on 42 in-depth interviews conducted in late 2023" [1]. The report was written in response to Executive Order 14110 of 30 October 2023, which was revoked on 20 January 2025 by Executive Order 14148 [2]. The report is still on the Treasury's site, and its interview findings still describe what banks said at the time.

The report has three findings on generative AI. First, "Some of the financial institutions that Treasury met with reported that existing risk management frameworks may not be adequate to cover emerging AI technologies, such as Generative AI" [1]. Second, the firms described generative AI models as still developing, costly to put into use, and difficult to validate for uses that need high assurance [1]. Third, "many firms are instead prioritizing low-risk, high-return use cases, such as code-generating assistant tools for imminent deployment" [1]. The report also says "several institutions reported using the retrieval augmented generation (RAG) method" [1]. Retrieval augmented generation means the model first finds passages in the bank's own documents and then writes its answer from them. The guide page on RAG evaluation explains how to test a system built this way.

In December 2024 the Treasury published a second report, on AI in financial services. It followed a request for information published on 12 June 2024, and "The AI RFI closed for public comment on August 12, 2024" [3]. The Treasury received 103 comment letters [3]. It reports that respondents said generative AI was "leading firms to be cautious about deploying them broadly in customer-facing applications" [3]. It recommends that firms "prioritize their review of AI use cases for compliance with existing laws and regulations before deployment" [3], and that "financial regulators continue coordinating to identify potential enhancements to existing risk management frameworks" [3].

The OCC's spring 2026 risk report

The OCC's Semiannual Risk Perspective for spring 2026, released on 7 May 2026, says "Banks are taking a measured approach to the adoption of generative AI (genAI) and agentic AI" [8]. It describes bank use as "generally limited to specific use cases with guardrails and human-in-the-loop accountability to manage risk" [8]. That means banks use generative AI for a small set of tasks, with set limits on what it may do and a person who reviews and answers for the result.

The OCC names the problems: "The OCC recognizes there are unique challenges related to the use of genAI and agentic AI such as lack of explainability, data privacy and data poisoning issues, cybersecurity threats, and validation challenges" [8]. Explainability is the ability to say why a model gave a particular answer. Data poisoning is an attack that corrupts the data a model learns from or reads. It also says: "Many risks associated with AI are the same as those of models and tools that do not rely on AI" [8]. And it repeats the promise of a request for information: "The agencies plan to issue in the near future a request for information" [8].

The Federal Reserve: Vice Chair Bowman, 7 July 2026

Michelle W. Bowman, the Fed's Vice Chair for Supervision, gave opening remarks on sound practices for AI on 7 July 2026. She notes that the views are her own. She said the Fed has seen "a noticeable increase in the use of AI by banks of all sizes" [7]. She said the FSB report stressed that lower-risk uses of AI should get less supervision and less regulation [7]. She also said "these practices are not the only way to adopt and use AI responsibly or to manage AI risks" [7]. On how much control each use needs, she said: "That actual use and materiality will help inform the type and intensity of the governance and controls that should be applied for the specific AI deployment" [7]. Materiality means how much harm a failure could cause.

The Financial Stability Board, 2024 and 2026

In November 2024 the Financial Stability Board (FSB) named four groups of AI vulnerabilities: "Third-party dependencies and service provider concentration", "Market correlations", "Cyber", and "Model risk, data quality and governance" [4]. On generative AI it said: "Understanding the quality and accuracy of model outputs is complicated by new inaccuracies, such as hallucinations" [4]. A hallucination is an answer that sounds right but is false.

On 15 October 2026 the FSB published its final report on sound practices for responsible AI adoption. "The 12 sound practices are organised into two groups" [5]: four on governance across the organisation and eight on risk across the AI lifecycle. The lifecycle practices include an assessment of materiality and risk when a use case starts, data governance, explainability, performance evaluation, human oversight, cyber and technology risk, and dependence on third-party AI [5]. The FSB encourages the board and senior management of financial institutions to refer to the practices [5]. Under the FSB's charter, its decisions are not binding and create no legal rights or obligations [4].

Canada's OSFI said the same day: "OSFI endorses the Sound Practices" [6]. Its statement also names the opposite risk: "institutions face the risk of falling behind if they fail to adopt AI at a sufficient pace" [6].

The Bank of England, the BIS and the FCA

The Bank of England's Financial Policy Committee wrote on 9 April 2025 that it watches "Greater use of AI in banks' and insurers' core financial decision-making" [9]. Its concern is that many firms could make the same error at once: it describes the case where "common weaknesses in widely used models cause many firms to misestimate certain risks and so misprice and misallocate credit as a result" [9]. It describes agentic AI as "systems which can take autonomous action to achieve specified goals by utilising tools, learning from feedback, and adapting to dynamic environments" [9].

A paper from the BIS Financial Stability Institute, published 12 December 2024 and giving its authors' views, says: "While AI exacerbates existing risks such as model risk and data privacy, it does not introduce fundamentally new risks apart from gen AI, which may give rise to hallucination and anthropomorphism risks" [10]. Anthropomorphism risk is the risk that people treat an AI system as if it were a person and trust it too much.

The FCA says: "Our regulatory approach is principles-based and focused on outcomes" [11]. It does not plan new AI rules [11].

The US National Institute of Standards and Technology (NIST) publishes a voluntary AI Risk Management Framework, released on 26 January 2023, and its page says: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan" [12]. The page running an AI pilot inside a bank shows how the framework fits a trial.

What the statements have in common

Read side by side, the statements repeat a small set of expectations.

Theme	Who says it
Match controls to how much harm a use can cause	Bowman [7]; FSB lifecycle practices [5]
Check each use against existing law before use	US Treasury [3]
Output quality is hard to judge, including hallucinations	FSB [4]; BIS paper [10]; Treasury interviews [1]
Dependence on a few vendors is a risk	FSB [4][5]
Many AI risks are the same as for other models	OCC [8]; BIS paper [10]
Keep a person accountable for results	OCC [8]; FSB human oversight practice [5]

Reveneau's view is that every row asks for the same evidence: evidence that the AI system does what the bank says it does, for the use the bank has approved. For generative AI that evidence is an eval, a written, repeatable test of the system's answers against cases the bank chooses, including cases built to catch hallucinations. Run the evals before release and after every change to the model or its instructions, and keep the results with their dates. The guide on why AI evals matter explains this for a buyer, and the page what regulators say about testing AI covers regulators outside banking.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau. For the guidance that replaced SR 11-7, read model risk rules and AI.