This AI policy template for finance is designed for adaptation by banks, credit unions, lenders, securities and investment firms, insurers, fintech companies, accounting and advisory firms, and corporate, nonprofit, education or government finance teams.
Template placeholders
Replace: [Organization Name], [Policy Owner], [Executive Sponsor], [AI Governance Committee], [Approved AI Tools], [Restricted Data Categories], [Approval Authority], [Incident Reporting Channel], [Effective Date] and [Review Date].
Start here: existing financial law and regulation still apply
Purpose
This section defines the organization’s approach to start here: existing financial law and regulation still apply and the controls needed to put that approach into practice.
Sample policy language
AI does not create an exemption from financial law, professional standards, contracts or internal controls. The rules that apply depend on the organization, activity, jurisdiction, charter, regulator, customer and data involved. [Organization Name] should identify applicable requirements before approving an AI use case.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Purpose and scope
Purpose
This section defines the organization’s approach to purpose and scope and the controls needed to put that approach into practice.
Sample policy language
This policy governs employees, officers, contractors and approved third parties who acquire, build, configure or use AI for [Organization Name]. It covers generative AI, predictive systems, machine learning, embedded vendor features and agentic systems used in banking, lending, securities, investments, insurance, accounting, audit, tax, treasury, payments, corporate finance or related operations.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
What this template is and is not
Purpose
This section defines the organization’s approach to what this template is and is not and the controls needed to put that approach into practice.
Sample policy language
This is a planning template, not legal advice, a compliance certification or a substitute for regulator, counsel, auditor or qualified professional review. Organizations should adapt it to their activities and delete provisions that do not apply.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Definitions and AI inventory
Purpose
This section defines the organization’s approach to definitions and ai inventory and the controls needed to put that approach into practice.
Sample policy language
[Policy Owner] will maintain an inventory of approved and proposed AI systems. Each record should identify purpose, owner, provider, users, data, integrations, output, affected parties, risk tier, approvals, testing, monitoring, incidents and retirement status. “AI system” should be defined broadly enough to include embedded and third-party features.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Foundational principles
Purpose
This section defines the organization’s approach to foundational principles and the controls needed to put that approach into practice.
Sample policy language
[Organization Name] will use AI lawfully, fairly, securely and transparently. Use must be appropriate to purpose; proportionate to risk; traceable; tested; accessible where required; subject to meaningful human oversight; and consistent with privacy, consumer protection, professional ethics and records obligations.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Governance, roles and accountability
Purpose
This section defines the organization’s approach to governance, roles and accountability and the controls needed to put that approach into practice.
Sample policy language
The [Executive Sponsor] is accountable for this policy. The [AI Governance Committee] reviews material use cases. Business owners remain responsible for outcomes; information security governs technical risk; privacy and legal teams review data and legal issues; compliance maps regulatory obligations; model risk or validation functions assess applicable models; internal audit provides independent assurance within its mandate.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Risk classification and approval
Purpose
This section defines the organization’s approach to risk classification and approval and the controls needed to put that approach into practice.
Sample policy language
Classify uses as low-risk assistive, review-required, high-impact or prohibited. High-impact uses include those affecting access to credit, pricing, eligibility, investment or customer outcomes; material financial reporting; payment release; regulatory filings; fraud disposition; or legal rights. The organization should document approval criteria, review level and reapproval triggers for each tier.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Acceptable and prohibited use
Purpose
This section defines the organization’s approach to acceptable and prohibited use and the controls needed to put that approach into practice.
Sample policy language
Approved assistive uses may include drafting, summarizing, coding, research and analysis when data and human-review requirements are met. Prohibited uses include uploading restricted data to unapproved tools; fabricating records or citations; bypassing segregation of duties; autonomous credit, investment, payment, filing or compliance decisions; impersonation or deceptive content; unapproved surveillance; and use intended to evade supervision, retention or audit controls.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Privacy, confidentiality and data governance
Purpose
This section defines the organization’s approach to privacy, confidentiality and data governance and the controls needed to put that approach into practice.
Sample policy language
Use the minimum necessary data. [Restricted Data Categories] should include, as applicable, nonpublic personal information, personally identifiable information, account and card data, tax and payroll records, credentials, confidential financials, material nonpublic information, suspicious activity report information, trade secrets and contract-restricted data. Define approved environments, retention, access, cross-border transfer, training use, deletion and data-subject procedures.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Cybersecurity, identity and AI-enabled fraud
Purpose
This section defines the organization’s approach to cybersecurity, identity and ai-enabled fraud and the controls needed to put that approach into practice.
Sample policy language
Apply defense in depth to AI systems and their integrations. Controls should address access, multifactor authentication, secrets, logging, data loss, prompt injection, malicious files, model or data poisoning, insecure plugins, excessive agency and supply-chain risk. Verify payment or account changes through trusted channels. Establish procedures for deepfakes, impersonation, voice cloning and AI-scaled fraud.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Model and AI lifecycle governance
Purpose
This section defines the organization’s approach to model and ai lifecycle governance and the controls needed to put that approach into practice.
Sample policy language
Document design, data lineage, limitations, performance, validation, monitoring, overrides, changes and retirement. Banking organizations should evaluate applicable supervisory guidance, including SR 26-2 for models within its scope. SR 26-2 expressly places generative and agentic AI outside that guidance’s scope; those systems still require controls appropriate to their risks under broader governance and the Treasury financial-services AI framework.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Explainability, traceability and records
Purpose
This section defines the organization’s approach to explainability, traceability and records and the controls needed to put that approach into practice.
Sample policy language
Retain enough information to reconstruct material use: system and version, approved purpose, input source, output, material prompts or configuration, reviewer, changes, decision rationale and required records. Explanations must be accurate and appropriate to the audience. An opaque system is not a reason to omit a legally required explanation.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Consumer finance, lending and credit
Purpose
This section defines the organization’s approach to consumer finance, lending and credit and the controls needed to put that approach into practice.
Sample policy language
AI-assisted credit and servicing processes must comply with applicable fair-lending, consumer-protection, notice, accuracy and dispute requirements. Qualified staff must confirm that adverse-action reasons are specific, accurate and reflect the actual factors used. Monitor data, proxies, outcomes, overrides, complaints and disparate effects; involve counsel and compliance before deployment.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Securities, investments and regulated communications
Purpose
This section defines the organization’s approach to securities, investments and regulated communications and the controls needed to put that approach into practice.
Sample policy language
Broker-dealers, investment advisers and other market participants should map applicable supervision, communications, books-and-records, fiduciary, suitability or best-interest, conflict and anti-fraud obligations. AI-generated public or customer communications require the same review as other communications. Claims about an organization’s AI capabilities must be specific, supportable and approved to prevent misleading “AI washing.”
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Accounting, financial reporting, audit and tax
Purpose
This section defines the organization’s approach to accounting, financial reporting, audit and tax and the controls needed to put that approach into practice.
Sample policy language
AI may assist research, reconciliation, drafting and analysis but may not replace authoritative literature, sufficient appropriate evidence, professional skepticism or required sign-off. Trace figures to systems of record; preserve documentation; test calculations and journal support; disclose material judgments; and require qualified review before entries, reports, filings or attest conclusions.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Payments, treasury and transaction authorization
Purpose
This section defines the organization’s approach to payments, treasury and transaction authorization and the controls needed to put that approach into practice.
Sample policy language
AI must not independently create and release a payment, change payee instructions, move funds or override limits. Preserve segregation of duties, dual authorization, out-of-band verification, sanctions and fraud controls, audit logs and exception escalation. Payment-card environments must follow applicable PCI DSS requirements.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Customer-facing AI and marketing
Purpose
This section defines the organization’s approach to customer-facing ai and marketing and the controls needed to put that approach into practice.
Sample policy language
Disclose AI interaction when required or when needed to prevent confusion. Provide an accessible route to a person. Test for accurate, consistent and fair responses; prohibit unsupported product, return or capability claims; preserve required notices; monitor complaints; and prevent the system from exposing customer or confidential information.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Third-party, cloud and embedded AI
Purpose
This section defines the organization’s approach to third-party, cloud and embedded ai and the controls needed to put that approach into practice.
Sample policy language
Before procurement or activation, assess provider governance, data use, retention, training, location, security, testing, subcontractors, intellectual property, incident notice, audit rights, regulatory access, business continuity and exit support. Contract terms should match the risk. The organization remains accountable for outsourced or embedded capabilities.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Human oversight and high-impact decisions
Purpose
This section defines the organization’s approach to human oversight and high-impact decisions and the controls needed to put that approach into practice.
Sample policy language
Name the qualified person with authority and time to review, challenge, stop or override the system. Avoid rubber-stamping. Define evidence, confidence, exception and escalation thresholds. No AI output should become a final high-impact decision until required human review and approval are documented.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Testing, validation and monitoring
Purpose
This section defines the organization’s approach to testing, validation and monitoring and the controls needed to put that approach into practice.
Sample policy language
Test before launch and after material changes. Measures should cover accuracy, completeness, stability, bias and fairness where relevant, security, privacy, explainability, false positives and negatives, override rates, complaints, incidents and business impact. Compare with an approved baseline, define thresholds and suspend use when controls fail.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Training and AI literacy
Purpose
This section defines the organization’s approach to training and ai literacy and the controls needed to put that approach into practice.
Sample policy language
Provide role-based training on permitted tools, restricted data, prompt and output risks, fraud and deepfakes, professional obligations, human review, incident reporting and the limits of AI. Specialized training should be required for developers, validators, procurement, compliance, customer-facing staff and high-impact decision-makers.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Incident response and escalation
Purpose
This section defines the organization’s approach to incident response and escalation and the controls needed to put that approach into practice.
Sample policy language
Report suspected data exposure, harmful or discriminatory output, fraud, security compromise, material error, regulatory breach or uncontrolled system behavior through [Incident Reporting Channel]. Procedures should cover containment, evidence preservation, legal and regulatory assessment, customer or authority notification where required, remediation and lessons learned.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Exceptions, enforcement and non-retaliation
Purpose
This section defines the organization’s approach to exceptions, enforcement and non-retaliation and the controls needed to put that approach into practice.
Sample policy language
Exceptions require documented business need, risk assessment, compensating controls, named approver, expiration and review. Violations may result in access removal or discipline consistent with policy and law. Personnel should be able to report concerns in good faith without retaliation.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Review and continuous improvement
Purpose
This section defines the organization’s approach to review and continuous improvement and the controls needed to put that approach into practice.
Sample policy language
[Policy Owner] will review this policy at least annually and after significant incidents, regulatory changes, new high-impact uses or material vendor changes. The [AI Governance Committee] should report inventory, risk, testing, incidents, complaints, exceptions and remediation to appropriate leadership.
Implementation considerations
- Identify the accountable owner, applicable requirements, data and affected people.
- Set measurable approval, testing, documentation and monitoring requirements.
- Define escalation, suspension and reapproval triggers.
Common pitfalls
- Treating vendor assurances or an AI-generated answer as independent validation.
- Applying one control level to every use case or overlooking embedded AI.
- Failing to document assumptions, exceptions, overrides and human decisions.
Stakeholders to involve
Business owner, finance leadership, legal, compliance, privacy, information security, risk, internal audit, records management, accessibility, procurement and affected customers or employees, as appropriate.
Implementation checklist
- Inventory all acquired, built and embedded AI systems.
- Map each use to applicable law, regulation, contract, standard and internal policy.
- Assign an owner and risk tier; document approval before use.
- Approve tools, data categories, access, integrations and retention.
- Test accuracy, security, privacy, fairness, explainability and controls as relevant.
- Establish meaningful human review for material outputs and high-impact decisions.
- Perform vendor due diligence and contract for data, audit, incident and exit rights.
- Train users and reviewers; test incident and fraud-response procedures.
- Monitor performance, overrides, complaints, incidents and material changes.
- Review the policy at least annually and document leadership approval.
Frequently asked questions
Does one finance AI policy fit every organization?
No. A corporate finance team, community bank, investment adviser and accounting firm face different obligations. Adapt the template to the actual activities, regulators, data and risks.
Can AI make final credit, investment, payment or accounting decisions?
This template recommends that it should not act alone. High-impact outcomes require authorized human review, applicable professional judgment, controls and documented approval.
Does existing law still apply when AI is used?
Yes. AI generally changes how work is performed, not whether consumer protection, privacy, securities, banking, accounting, audit, employment, records, cybersecurity and contract requirements apply.
Authoritative sources and implementation resources
- U.S. Treasury: Financial Services AI Risk Management Framework and AI Lexicon (February 2026)
- Financial Services Sector Coordinating Council: AI deliverables
- NIST AI Risk Management Framework
- NIST Generative AI Profile
- Federal Reserve SR 26-2: Model Risk Management
- CFPB: Adverse action notices and complex algorithms
- FINRA Regulatory Notice 24-09: Generative AI
- SEC: Enforcement involving misleading AI claims
- FTC Safeguards Rule guidance
- PCI Security Standards Council
- PCAOB: Generative AI in audits and financial reporting
Organizations should also consult the current rules and guidance of their own federal and state regulators, professional licensing bodies and standard setters.