AI product management · Industry brief

The Conference of State Bank Supervisors (CSBS) released an AI Supervisory Framework in August 2026 to guide state examiners in assessing artificial intelligence use by state-chartered banks and nonbank financial institutions. Though discretionary and creating no new legal obligations, the framework signals regulatory expectations for AI programs and fills a guidance gap left by federal banking agencies. It comprises five components: a core examiner guide with an eight-question scoping questionnaire, a 28-page examiner work program, nonbank AI supplements covering third-party oversight, model risk management and consumer protection, a risk-tiering worksheet for AI use cases ranked 1-3 based on consumer impact and data sensitivity, and source support documentation referencing NIST's AI Risk Management Framework and other regulatory materials. Key supervisory focal points include third-party vendor management—requiring institutions to identify AI-embedded relationships, incorporate AI-specific due diligence factors, and clarify shared oversight boundaries—and data practices, specifically whether customer or institutional data is retained, shared, or used to train vendor models. For consumer-facing AI applications, examiners will test whether institutions can explain adverse actions, pricing decisions and outcomes consistent with Equal Credit Opportunity Act principles, and monitor for proxy effects and automation bias. The framework encourages state adoption and consistency across multi-state operations, though individual states retain discretion on implementation; state-regulated entities should anticipate alignment with concurrent state AI legislation such as Colorado's finalized rules in May 2026 (Cooley LLP, Finsights).

China's Supreme People's Court published landmark judicial opinions on AI disputes on September 7, 2026—the first such ruling by a national supreme judicial body in China. The 24-article framework establishes fault-based liability as the default for AI-related disputes, distinguishing between general-purpose and specialized models, and applies a safe-harbor notice-and-takedown rule to generative AI service providers rather than imposing proactive monitoring obligations. Key provisions address autonomous vehicle liability under existing traffic rules, personality rights protection including deepfakes and "AI resurrection," intellectual property allocation among developers and users based on fault, consumer protection against big data price discrimination, and evidentiary standards for AI-generated materials. The opinions deliberately leave unresolved whether AI-generated content qualifies for copyright protection and whether using copyrighted works for model training constitutes infringement. The framework shifts compliance expectations toward "provable compliance" across the full AI lifecycle, requiring enterprises to document governance practices, maintain audit trails, implement content-review workflows, and preserve generation records for potential litigation.

North Dakota's Department of Insurance issued Bulletin 2026-2 (effective October 5, 2026) requiring all licensed insurers to ensure consumer-impacting AI decisions comply with insurance law and are not arbitrary, discriminatory, or unfair. The bulletin mandates risk-based AI Systems Programs with documented governance, controls, and model oversight covering the full insurance lifecycle from product development through claims, and treats third-party AI vendors as the insurer's compliance responsibility, requiring pre-use due diligence, contractual audit rights, and comparable governance standards. The Department may scrutinize AI governance, documentation, and vendor oversight during examinations and market-conduct actions, and can request the AIS Program, model inventories, bias documentation, audit results, and vendor materials as evidence of compliance.