AI rules for banks and credit unions in 2026

Which AI rules apply to banks and credit unions in 2026?

No federal statute or regulation governs AI at banks or credit unions as such. As of October 2026, the binding duties come from existing law: Regulation B adverse action and anti-discrimination rules, UDAAP, the Bank Secrecy Act, GLBA information security standards, incident notification rules, and, for some institutions, New York’s Part 500. For decisions on or after January 1, 2027, Colorado’s SB 26-189 adds its own. Model risk and vendor guidance tells examiners how to apply those duties, and the guidance differs for banks and credit unions.

That difference is the first thing to sort out. Banks answer to the Federal Reserve, OCC, or FDIC, which issued the 2026 model risk guidance. Federally insured credit unions answer to the NCUA, which states it has issued no AI-specific rules and supervises AI under its existing framework. For consumer financial law, the size line is $10 billion in total assets: at or below it, the prudential regulator has exclusive enforcement authority relative to the CFPB; above it, the CFPB has primary enforcement authority.

What does the 2026 model risk guidance mean for a bank’s AI models?

For banks, SR 26-2 and its OCC and FDIC versions replaced SR 11-7, OCC Bulletin 2011-12, and SR 21-8, the 2021 statement on model risk for BSA/AML systems. It is risk-based. The agencies say it is expected to be most relevant to banking organizations with more than $30 billion in total assets, and the FDIC states it generally does not apply to models at banks of $30 billion or less unless they have significant model risk exposure.

Three details decide how much of an AI program the guidance actually touches:

• The OCC states that generative and agentic AI models are not within the guidance’s scope. The agencies plan a request for information on model risk management that considers banks’ use of AI. We found no published request as of October 21, 2026.
• The guidance still covers vendor and other third-party products, including their validation.
• The agencies state that non-compliance with the guidance will not result in supervisory criticism. Supervisory action may still result from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.

Before the revision, OCC Bulletin 2025-26 (October 6, 2025) told community banks supervised by the OCC that its model risk guidance did not require annual model validation and that validation frequency and scope could be tailored to risk. The OCC has not rescinded that bulletin, and Bulletin 2026-13 cites it. The revised guidance itself says the timing, nature, and frequency of validation activities vary based on factors including model purpose, model methodology, and the frequency and scope of model changes.

A generative AI tool outside the guidance is not outside supervision. Third-party risk guidance and information security, fair lending, and UDAAP requirements still reach it.

What does the NCUA expect from credit unions?

Nothing new in regulation. The NCUA has not adopted SR 26-2 or issued AI-specific regulation, and it expects credit unions to use AI in a safe, sound, and compliant manner under existing rules. Its AI resources page, last modified April 28, 2026, states that “AI is not treated differently than any other innovative technology.”

In practice that means an examiner looks at the same things it would for any other new technology. The page says examiners review safety and soundness practices, legal compliance, internal controls over the AI tool, ongoing risk monitoring, and third-party due diligence. For vendor AI, it points to Letters to Credit Unions 07-CU-13 and 01-CU-20.

Two gaps are on the record. In May 2025, GAO found NCUA’s model risk guidance limited in scope and detail, and recommended an update. The recommendation remains open: after NCUA cited its AI resources page in March 2026, GAO said the page does not provide detailed model risk management guidance covering a broad variety of models. GAO also noted that NCUA lacks authority to examine technology service providers, which Congress had not granted as of February 2025. A credit union therefore carries more of the vendor oversight burden itself.

What must an adverse action notice say when a model decides?

It must state the specific reasons for the adverse action, or tell the applicant how to get them (12 CFR 1002.9). A model’s complexity does not excuse the duty.

The CFPB’s Circulars 2022-03 and 2023-03 said so directly. Both were among 67 guidance documents withdrawn effective May 12, 2025. The withdrawal removed the CFPB’s explanation; it did not change the regulation. A creditor that cannot say why its model denied an application still cannot produce the statement of specific reasons the rule requires.

The fair lending side did change in 2026. The CFPB’s Regulation B rule, effective July 21, 2026, states that ECOA does not authorize disparate impact liability. It is under APA challenge in National Fair Housing Alliance v. CFPB, No. 1:26-cv-01820 (D.D.C.), where briefing runs into January 2027. Intentional discrimination is still prohibited, and the rule does not change the Fair Housing Act or state laws that recognize disparate impact. A lender that drops disparate impact testing is assuming the rule survives the litigation and that no Fair Housing Act or state claim reaches its models. Keep testing.

Colorado adds a layer for decisions on or after January 1, 2027. A deployer must give notice before covered ADMT materially influences a consequential decision and, within 30 days after an adverse outcome, describe the ADMT’s role. A federal court order in X.AI LLC v. Weiser bars Colorado’s Attorney General from enforcing SB 26-189, including by investigation, for violations occurring on or before 14 days after the court rules on xAI’s preliminary injunction motion; xAI had not filed that motion as of October 21, 2026.

For a credit decision, the federal notice can do double duty. A creditor that is required to provide, and provides, an ECOA notice (and, when applicable, an FCRA notice) complies with Colorado’s notice requirements for the same decision if the federal notice also satisfies them, and that notice may include a brief statement that covered ADMT was used (C.R.S. 6-1-1704(6)).

Colorado also carves out much of the BSA and fraud side. It excludes from “consequential decision” activities relating to technologies used for anti-money laundering and counter-terrorist financing controls, economic sanctions compliance including under the Bank Secrecy Act (excluding facial recognition unless its sole purpose is to confirm an individual’s identity), and fraud prevention, including identity verification (C.R.S. 6-1-1701(3)(b)(VI) to (VIII)).

What should a contract with an AI vendor cover?

It should cover what the information security standards already require of any service provider, and what the third-party guidance expects, applied to how the AI uses data. For banks, the 2023 interagency guidance sets risk management across the life of a third-party relationship, commensurate with the bank’s risk profile and complexity. The September 2026 proposal would replace it with guidance that asks institutions to prioritize by the magnitude and likelihood of harm. Both are guidance, not rules.

The firmer requirement is GLBA. The interagency information security standards for banks require, and NCUA’s Part 748 Appendix A guidelines for credit unions call for, due diligence in selecting service providers, contracts requiring appropriate safeguards, and monitoring where the risk assessment indicates it.

• Permitted uses of customer or member data, including whether the vendor may train models on it
• Notice of material model changes, with version identifiers
• Documentation sufficient to validate the model and to map its outputs to adverse action reasons
• Access to bias and performance testing results
• Incident notice fast enough to meet your own 36-hour or 72-hour deadline; the federal bank service provider rule (12 CFR 53.4, 225.303, 304.24) only requires notice of an incident that disrupts, or is reasonably likely to disrupt, covered services for four or more hours
• For DFS-regulated institutions, timely notice of cybersecurity events and representations on secure use of nonpublic information, as the NYDFS letter recommends

How does AI change BSA/AML and fraud work?

It changes the threat more than the rules. FinCEN’s November 13, 2024 alert describes fraud using generative AI to create fake identity documents and get past identity verification. It asks institutions to use the key term “FIN-2024-DEEPFAKEFRAUD” in SAR field 2 and the narrative. Its red flags include a photo inconsistent with other identifying information, a third-party webcam plugin during live verification, and a customer who declines multifactor authentication.

The NYDFS letter of October 16, 2024 adds no new requirements to Part 500. It recommends authentication that deepfakes cannot impersonate, such as digital certificates and physical security keys, over SMS, voice, or video. Credit unions will find the FinCEN alert listed on NCUA’s AI resources page.

The supervisory change is on the bank side: BSA/AML systems that meet the model risk guidance’s definition of a model now fall under SR 26-2, which superseded SR 21-8. That definition excludes deterministic rule-based processes, so a rules-only monitoring scenario may sit outside it. Either way, keep a record of every threshold change and alert suppression decision.

Does the EU AI Act reach a US bank?

It can. Article 2 covers deployers located in the EU, such as an EU branch, and providers and deployers outside the EU where the system’s output is used in the EU. AI systems that evaluate the creditworthiness of natural persons or establish their credit score are high-risk under Annex III point 5(b), except systems used to detect financial fraud. Deployers of those systems must complete a fundamental rights impact assessment under Article 27. The Digital Omnibus moved these high-risk duties to December 2, 2027.

What should a bank or credit union do in the first 90 days?

• Inventory every model and AI tool, and mark which are generative or agentic and so outside SR 26-2
• Identify your enforcer for consumer financial law: the CFPB above $10 billion in total assets, your prudential regulator at or below
• Test that adverse action reasons match the features that actually drove each credit decision
• Keep disparate impact testing running while the Regulation B litigation is pending
• Re-paper AI vendor contracts against the GLBA service provider standards and your incident deadline
• Comment on, or at least read, the third-party risk proposal before November 16, 2026
• Map Colorado lending decisions and draft the ADMT notice before January 1, 2027
• Add FinCEN’s deepfake red flags to identity verification and SAR procedures
• Credit unions: document how you validate vendor models, since NCUA lacked authority to examine technology service providers as of GAO’s 2025 report

Where to read more

SR 26-2, Regulation B, and the NYDFS letters are covered in depth in the financial services guide. Colorado SB 26-189 sits in the state law guide, and the high-risk duties and Omnibus dates in the EU AI Act guide. A model risk team building a program from scratch can map it to NIST and ISO through the governance frameworks guide.

This page is general information as of October 2026, not legal advice; confirm current requirements with counsel or your primary regulator.