What Regulators Expect When an Institution Uses AI in Lending

Institutions that use AI in their lending processes frequently ask what regulators expect. The answer is less novel than the question implies. Regulators expect the same things they have always expected from institutions that use models in credit decisions: documented purpose, validated performance, defined accountability, and the audit evidence required to demonstrate that the institution is managing the tool responsibly.

Federal banking agencies revised their model-risk-management guidance in April 2026. The revised framework — issued jointly by the Federal Reserve (SR 26-2), OCC, and FDIC — supersedes and replaces SR 11-7 and emphasizes a risk-based approach tailored to an institution's size, complexity, model usage and risk profile. Whether a particular AI or machine-learning tool falls within model-risk guidance depends on the technology and its use; generative and agentic AI are expressly outside the scope of the 2026 model-risk guidance and require governance appropriate to their distinct risks. Institutions should determine the appropriate governance classification for each AI tool before production use, and should confirm the applicable framework with qualified counsel given the April 2026 changes.

For consumer and small business credit processes subject to ECOA and Regulation B, explainability is a compliance requirement, not a best practice. When an AI tool informs an adverse action, the institution must be able to provide the principal reasons for the action in terms that satisfy the applicable disclosure requirements. The CFPB has addressed this directly in the context of AI-generated adverse action notices. Institutions that deploy AI in consumer credit processes without addressing explainability have a documented compliance gap. Commercial credit processes carry different adverse action requirements under Reg B — institutions should confirm the applicable standard with counsel for their specific use case.

Fair lending compliance applies to AI-assisted credit processes. Institutions should be aware that the applicable legal framework has changed materially. In April 2026, the CFPB issued a final rule amending Regulation B, including removing the effects test and stating that ECOA does not recognize disparate-impact liability under the statute. In July 2026, the FFIEC updated its ECOA examination procedures to reflect that change. The current scope of disparate-treatment and disparate-impact requirements under ECOA, Regulation B, and other federal and state fair-lending authorities should be confirmed with qualified legal counsel before deploying AI tools in any credit process subject to fair-lending requirements. This article does not state current law, and institutions should not rely on it for compliance purposes. What remains applicable regardless of the current disparate-impact framework is that AI tools trained on historical data can reflect historical credit patterns, and that institutions are expected to test and monitor AI-assisted credit processes for fair-lending compliance as part of their model risk management program. The specific testing methodology and applicable legal standards should be confirmed with counsel in light of the April 2026 and July 2026 regulatory changes.

Human accountability is a governance requirement, not a per-transaction operational rule. The 2026 revised model-risk-management guidance and the 2021 Interagency AI/ML Statement both require that institutions maintain clear lines of responsibility for model risk management — including defined ownership of model validation, ongoing monitoring, and the decision to deploy or retire a model. Each AI-enabled credit process should have clearly assigned institutional ownership, approved decision boundaries, monitoring and exception responsibilities. Where human review is required by law, policy, risk classification or the approved operating design, that review should be explicit and evidenced. What examiners look for is evidence that a responsible individual or function owns the model's performance and can demonstrate that the institution's use of the tool is understood, monitored, and controlled.

Institutions that build these requirements into their AI deployment process before an examination are in a fundamentally different position than those that address them after a finding is written. The requirements are not new — they are the existing framework, now updated and applied to a new class of tools. Institutions that treat AI governance as an extension of their existing model risk management program — and that account for the distinct governance requirements of generative and agentic AI outside that framework — will be better prepared when examiners ask for the documentation.