New AI Risk Management Guides Can Help Community Banks

In February, the Treasury Department issued the first two of six planned resources to help banks navigate the risks and opportunities of AI: the AI Lexicon and the Financial Services AI Risk Management Framework. 

The resources reflect “a practical recognition” on behalf of the financial sector that AI can create “meaningful opportunities” for bank customers and employees by providing more efficient services, detecting fraud and creating new products. At the same time, it introduces risks that need to be understood, governed and controlled, says Leslie Watson-Stracener, partner, regulatory compliance and AML for Chicago-based Grant Thornton Advisors LLC.

“For community banks, the value is providing a common vocabulary and risk-based structure to enhance the benefits of AI, while mitigating the potential hazards for banks of all sizes, risk profiles and level of AI adoption,” Watson-Stracener says.

ICBA was involved throughout the entire drafting process and provided substantial feedback, says Anjelica Dortch, ICBA’s vice president of operational risk and cybersecurity policy.

“The community banks’ voice was heard on the initiative—and there’s more to come,” Dortch says.

Below, we look at each of the guides in turn.

The AI Lexicon

The AI Lexicon was developed to promote a shared vocabulary for communication and collaboration on AI-related matters in the financial sector, according to the Treasury Department. It was created by the Artificial Intelligence Executive Oversight Group, a public-private partnership formed by the Treasury in collaboration with the Financial and Banking Information Infrastructure Committee.

The AI Lexicon helps define key AI terms so executive leadership and bank managers in charge of risk, compliance and IT “don’t speak past each other” when it comes to risk management and technical concepts, says Watson-Stracener.

“Practically, the AI Lexicon assists senior leadership to speak the same language when creating AI governance policies and procedures,” she adds, “and helps translate technical concepts when conducting vendor due diligence.”

The other audience for the AI Lexicon is bank examiners, Dortch says.

“We know folks in the supervisory space are still learning about this technology,” she says. “When they have meetings with community banks, they need to understand and use shared terms, so everyone is coming from the same place.”

The Financial Services AI Risk Management Framework

The Financial Services AI Risk Management Framework adapts the National Institute of Standards and Technology AI framework to the specific operational, regulatory and consumer protection considerations of financial services, according to the Treasury.

The framework “provides practical tools and reference materials to help institutions evaluate AI use cases, manage risks across the AI lifecycle, and embed accountability, transparency and resilience into AI deployment decisions,” the Treasury writes. “The framework is designed to be scalable and flexible, supporting adoption by institutions of varying size and complexity.”

The framework includes a maturity scoring system whereby, through questionnaires, banks can gauge whether their internal controls are adequate based on their level of AI adoption, says Brendt Lauck, a manager in the risk advisory team at Eide Bailly in Minneapolis.

“As they scale up their controls and rigor, they will also have to strengthen their controls and oversight as they continue to grow their use of AI,” says Lauck, “including determining whether there is model drift causing hallucinations, or disparate impact from AI bias.”

Further AI exploration

Lauck says community banks are now “just getting their feet wet” with AI by using generative AI tools like Copilot, Claude or ChatGPT to read and summarize emails and to draft documents.

He also says community banks are using AI tools to automate file maintenance reports on daily batch jobs, pulling data from the core system to detail any changes in data fields within customer files.

Longer term, AI agents might be able to move money or perform other sensitive actions on behalf of customers, “but the industry has not caught up with this from a risk standpoint,” says Lauck. For one, “there needs to be a third-party AI agent accreditation process in place.”

The framework helps banks better understand the data behind an AI model by asking vendors the right questions, Dortch says. How did vendors train the large language model? What data elements are in it? What is the source? How old is it? Is the data outdated? Is it really going to help the model?

“Getting into agentic AI, it’s more about bankers asking themselves, ‘Should AI agents have full access to our banking system?’” Dortch says. “You have to assume customers are giving credentials to AI agents to bank on their behalf, so bankers need to ask themselves what they can do to protect the institution and customers.”

A big part of this is “identity orchestration”: granting limited permissions to AI agents, Dortch says.

“It’s fine to give access to an AI agent, but it needs to be limited, as we don’t want them to change a customer’s address, email or password,” she says. “It’s fine for them to move $100 a month from a customer’s checking account to their savings account, but banks also need to let customers know there are [more secure and] automated ways to do that in the system.”

Gaining confidence to take the next step

Grant Thornton’s 2026 AI Impact Survey Report of 950 business leaders, including banking executives, found there is a growing gap between organizations that are implementing strong AI governance and strategic frameworks and those that are not, Watson-Stracener says.

The financial institutions with strong frameworks in place are seeing more revenue growth and are scaling faster because they are confident in their AI strategy and proven controls, she says. 

According to the survey results, organizations with fully integrated AI were almost four times as likely to report AI-enabled revenue  growth as organizations still piloting AI—58% compared with 15%.

Yet among the industry leaders Grant Thornton surveyed, banking leaders were one of the least confident in those controls. 

“We will see AI transform countless aspects of banking, from credit approvals to anti-money laundering checks and financial reporting,” Watson-Stracener says. “Over the next few years, the community banks that have clear language and implement strong governance frameworks will be much more resilient and adopt AI deliberately rather than reactively.”

---