FFIEC Guidance and AI: What Examiners Ask For

Which FFIEC guidance applies to AI systems

The FFIEC has not issued a standalone AI examination handbook. Examiners instead extend three existing frameworks to AI and machine learning deployments. SR 11-7, issued jointly by the Federal Reserve and OCC in 2011, remains the primary model risk management standard and covers model development, implementation, validation, and governance. FFIEC IT Examination Handbook booklets, particularly Information Security, Architecture Infrastructure and Operations, Development Acquisition and Maintenance, and Outsourcing Technology Services, supply the technical control expectations. The 2023 Interagency Guidance on Third-Party Relationships, issued by the Federal Reserve, FDIC, and OCC, applies when a bank uses vendor-supplied AI models or platforms, covering risk assessment, contracting, and ongoing monitoring. None of these documents were written with generative or agentic AI in mind, so examiners interpret and apply them by analogy rather than by direct reference.

SR 11-7 and agentic AI: where the framework runs out

SR 11-7 was written for statistical and machine learning models with defined inputs, defined outputs, and stable versioning. It requires ongoing validation covering conceptual soundness and continued monitoring, concepts examiners still apply to AI systems. The gap appears with generative and agentic AI, where a system may chain multiple reasoning steps, select tools dynamically, and produce non-deterministic outputs. A static model inventory built for discrete, versioned models does not naturally account for an agent that composes different tools and data sources at runtime. Validation frameworks designed around fixed input-output pairs also do not map cleanly onto systems whose behavior varies by session. FFIEC guidance does not currently specify how to document runtime behavior, tool-call sequences, or decision rationale, leaving institutions to fill this evidentiary gap with internal control frameworks rather than a prescribed standard.

Third-party AI and the 2023 interagency guidance

Most banks access AI capability through vendors rather than building models internally, which puts the 2023 Interagency Third-Party Risk Management Guidance directly in scope. Examiners expect documented risk assessment and ongoing monitoring for AI vendors, particularly where the vendor is considered critical to the institution's operations. A specific complication is that foundation models are frequently updated by the vendor without the bank's direct control, for example through API version changes. This makes it difficult to maintain current validation evidence, since the underlying model behavior can shift between examination cycles. Institutions should treat vendor model update notifications as a required input to their ongoing monitoring process, not an optional courtesy from the provider.

Recent regulatory signals

In March 2021, the Federal Reserve, OCC, FDIC, CFPB, and NCUA jointly issued a Request for Information on financial institutions' use of AI, seeking industry input on governance, risk management, and explainability. That RFI has not been followed by binding AI-specific rules from these agencies. NIST published its AI Risk Management Framework in January 2023, which federal agencies reference as a voluntary resource, though it is not FFIEC-issued guidance and does not substitute for SR 11-7 compliance. OCC risk perspective publications have identified AI and machine learning adoption as an area of increasing supervisory attention tied to model risk, third-party risk, and operational risk, though without prescribing new mandatory requirements. Institutions should treat this area as one where interpretation currently carries more weight than fixed rules, and should confirm current expectations against the latest FFIEC and agency publications before relying on any specific interpretation.

How examiners map frameworks to AI evidence

The table below summarizes how the three frameworks typically translate into documentation and control expectations during an examination of bank AI systems.