Connecticut Now Expects a Written AI Governance Plan From Every Bank and Licensee It Examines. State Examiners Got Their AI Playbook Six Days Earlier.

1. What did Connecticut’s Department of Banking issue on September 22, 2026?

On September 22, 2026, Connecticut Banking Commissioner Jorge Perez issued regulatory guidance titled Governance of Artificial Intelligence Systems, addressed to all Connecticut chartered financial institutions and all other entities licensed or regulated by the Department. It is five pages long. It tells every one of those entities that the Department expects an AI Governance Framework, expects a Written AI Governance Plan with seven specific components, and plans to review both during supervisory examinations.

Connecticut’s Department of Banking AI guidance is a supervisory expectation, issued September 22, 2026, that every Connecticut chartered bank and credit union and every Department licensee using AI that materially influences operations, risk management or consumer decisions maintain a proportionate AI governance framework and a written plan covering lifecycle, inventory and risk tiering, legal compliance, human oversight, training, vendors and documentation.

The guidance landed six days after the Conference of State Bank Supervisors released its AI Supervisory Framework on September 16, 2026. Read together, the two documents answer the question every small lender, community bank and licensee has been asking since generative AI showed up inside their core, LOS and CRM vendors. What will the examiner actually want to see? Connecticut says what it expects the plan to address. CSBS says how an examiner will scope the review, what documents they may request, and how to tier each use case.

The legal status matters, so it is worth stating plainly. Neither document is a statute or a regulation. Neither carries its own penalty, and neither sets a compliance date. The Connecticut text uses the language of expectation (“the Department expects” and “should”), not of obligation, even under its heading for required components.

The guidance makes AI governance an announced examination topic. Inadequate controls may lead to supervisory questions or findings under applicable examination standards, laws or safety and soundness principles, but the guidance itself does not establish a standalone violation. Throughout this article, “your next exam” is our readiness target, not an official deadline.

2. Who does the guidance cover, and what counts as an AI System?

The guidance covers every Connecticut chartered financial institution and every other entity licensed or regulated by the Department of Banking, and it applies to AI used in both consumer facing and internal functions. The text names compliance, risk management, underwriting, pricing, fraud prevention, marketing and customer service as examples. Venable’s October analysis reads that population to include state chartered banks and credit unions and the Department’s nondepository licensees, such as mortgage, consumer lending and servicing, money transmission and debt collection businesses. Treat those as examples, not an exhaustive list, because the Department’s remit is broader and also includes securities regulation.

Addressing every regulated entity does not mean every entity needs the same plan, or any invented use cases. The expectation is governance proportionate to an entity’s use of qualifying AI Systems. Our practical recommendation, not an express instruction from Connecticut, is that an entity concluding it has no in scope AI should document the inventory review and materiality analysis that supports that conclusion.

For the depository side, the population is small and concrete. The FDIC BankFind institutions API, queried October 19, 2026 for institutions with active status on that date and a Connecticut home state, returns 26 FDIC insured institutions. Twenty two of them carry a state charter. Using total assets reported for the June 30, 2026 quarter end, 17 of those 22 hold less than $2 billion, eight hold less than $1 billion, and the largest holds roughly $9.4 billion.

That subset excludes credit unions and every nondepository licensee, so it is only one slice of the population the guidance addresses. Vendor provided AI is an important use case for institutions like these, which generally lack large internal development teams.

The two definitions that decide scope

Scope turns on two footnoted definitions. “Artificial Intelligence” means a machine based system trained on data that generates outputs such as predictions, recommendations, decisions or content “by using computational techniques that enable inference from data.” The guidance expressly excludes traditional rule based engines, spreadsheet logic and static calculations that do not infer from data, and gives a clean example: a model that infers credit risk from historical data is AI, while a spreadsheet applying fixed debt to income thresholds is not.

“AI System” then narrows the field to an automated system or tool that uses AI and materially influences business operations, risk management or consumer facing decisions of the regulated entity. Tools that use AI only incidentally, or whose output does not materially affect those operations or decisions, are outside scope. That materiality filter is the most useful sentence in the document for a small institution, because it means an AI spelling suggestion inside your word processor is not an AI System for these purposes.

The same footnote closes the obvious loophole. An AI System expressly includes AI functionality embedded within a broader software product or service, including third party and software as a service tools, whenever that functionality meets the same materiality threshold. If your loan origination platform added a machine learning fraud score last year and your underwriters now act on it, that feature is in scope even though you never bought an “AI product.” Venable notes that “business operations” is not further defined, which gives the hook a broad reach beyond consumer decisions.

3. What does the Department expect the AI Governance Framework to include?

The Department expects the AI Governance Framework to include four components: board and senior management responsibility; cybersecurity, privacy and protection of consumer data; incorporation of best practices and standards; and a Written AI Governance Plan. Around those four, the guidance sets five qualities the framework should have. It should be proportionate to the entity’s size and activities and to the “scope, complexity, risk, and data sensitivity” of the AI used, establish clear roles, identify and manage AI risks within the overall risk program, incorporate recognized standards, and ensure compliance with applicable law.

Board and senior management

Responsibility for AI Systems and the framework sits with senior management accountable to the board, managing member or other governing body. The board is expected to take “an active role,” which the guidance defines as three things: enough understanding of AI to exercise oversight (advisors are expressly allowed), regular review of management reports on AI Systems, and confirmation that management has allocated enough resources. For a licensee organized as an LLC with a single managing member, that means the managing member, not a vendor, owns the answer.

Cybersecurity inside the program you already have

The Department calls cybersecurity, privacy and consumer data protection “paramount.” It also says something small institutions should welcome: these risks should be addressed “within their existing information security programs rather than through a separate or parallel cybersecurity regime.” You do not need a second security program for AI. You need your existing program to know where AI Systems sit, what data flows into them, and what happens if one is attacked or exposes nonpublic information.

The standards the Department names

The guidance points to the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) and its generative AI companion materials, Treasury and Financial Services Sector Coordinating Council AI deliverables, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and current federal model risk principles. Its footnote 4 also lists ISO/IEC 42001:2023, the AI management system standard, and the New York Department of Financial Services’ October 16, 2024 industry letter on AI cybersecurity risks. None is mandatory. The instruction is to review them and incorporate what fits your size, activities and AI use.

4. What goes in the Written AI Governance Plan?

The guidance says the Written AI Governance Plan should address seven components: lifecycle; inventory, risk assessment and risk management; compliance with applicable laws; human oversight; training and competency; third party risk management; and documentation. It may sit inside your overall risk management plan rather than standing alone, and it should cover both internally developed AI and AI “provided or supported by vendors” through your third party risk program. The plan is also expected to “support supervisory review and examination readiness,” which tells you who its intended reader is.

The right hand column is our suggestion for a small institution, not language from the guidance. It reflects the text’s repeated instruction that documentation and controls be “proportionate to the scope, complexity, risk, and data sensitivity” of the AI involved. A $500 million savings bank using one vendor chatbot and one fraud score should not produce the same binder as a $9 billion institution building its own models, and the guidance does not ask it to.

Component 3 deserves a second look from any lender. It asks for monitoring “for potential unfair or discriminatory outcomes, consistent with existing federal and state fair lending laws such as the Equal Credit Opportunity Act and the Fair Housing Act.” That expectation survives regardless of where federal disparate impact policy goes, a divergence we covered for Illinois lenders in our analysis of Public Act 104-0744. A state examiner can now ask how you check AI driven credit and pricing outcomes even when no federal agency is asking.

An inventory alone will not answer the whole supervisory question. The guidance closes with an explicit explainability expectation: “At a minimum, Regulated Entities should be able to explain in a clear and concise manner whether AI Systems materially affect consumers and decisions regarding consumers.” For each AI System, someone at your institution should be able to say in plain words what role it plays in consumer decisions, and whether a person or the system makes the final call.

5. What is the CSBS AI Supervisory Framework, and how will examiners use it?

The CSBS AI Supervisory Framework is a discretionary toolkit, released September 16, 2026, that state examiners can use to identify AI at state chartered banks and state licensed nonbanks, assess the associated risks, and decide when a deeper review is warranted. CSBS says the CSBS State Supervisory Processes Committee and Non Depository Supervisory Committee approved it in August 2026, and the component documents carry a Version 1.0 approval date of August 13, 2026. Each state agency decides how far to incorporate it.

It has five parts: a Core Examiner Guide (eight pages), an Examiner Work Program, Nonbank AI Supplements (eleven pages covering third party and vendor oversight, model risk and consumer protection), an AI Use Case Risk Tiering Worksheet, and a source support document. CSBS says it draws on the NIST AI RMF, the Cyber Risk Institute framework and the Treasury AI Lexicon. The press release adds that the framework “doubles as a resource for industry,” which is a polite way of saying the examiner’s checklist is now public.

The eight scoping questions

The Core Examiner Guide opens with eight initial scoping questions, IS-1 through IS-8. They ask whether the institution uses AI anywhere; whether it has identified its AI systems; whether AI is customer facing or influences decisions; whether it relies on third parties for AI; whether it has looked for AI embedded in vendor products; whether it uses generative AI; whether it differentiates use cases by risk; and whether customer or confidential data passes through AI.

The instruction attached to the first question is the one to plan around. A “negative or unclear response” to IS-1 “may warrant confirmation against the institution’s vendor inventory, software inventory, approved tools, and recent product or platform changes before concluding that the framework does not apply.” In plain terms, “we do not use AI” may be tested against your own vendor list. An institution may overlook AI introduced through a vendor product update rather than through a purchase decision.

6. How does the CSBS risk tiering worksheet sort your AI use cases?

The worksheet rates each AI use case on four factors, consumer impact, human oversight, harm potential from errors or outage, and data sensitivity, and the highest rated factor “should generally establish the preliminary tier.” The worksheet is optional. Institutions choosing to use it are instructed to “complete one worksheet per AI use case” and to “retain completed worksheets as support for examination requests,” and its own control list allows documenting risk with “the included risk tiering methodology above or other.” Connecticut expects risk differentiation and tiering but does not mandate this particular form. A different final tier is allowed with documented rationale, but any downward adjustment “should be reviewed and approved consistent with the institution’s governance process.”

These are worksheet examples, not mutually exclusive legal categories. Identifiable account or transaction information may itself constitute nonpublic personal information and call for the higher assessment, so do not treat the Tier 2 data row as a safe default.

The data sensitivity factor is where small institutions get surprised. Under the worksheet’s methodology, sensitive applicant information may drive a preliminary Tier 3 classification even where the task is internal and human reviewed, such as an AI tool that summarizes a loan file. Any lower final tier needs documented justification and appropriate approval. Tier 3 is a worksheet classification, not a legal finding that the use is prohibited, and a lower tier never authorizes entering protected customer information into an unapproved public tool; your privacy, security and approved tool rules still apply.

Suggested controls stack by tier

The worksheet lists nine suggested controls for every AI use case, eight more for Tier 2 and Tier 3, and seven more for Tier 3, and says they are cumulative. Tier 1 includes an inventory entry naming the business owner and purpose, a written acceptable use policy, vendor contracts that address AI risk with audit rights where a third party is involved, trained users, data quality controls, periodic management reporting and a documented risk level. Tier 2 adds pre deployment testing for accuracy and fairness, explainability documentation for consumer facing outputs, a tested adverse action process where relevant, an escalation path and complaint handling that captures AI issues.

Tier 3 adds ongoing monitoring of accuracy, fairness and fair lending outcomes, independent model validation by a qualified party, AI specific incident response procedures, consumer disclosures about automated decision making where applicable, and board or oversight body reporting. The worksheet is labelled an optional industry tool that “should not be interpreted as official regulatory guidance from a state agency.” It is still a concrete public description of what a state examiner may consider proportionate at each level.

7. How does state AI guidance differ from federal model risk guidance?

State AI guidance differs from federal model risk guidance mainly in scope and audience. On April 17, 2026, the Federal Reserve, FDIC and OCC replaced the 2011 model risk guidance with SR 26-2 (FDIC FIL-15-2026, OCC Bulletin 2026-13). The new guidance says it is “expected to be most relevant to banking organizations with over $30 billion in total assets,” states that it “does not set forth enforceable standards or prescriptive requirements,” and, per the OCC’s announcement, places generative AI and agentic AI models outside its scope. The same guidance says it may still be relevant to banks of $30 billion or less “that have significant exposure to model risk,” and its footnote adds that an organization’s risk management and governance practices should guide controls for tools the document does not cover. The exclusion is not permission to run generative or agentic AI without controls.

Connecticut’s footnote 6 notes exactly that carve out. So does the CSBS Core Examiner Guide, which says that “some existing model risk resources may not fully address generative AI, agentic AI, or similar capabilities” and that examiners may use the AI framework to fill the gap. The OCC said in April that the agencies plan a request for information on model risk and AI, including generative and agentic AI. Until then, state guidance such as Connecticut’s offers many small state chartered banks a concrete public description of AI expectations. The sequence is chronology; nothing in these documents says the federal revision prompted either state initiative.

All 22 of Connecticut’s active state chartered FDIC insured banks fall below the $30 billion line, but that does not categorically exclude them: SR 26-2 may remain relevant to a smaller institution with significant model risk, and it still describes sound practice for any model that drives credit decisions. For an institution of that size, the Connecticut guidance, read alongside the CSBS worksheet or another tiering method, is likely to be a central reference in its next AI conversation with an examiner.

8. What may an examiner ask for, and where do small institutions often fall short?

The CSBS Core Examiner Guide lists the documents examiners may request in four groups: governance and oversight materials, the AI inventory and use case documentation, generative AI policies and approved tool lists, and additional materials such as vendor oversight files, validation and testing, consumer facing compliance materials and internal audit work. CSBS says examiners may request these “as applicable.” Requests should be tailored to the institution’s use and risk, and even a small institution may receive requests across several categories.

Four items on the list can be hard for small institutions to produce. The first is a “list of vendor products or services with known or potential embedded AI capabilities.” The second is samples of recent consumer facing outputs that AI generated or assisted, with notices, chatbot transcripts and generated communications given as examples. The third is contract or service terms addressing “the use, retention, sharing, or training of AI systems on customer, consumer, confidential, or institutional data.” The fourth is change management records, because the guide asks whether governance keeps up “when AI systems, data, vendors, or operating conditions change.”

Generative AI and agents get their own section

The Core Examiner Guide devotes a section, GE-1 through GE-8, to generative AI and emerging uses. Examiners are pointed at whether tools are public, private, internally deployed or vendor provided; what data staff can enter; how outputs are reviewed; and whether the institution has identified risks “including inaccuracy, hallucination, prompt injection, and data exposure.” Procedure GE-8 covers AI that acts “with limited human direction” and asks how the institution defines permitted actions, human checkpoints, logging, reversibility, and “the ability to restrict or halt the system.”

That last procedure matters even for a five branch bank. If you have turned on an agent feature in a CRM or collections platform that can send messages or update accounts on its own, you should be able to show an examiner what it is allowed to do, where a human signs off, and how you would switch it off. Connecticut’s human oversight component asks the same question in different words: “the ability to intervene, override, or take corrective action when warranted.”

The nonbank supplements

Licensees also get the Nonbank AI Supplements, an eleven page document with three overlays that sit on top of existing exam resources. The vendor supplement asks whether contracts address data rights, usage restrictions, model updates, “disclosure of material incidents,” access to testing or audit information, and options to pause or revert. Its worked examples are familiar: a vendor provided AI underwriting tool may raise vendor, model risk and consumer protection issues at once, and a generative AI tool used by staff to draft consumer communications raises consumer protection and, if hosted externally, vendor oversight.

9. Does this matter if you are not in Connecticut?

Yes, because the CSBS framework is a national template and state regulators supervise most of the banking system. CSBS says in its September 16 release that state regulators “supervise 79% of all U.S. banks,” and CSBS operates the Nationwide Multistate Licensing System used to license nonbank mortgage, money services, consumer finance and debt businesses. Each state decides how much of the framework to use, but a mortgage company licensed in a dozen states now faces a published, common checklist that any of those examiners can pick up.

Connecticut moved within a week of the CSBS release and spelled out its own plan components, which is a concrete example of how a state can turn the discretionary toolkit into a stated expectation. White & Case wrote that many state regulators “will likely incorporate the Framework into their supervisory programs” even though it imposes no legal requirements. We would not predict which state follows next. A multistate licensee should be prepared to be asked for similar inventory and tiering materials in more than one exam.

The exposure is not only supervisory. The same use cases that show up on a CSBS worksheet as Tier 3, credit decisions, pricing and account status, are the ones state legislatures are regulating directly. Illinois codified disparate impact for lending effective June 1, 2027, as covered in our Illinois underwriting piece, and California’s 2026 signing wave added more AI duties that reach small businesses, sorted in our California roundup. Small RIAs face a parallel SEC conversation, described in our SEC policy guide.

10. What is a practical 90 day plan to reach a credible baseline?

A credible 90 day baseline for a small institution is an inventory, a documented risk tier for each AI use case, a short written plan covering Connecticut’s seven components, vendor AI questions in your due diligence, and one board briefing. That is a defensible starting point, not a safe harbor, and it should grow with your AI use. The sequence below assumes one accountable executive and a few hours a week from compliance, IT and the business owners.

Days 1 to 30: find the AI

Name the senior manager accountable for AI governance and tell the board you have done it. Pull your vendor and software inventory and send each critical vendor a short written question: does your product use machine learning, generative AI or agents, what data does it use, and do you train on our data? Survey staff on which public AI tools they use and for what. Log every hit in one register with owner, purpose, vendor and whether the output materially influences operations, risk or consumer decisions. If the review finds no in scope AI, document that review and the materiality reasoning behind it.

Days 31 to 60: tier and write

Assess and document each material use case using the CSBS worksheet or another suitable tiering methodology, and have the accountable executive approve every tier, especially any downward adjustment. Write the Written AI Governance Plan around Connecticut’s seven headings and keep it short and proportionate to the AI you actually use. Add an acceptable use policy for generative AI that states what data may never be entered into public tools. For any credit or pricing use, document how you check outcomes for fair lending risk, and write a plain language explanation of whether and how each AI System affects consumer decisions.

Days 61 to 90: close the vendor and oversight gaps

Add AI terms to vendor due diligence and to contracts as they renew: data use and training restrictions, notice of model changes, incident disclosure, audit or testing access, and an option to pause or revert. Renewal is a practical negotiation point, but do not wait for it when a live data or consumer risk is unacceptable; restrict, amend or suspend that use now. Confirm a human override path for every Tier 2 and Tier 3 use. Deliver a board briefing that covers the inventory, the tiers, and the open items. Then file everything where an examiner can find it, because the stated purpose of the documentation is “examination readiness.”

If you want a recognized structure underneath the plan, the Department’s own footnotes point to the NIST AI RMF and ISO/IEC 42001. An ISO/IEC 42001 aligned management system covers leadership, risk assessment, competence, operational controls and supplier relationships, which maps closely to the seven components, but alignment is supporting evidence of a sound program and not a substitute for answering the examiner’s specific questions.

This article is provided for general informational purposes and reflects the state of the law as of October 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.