Observation
A later procedure copy changes the second-review rule. Only the earlier version has supplied approval evidence.
For community banks, credit unions and the fintechs that serve them.
Know where AI touches your institution.
A two-week review of declared AI uses, permitted sources and evidence gaps. Your team keeps the inventory, owned actions and a board briefing.
Request a call See the complete examplePreparation for your review, not an exam result.
Fee fixed in writing after one working session.
Start with the AI Governance Starter.
Start here. Two weeks.
Declared uses, inspected sources and owned questions.
Before an exam, board question or vendor AI change, agree where your team looked for AI. We inspect permitted sources, explain missing or conflicting evidence, and prepare the record your reviewer needs.
The scope covers up to 10 declared AI uses, three vendor disclosures and two stakeholder sessions. Timing starts after agreed inputs and reviewer availability.
Read the Starter scopeYour team keeps
- Coverage and AI use records.
- Source versions and evidence gaps.
- Proposed tiers and assigned actions.
- Examiner mapping and a board briefing.
Your institution records acceptance and conditions separately.
How the review moves from input to decision.
Supplied
Your team declares uses, names the owner and supplies permitted sources.
Prepared
We inspect versions, explain gaps and prepare actions and the board briefing.
Reviewed
Your reviewer evaluates the evidence and records the institution decision.
The work behind the board briefing.
Illustrative inputs, not a client.
Assigned action
The procedure owner confirms which version controls and resolves the conflicting instruction.
Reopened question
A revised vendor disclosure expands data reach. Retain the earlier baseline and ask for handling and control evidence before activation.
The example includes the source register, open actions and a printable package.
Why examiners are asking now.
SR 26-2 excludes generative and agentic AI. The revised model risk guidance is most relevant above $30 billion.
Federal Reserve guidanceCSBS gives state examiners eight scoping questions and a document request list. It creates no new legal obligations. Each state decides its use.
CSBS frameworkThe interagency third-party proposal does not address AI-specific vendor risk.
OCC proposalCredit unions should use NCUA's AI resources alongside its 2026 supervisory priorities.
NCUA resources
Sources checked October 5, 2026. Read charter and regulator boundaries. One review covers declared uses.
Five specialist reviews when the question narrows.
Use the same evidence method for a specific decision. Choose the review that matches the question.
Same file, different question.
Pilot acceptance
Did the pilot pass every required test, including the ones that failed?
See this review rowSame file, different question.
Agent authority
Who approved what the agent can do, and who can turn it off?
See this review rowSame file, different question.
Renewal terms
What do both quotes cover for the same work, and which terms are still blank?
See this review rowSame file, different question.
Procedure version
Which version of the procedure controls, and which question is still open?
See this review rowSame file, different question.
Core-change reach
What does this core change touch, and what needs retesting before release?
See this review rowThe summary file your reviewer receives.
Illustrative inputs, not a client.
| Use | Where it runs | Data it can touch | Owner | Evidence on hand | Question still open |
|---|---|---|---|---|---|
| Vendor feature inside an existing platform | The vendor's service | Not yet declared | Not yet named | The proposal | Is the feature on by default, and can the institution turn it off? |
| Staff use of a public assistant on procedure text | A public assistant outside the institution | Not yet declared; must exclude member and account data | Not yet named | None | Which procedure version controls, and which questions stay unanswered? |
Institution decision: ________________________
Open the blank file and downloads. Read the work behind the board briefing.
Bring the question due for review.
- An exam request, board question, vendor AI change or pilot decision is on the calendar.
- An accountable owner can supply permitted records and coordinate reviewers.
- Your reviewer can evaluate findings and record the institution decision.
Start with a general business question. Keep confidential documents out of the inquiry.
Find your institution roleKeep the agreed file current each quarter.
After the initial review, your team supplies changed disclosures, policies and use records. We identify affected questions, prepare an owned review queue and update the supporting file after your reviewer responds.
Agree the baseline, update scope, reviewer and delivery dates in writing. Updates are supplied by your team; connected monitoring is outside this service.
Read the quarterly follow-on scopeWho does the work.
Stephen Bishop
Stephen works across community banking, core and digital platforms, and fintech partnerships. His career includes Jack Henry, Citi and operating leadership at OMB and Equs. He publishes The Vault and coauthored Know Your Agent.
Stephen on LinkedIn
Tony del Fierro
Tony served as Sound Credit Union's senior vice president and chief technology officer. His author biography describes Wells Fargo connectivity strategy. He focuses on institution-owned context and agent authority and coauthored Know Your Agent.
Tony on LinkedInKnow Your Agent.
Stephen and Tony examine who authorizes an agent, what it may do and who can stop it.
Read the sample chapter PDFTry the method.
Inspect procedure text, conflicting versions and open questions in the browser.
Try with illustrative inputsUse the review methods in approved Claude Code with the local Evidence Desk package. Keep the complete export for your institution reviewer.
Questions before the first review.
What evidence does the board receive?
A one-page briefing tied to the coverage record, source versions, evidence gaps and assigned actions. The institution decision remains separate.
Which regulatory route applies?
States decide how to use the CSBS framework for state-chartered banks and nonbanks. National banks use their OCC route; credit unions use NCUA resources.
Read the charter boundaries and examiner questionsHow is the fee agreed?
Source volume, preparation, review responsibilities and the handling route are agreed in a written scope.
Read the engagement boundariesThe institution owns the decision.
The summary points to the sources, reviewer observations and actions behind the briefing. Wait, narrow, or do not buy are valid answers.
A review prepares a file. It does not certify compliance, give a legal opinion or connect to a core.
Read how sources are handledTalk through the review question.
Tell us the trigger, deadline and accountable role. A person will reply within one business day.
Request a callPrefer email? info@llmsquared.com.