Decoding the US Regulatory Framework for AI in Banking: Carla Boo

Artificial intelligence (AI) has been used in the banking industry for several decades. AI decision making, machine learning based automation and chatbots are already here and have found their place in making banking more efficient and scalable.

What has changed is the complexity of our computing power and, of course, the generation of artificial intelligence.

In 2023, the US Senate hosted a series of educational briefings on artificial intelligence, including a classified briefing for all senators and nine
AI Insight Forums. In December 2023, the Financial Stability Oversight Council identified AI as an emerging risk, highlighting the seriousness with which regulators are taking the technology.

Congress views AI as a national security threat, and banking regulators have not introduced any AI-related regulations. Additionally, there is a strong focus on creating a framework for how AI systems should be designed and what security guardrails should look like. These concepts should be included in all AI adoption strategies in financial institutions.

There are also some common themes emerging in the areas of consumer protection and data privacy that could form the basis for best practices in AI-based products or services. In this blog, I discuss what financial institutions can learn from existing frameworks and guidance, as well as some thoughts on how the US approach to AI regulation differs from the European one.

Regulations on the implementation of AI in banking: what we know

As AI use cases move from simpler to more complex tasks, bankers and banking regulators are concerned about business risks. A 2024 survey of 127 US banking professionals found that 80% expressed concern about the potential for bias in general AI models and therefore decision making; 77% for degradation customer trust and transparency; 73% are about exposing customer data or creating vulnerabilities for cyber attacks.

Similar concerns are evident in the rules being debated during legislative sessions. Congress has already submitted more
40 AI-related bills in 2024focusing on common themes to ensure responsible and safe use of AI across the country. The following are topics relevant to the financial industry and related regulatory changes in the United States:

Privacy and data protection: Banks and credit unions hold a treasure trove of personal data, and there is an increasing desire to ensure that this data is adequately protected. The latest congressional efforts lay the groundwork for what could eventually lead to a national privacy law in the US, a development that has been years in the making.

The Biden administration further emphasized this need with an executive order in late 2022, coinciding with the promulgation of
AI Bill of Rightswhich serves as guidance for protecting privacy and civil rights while ensuring AI tools are fair and accurate.

Transparency and efficiency: For banks and credit unions, the biggest concern is the Consumer Financial Protection Bureau (CFPB). Their recent focus on chatbots highlights the potential dangers of artificial intelligence in customer service, including deceptive practices and customer frustration. Therefore, financial institutions using AI-powered chatbots must be especially vigilant about transparency and efficiency.

Accountability: Ensuring accountability of AI systems is a top priority, especially in sensitive areas such as credit scoring. The goal is to protect against bias and discrimination by ensuring that AI decisions are fair, transparent and equitable. In particular, financial institutions must consider a broader range of regulatory implications when implementing AI:

Third party risk assessment: Perhaps most critically, regulators are focusing on third party risk management. As banks increasingly rely on external AI providers, robust oversight and risk mitigation strategies for these partnerships are essential.

Regulatory direction: comparison with the EU Artificial Intelligence Act

The European Union sets the pace worldwide with its Artificial Intelligence Act, which is recognized as the most comprehensive AI framework today. This law is intended to regulate high-risk artificial intelligence systems, with a particular focus on banking. The AI Act classifies AI applications by risk level and sets strict rules to ensure transparency and accountability. The EU Artificial Intelligence Act is expected to have the most global impact due to the size of the European market and its wide reach in other parts of the world.

The current US approach differs from the EU approach in the following ways.

Globally, the challenge for each region will be to keep pace with rapidly evolving technological developments and harmonize risk management internationally.

Future prospects

Looking ahead, several trends are likely to shape the future of AI regulation in US banking:

Harmonization of standards: Probably will strive for AI harmonization cross-border regulation, which facilitates the work of banks around the world. Organizations such as the Global Partnership on Artificial Intelligence (GPAI) could lead the charge here, creating a unified approach to AI oversight.

Explainability and transparency: Future regulations are expected to emphasize the need for explainable AI. In banking, this means that artificial intelligence systems must have crystal clarity about how they make decisions.

Ethical Framework for AI: Greater emphasis will be placed on ensuring that
AI is used ethically in banking. This means developing frameworks to prevent bias and ensure AI systems are consistent with societal values and norms. This will include a framework to ensure non-discrimination, fairness and protection of human rights.

Conclusion

AI is rapidly transforming the banking industry, and the regulatory framework must evolve to keep pace. By staying ahead of these trends, banks and other stakeholders can navigate the complexities of AI regulation and unlock its full potential. The key to success lies in balancing strict compliance with the spirit of innovation.