TL;DR
AI governance in banking means owners, independent checks, controls and records for every AI system behind a credit, fraud, AML or customer decision. In the US, SR 26-2 replaced SR 11-7 on 17 April 2026 and sets model risk expectations, mainly for banks with over $30 billion in assets. That guidance is not enforceable, and it leaves generative and agentic AI to the bank’s own governance. Fair lending law still applies to every model, so a declined applicant must get specific reasons that match what the model actually scored. Examiners expect clear lines of defense, validation before launch and a board that sees evidence rather than policy statements. In the EU, credit scoring becomes high-risk under the AI Act from 2 December 2027, supervised by the bank’s own financial regulator.
Key Takeaways AI governance in banking follows the decision a system shapes, so credit, fraud, AML, collections and chat each need their own controls. SR 26-2 replaced SR 11-7 and SR 21-8, but it is not enforceable and mainly targets banks with over $30 billion in assets. Generative and agentic AI sit outside SR 26-2, so the chat assistant still belongs in the inventory and the board pack. Regulation B still requires specific principal reasons when a bank declines an application, drawn only from factors the model actually scored. The OCC’s Heightened Standards give the three lines of defense a legal footing at large banks, so AI roles should map onto them. An examiner judges records, so keep an evidence pack of inventory, validation, minutes, adverse-action samples and monitoring results. Watch on YouTube
AI Factory Framework: How Enterprises Scale AI to Production in 2026
Kanerika walks through how enterprises move AI from pilot to production, the stage where a bank’s inventory, validation and monitoring controls have to be in place.
The Footnote That Hands Generative AI Back to the Bank
Footnote 3 of the revised interagency model risk guidance opens by calling generative AI and agentic AI models “novel.” A few words later the agencies close the door: “As such, they are not within the scope of this guidance.”
The very next sentence hands the work back to the bank: a banking organization’s “risk management and governance practices should guide the determination of appropriate governance and controls” for anything the guidance leaves out. So the chat assistant, the drafting tool in financial crimes and every AI agent now run on standards the bank writes itself.
Picture the first morning of an exam. The examiner asks for the AI inventory. But the list stops at credit and fraud models and skips the assistant that talks to customers all day. Nobody broke a rule, yet the bank still cannot show who approved the system its customers meet most.
What AI Governance in Banking Means, and What a Bank Has to Prove
AI governance in banking is the set of decision rights, independent challenge, controls and records a bank applies to its AI. It covers each system that touches a credit, fraud, AML, collections or customer decision. The records matter as much as the controls, because a supervisor can only judge what it can read.
Governance also follows the decision, not the technology label. For example, a gradient-boosted credit model, an AML alert ranker and a generative chat assistant can share one cloud platform. Still, each answers to different rules and a different owner.
Banking activity Decision the AI shapes What an examiner asks to see Credit underwriting Approve, decline, price or set a limit Model approval, validation report, adverse-action reason mapping Fraud detection Block, hold or release a payment Threshold settings, override log, false-positive and loss trends AML monitoring Which alerts an investigator works Tuning records, testing of alerts below the threshold, BSA officer sign-off Collections Who to contact, when and with what offer Policy limits, hardship handling, complaint trends Customer chat What the bank tells a customer Answer boundaries, transcripts, handoff and complaint records
The principles underneath, such as fairness and accountability, come from responsible AI , and the general model is laid out in our guide to AI governance . The data itself, however, is a separate layer with its own controls, and data governance in banking covers that side. This guide therefore stays with the AI systems and the people who answer for them.
AI Assessment
See Where Your AI Program Stands
Score your organization’s readiness across AI and ML foundations, generative AI and AI agents, and see which systems need governance attention first.
Start Your AI Assessment → What US Bank Supervisors Expect From AI in 2026
US supervisors have not written an AI rulebook for banks. Their expectations come from four sources with different legal weight. These are interagency model risk guidance, the OCC’s risk governance guidelines, fair lending law and third-party guidance, while a voluntary Treasury framework sits beside them.
SR 26-2: Who It Reaches and Where Your AI Falls
The Federal Reserve issued SR 26-2 on 17 April 2026, together with the OCC in Bulletin 2026-13 and the FDIC in FIL-15-2026 . It also supersedes SR 11-7 and SR 21-8. What the new guidance kept and changed is covered in our AI model risk management playbook , so this section sticks to who it reaches.
The agencies expect it to be most relevant to banks with over $30 billion in total assets, which is the first test of reach. Smaller banks with complex models, or with activities outside traditional community banking, may still find it applies. The OCC’s note to community banks also says the guidance applies to them, subject to its limitations.
The guidance is not enforceable either. Non-compliance with it “will not result in supervisory criticism,” in the agencies’ own words. But footnote 1 keeps the teeth, because unsafe or unsound model risk management, or a violation of law, can still lead to supervisory action.
In practice, scope is where banks feel the change. Credit scores, fraud scores and AML scoring stay in scope as non-generative models, while generative and agentic AI fall to the bank’s own governance. Two bank-specific changes came with it: SR 21-8, the BSA/AML statement, is now folded in, and the OCC rescinded its 1997 credit-scoring examination guidance.
Fair Lending Rules Do Not Care How the Model Works
Fair lending law applies whatever technique scores the applicant, because the Equal Credit Opportunity Act and Regulation B never mention one. In May 2025 the CFPB withdrew its 2022 and 2023 circulars on adverse-action notices, but the regulation text did not change. The adverse-action section below walks through what that text demands of a model.
Third Parties: The 2023 Guidance Still Applies, a Replacement Is Proposed
For now, SR 23-4 , from June 2023, remains the interagency guidance on third-party relationships. On 11 September 2026 the agencies proposed a replacement tailored to the level of risk. Even so, it keeps the principle that a third party does not reduce the bank’s responsibility.
SR 26-2 also keeps vendor models inside model risk management, even when code, data or method are proprietary. So the questions a bank sends an AI vendor carry real weight. Our AI vendor risk assessment guide lists the ones a standard security questionnaire misses.
Treasury’s FS AI RMF Is a Tool, Not a Rulebook
Treasury released the Financial Services AI Risk Management Framework on 19 February 2026 . It adapts the NIST AI RMF to financial firms through four documents, from an adoption-stage questionnaire to a risk and control matrix. It is voluntary, yet it fits the generative AI layer that SR 26-2 leaves out. Our NIST AI RMF comparison shows how it maps to the main ISO standard for AI management systems.
Source Type Who it reaches What an examiner can ask for SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026 Interagency guidance, not enforceable Mainly banks over $30B; smaller banks with significant model risk Inventory, validation, monitoring and governance records for in-scope models OCC Heightened Standards (12 CFR 30, App. D) Guidelines under 12 CFR Part 30 OCC banks with $50B or more in average assets Risk governance framework, front line, risk and audit roles, board reporting Regulation B, 12 CFR 1002.9 Regulation Every creditor Adverse-action notices with specific principal reasons SR 23-4 and the September 2026 proposal Guidance, while the proposal is not final All banks using third parties Due diligence, contract terms and ongoing vendor monitoring Treasury FS AI RMF Voluntary framework Any financial institution Nothing by itself, although it works well as a control map
In general, the compliance operating model around these sources looks similar in any industry. Our posts on AI governance, risk and compliance and AI compliance cover it, while the rest of this guide stays inside the bank.
Checklist
AI Governance Checklist
A practical checklist for setting up AI governance, with the ownership, review and oversight steps a bank’s supervisors expect to see in place.
Get the Checklist → If Your Bank Is Supervised in the EU
Credit scoring of natural persons is high-risk under the EU AI Act. It appears in Annex III, point 5(b) , with an exception for AI used to detect financial fraud. After the amendment in Regulation (EU) 2026/1744 , those high-risk obligations apply from 2 December 2027.
Supervision also stays close to home. Under Article 74(6), the bank’s own financial supervisor acts as the market surveillance authority for AI tied directly to its financial services. Supervisors of credit institutions in the Single Supervisory Mechanism also pass relevant findings to the ECB.
In addition, the Act lets banks fold parts of the provider quality system and deployer monitoring into their internal governance under the Capital Requirements Directive. So an EU bank’s AI controls belong inside the governance it already runs, not in a parallel program. For everything else in the Act, see our EU AI Act compliance guide.
Three Lines of Defense for AI Inside a Bank
At large US banks, the three lines have a legal footing. The OCC’s Heightened Standards define roles for front line units, independent risk management and internal audit. They apply at OCC banks with $50 billion or more in average assets. Under them, the chief risk executive has unrestricted access to the board, while no front line executive may oversee an independent risk management unit.
SR 26-2 never uses the phrase “three lines,” so banks map AI roles onto the structure they already run. A general AI governance framework stops at policy, but a bank needs a named function in every box.
First Line: The Business Owns the Use Case
The lending, card or deposit business that profits from a model owns its risk. So it proposes the use case, sets the appetite and then lives with the overrides. Model developers sit here too, even when they report to a central data science team.
Second Line: Model Risk, Compliance and the BSA Officer
Model risk management validates and challenges every in-scope model, while fair lending and consumer compliance review inputs, outcomes and adverse-action reasons. The BSA/AML officer also signs off on any model that decides which alerts investigators see. Operational and third-party risk then cover vendors, outages and resilience.
Third Line: Internal Audit Tests the System, Not the Model
SR 26-2 says internal audit generally does not duplicate development or validation. Instead, it checks whether model risk practices are rigorous and effective and whether policy is followed. In practice, audit samples the inventory, tests validation independence and traces a few decisions from end to end.
Where the Board and Risk Committee Sit
At the top, the board risk committee approves risk appetite and receives reporting. Many banks also run a model risk committee below it for approvals, conditions and exceptions. That committee is also where a disagreement between the first and second lines should end up, with minutes.
Activity Does the work Signs off Consulted Use-case intake and tiering Business line Model risk Fair lending, BSA officer Development and documentation Model developers Business line Model risk Independent validation Model risk validators Head of model risk Business line Adverse-action reason mapping Fair lending compliance Fair lending officer Model risk AML model tuning Financial crimes BSA officer Model risk Vendor model acceptance Business line Model risk Third-party risk Monitoring and breach escalation Business line Model risk Compliance Risk acceptance and exceptions Business line Model risk committee Second line Audit coverage of the AI program Internal audit Audit committee All lines
Treat the split as a starting point, because each bank sets its own owners and committees. Using AI to measure business risk, by contrast, runs the other way. Our post on AI in risk management covers that direction.
Kanerika Service
AI for Banking
Kanerika builds AI systems for fraud, credit and reporting with audit trails, access controls and governance built in from the start, so regulators can audit the controls.
Explore AI for Banking Controls for the Five Places Banks Use AI
Each use case carries its own supervisory worry, so one generic control set will miss at least one of them. The table below pairs each use case with an owner and the evidence to keep. Read it as implementation practice rather than a list of regulatory mandates.
Use case In SR 26-2 scope? Main supervisory concern First-line owner Core control Evidence kept Credit decisioning Yes Fair lending, accurate adverse-action reasons Lending business Permitted inputs, reason-code map, change approval Validation report, reason-code tests Fraud detection Yes Losses and customers wrongly blocked Fraud operations Threshold governance, override review Threshold change log, false-positive trend AML alert triage Yes, since SR 21-8 is folded in Missed suspicious activity Financial crimes BSA officer sign-off on tuning Tuning analysis, sampling below the threshold Collections Yes, unless the model is generative Unfair treatment of customers in difficulty Collections Policy limits, hardship flags Contact logs, complaint trend Customer chat and GenAI assistants No, so the bank’s own controls apply Wrong statements to customers, data exposure Digital channels Answer boundaries, human handoff, logging Transcripts, incident log
Credit Decisioning
Credit models need a list of permitted inputs, a named person who can override a decision, and approval before any retrained version reaches production. The reason-code map gets its own section below, because that is where examiners dig deepest.
Fraud and AML Alert Triage
SR 21-8 now lives inside SR 26-2, so AML models get the same validation and monitoring as credit models. A change to an alert threshold therefore counts as a model change, while the investigator keeps the final disposition. For how these models work, see our guide to AI in fraud detection .
Drafting a case narrative with generative AI, on the other hand, falls outside SR 26-2. Nothing in that guidance forbids it, but the bank’s own rule has to say who reviews each draft before anyone files it.
A pattern from outside banking shows how human review and AI can share this work, even though the client is not a bank. In Kanerika’s rental transaction risk project for a property management company, a rule engine flags anomalies and an Azure OpenAI layer reasons over each one. Business users then decide, and their decisions feed governed rule changes. The work surfaced about 500 findings in six risk categories, worth roughly $1.2 million in potential exposure. The case study marks those figures as subject to validation.
Case Study
Detecting Rental Transaction Risk Early With AI-Powered Risk Intelligence
For a property management company, Kanerika paired a rule engine with an Azure OpenAI reasoning layer and human review, surfacing about 500 findings worth roughly $1.2M in potential exposure (subject to validation).
Read the Case Study → Collections
Collections models recommend whom to contact, when and with what offer. So keep those recommendations inside written policy limits, flag hardship and vulnerability, and have consumer compliance review any script a model selects. Because a collections model is neither generative nor agentic, it stays inside SR 26-2, so it goes through the same validation and change approval as any other in-scope model.
Customer Chat and GenAI Assistants
The chat assistant is where SR 26-2’s scope gap bites hardest, because it talks to customers directly. First, set answer boundaries for account data and credit-sounding promises, then log every exchange, capture complaints and send hard cases to a person. Our post on agentic AI in financial services covers agent adoption, and our generative AI services page shows how assistants get built.
Defending an AI Credit Decision Under Regulation B
Regulation B is where an AI credit model meets an enforceable rule, because it applies every time the model says no. The rule is short, but it reaches deep into how the model is built and stored.
What the Rule Requires
Under 12 CFR 1002.9 , a creditor has 30 days after a completed application to tell the applicant what it decided. When it declines, any statement of reasons must be specific and give the principal reasons. In other words, a line saying the applicant missed a qualifying score on the creditor’s scoring system is, in the regulation’s own word, “insufficient.”
The official interpretation also adds two limits that matter for machine learning. First, disclosing more than four reasons “is not likely to be helpful” to the applicant. Second, for a scoring system the reasons must relate to factors actually scored, with no principal reason left out. The withdrawn CFPB circulars restated these points, yet the regulation itself still says them.
The Evidence Chain Behind One Declined Application
Imagine an examiner picks one applicant your bank declined last March. You should be able to rebuild that decision from stored records alone, without rerunning anything.
Link in the chain What is stored Owner Application record Inputs as received, with a timestamp Lending operations Feature values The exact values the model saw Model development Model version and cut-off Version ID, score and the policy threshold in force that day Model risk Attribution output Each factor’s contribution to the score Model development Reason-code map The approved translation from factor to reason Fair lending compliance Notice The text sent and the date it went out Lending operations
Each link has one owner, so a gap shows up as a missing record rather than an argument. When the model version in the notice archive differs from the version that scored the file, the chain is broken.
Testing That the Reasons Match the Model
An attribution score explains the math, but it is not the reason the applicant reads. The reason-code map that turns one into the other is a compliance-reviewed artifact, and explainable AI methods only help when that map is tested too.
Test stability first, so similar applicants get similar reasons, then check overrides and decisions that combine several models. Finally, run a disparity review that compares outcomes across groups and looks for proxies for protected traits. No universal numeric threshold exists for that review, so document the method and the decision.
What Independent Challenge Must Settle Before a Bank Ships AI
Independent challenge earns its keep at the release gate. A system should ship only when the second line can answer six questions with records.
Is the tier recorded, along with the materiality behind it? Are validation findings closed, or is use limited until they are? Has fair lending signed off before any credit use? Has the BSA officer signed off on any AML model? Can the bank see enough of a vendor model to validate it, since SR 26-2 expects that? Are monitoring thresholds set, and can a named person roll the system back? Thresholds such as an acceptable drift level or override rate are calibrated by each bank, because no regulator publishes them. Validation methods for ML models, LLMs and agents are in our model risk management guide . Meanwhile, machine learning governance covers the MLOps controls behind a rollback.
What the Board and Model Risk Committee Should See
Bank boards have written AI policies faster than they can prove them. In Grant Thornton’s 2026 AI impact survey , 62% of banking respondents said their boards have AI governance policies or expectations, which sounds encouraging at first. Yet only 18% were sure they could pass an independent audit of their AI controls.
Half of the same group also said governance and compliance barriers limit AI performance. The banking subgroup is 50 respondents, so read these numbers as a direction rather than a precise measure. Either way, the gap they point to is between policy and proof.
A One-Page Reporting Pack
A good board pack shows evidence rather than activity, so every line has to point at a record. Each line below has a reason a supervisor cares and a trigger that forces a conversation.
Metric Why a supervisor cares Escalation trigger (illustrative) AI inventory by tier, including GenAI outside SR 26-2 Shows the bank knows what it runs When any unregistered system turns up Validation backlog and overdue findings Independent challenge keeping pace When high-tier findings pass their due date Systems in use under conditions Risk taken knowingly, with limits When a condition passes its expiry Overrides and adverse-action exceptions Fair lending exposure When the override rate leaves the agreed range Fair-lending test results Disparate outcomes When a disparity has no explanation AML alert quality Missed or noisy alerts When productive alerts fall for a sustained period Chat incidents and complaints Customer harm from GenAI When complaints spike or data is exposed Vendor model changes Changes the bank did not make When a vendor changes a model without notice
A shared risk register makes this pack far easier to fill each quarter. For instance, our AI risk assessment template gives the fields and tiers, and AI governance tools can keep the inventory counts current.
What Leading Banks Disclose
Markets also judge AI governance in banking from what banks publish. For example, the Evident AI Index for October 2026 ranks 50 large banks. In it, transparency of responsible AI activities is worth 10% of the score, while model risk talent counts under the talent pillar. Overall, JPMorganChase, Capital One and RBC took the top three places.
Building the Evidence Pack an Examiner Will Ask For
An exam goes faster when the evidence already sits in one place. Rebuilding it from email threads and slide decks during the exam is how a sound program ends up looking weak.
An inventory extract with tier, owner and approval date for every AI system, GenAI tools included Validation summaries and the open findings list Committee minutes and signed risk acceptances Adverse-action samples traced to the model version that decided Monitoring results, as well as every threshold breach The incident and issue log Vendor files, contract terms and change notices The pack also has to show controls running, not just existing on paper. Record who reviewed, what evidence they used, what changed and when the issue closed. Data lineage from source to model output ties those records together, and in a Microsoft environment Microsoft Purview can hold much of that trail.
A 90-Day Start for a Bank’s AI Governance
Ninety days is enough to produce the artifacts a supervisor reads first. The plan assumes a model risk function already exists, so it adds AI to that function instead of building a new one.
Window Owner Artifact Done when Days 1-30 Model risk with the business lines AI list reconciled to the model inventory, with GenAI and agent tools flagged as outside SR 26-2 When every AI system has an owner and a tier Days 1-30 Model risk committee Charter updated to cover GenAI and agents When the board approves the charter Days 31-60 Fair lending One credit model run through the reason-code test When the test is documented and gaps are logged Days 31-60 BSA officer and model risk One AML model run through the release gate When the sign-off is on record Days 61-90 Chief risk officer First one-page board pack When the pack is presented and minuted Days 61-90 Internal audit Mock exam file When every gap has an owner and a date
The first window usually takes longest, because AI tools hide in business units and vendor products. Clean data governance makes that reconciliation faster, since owners and sources are already on record.
Watch on YouTube
Revolutionizing Data Governance for a Bank with Microsoft Purview
How Kanerika set up Microsoft Purview for a bank, building the data ownership and lineage records that make an AI inventory and evidence pack faster to assemble.
How Kanerika Supports AI Governance in Banking
Kanerika’s AI governance services follow the IMPACT approach. The service page spells it out as Identify, Map, Prove, Analyze, Create and Transform. In the page’s words, “Identify surfaces governance gaps before they become audit findings,” and “Prove tests governance controls on highest-risk systems first.”
The listed capabilities also line up with what bank examiners ask for. They include data lineage from source to model output, model impact assessments before deployment and a model registry with a full audit trail. Explainability reports and bias testing before launch, with monitoring after it, complete the set.
Validation stays independent of the build team, too. The page describes model validation as an assessment “conducted by a party separate from the development team”. It notes that this matters in banking, since model risk frameworks require independent validation before production.
Kanerika’s AI for banking work builds systems for fraud, credit and reporting “with documented controls regulators can audit”. Its MLOps consulting then keeps models monitored after release. On security, Kanerika holds ISO 27001, ISO 27701:2019 and SOC 2 Type II certification.
What Banking Clients Report
Client feedback on the AI for banking page shows what that delivery looks like. A Chief Data Officer at a regional retail bank says its AI pilots ran for over a year without reaching production. Kanerika then got the bank’s fraud detection model live in eight weeks “by fixing the data foundation first.”
A Chief Compliance Officer at a commercial banking group describes a similar shift in reporting. Monthly regulatory reports that used to take “three full days of our compliance team” generate automatically after the switch, with audit trails already attached. For an examiner, that attached trail is the part that counts.
Three gaps are worth checking first in any bank’s AI program, because each one is easy to miss. GenAI tools may never have entered the inventory because SR 26-2 left them out. Reason codes may come from a different model version than the one that decided, and vendor models may change without notice. To test your own program against these, talk to Kanerika’s team .
Kanerika Service
AI Governance Consulting Services
Kanerika’s AI governance services cover lineage, model impact assessments, a model registry with audit trail, explainability reports and bias testing, with validation kept independent of the build team.
Explore AI Governance Services The First Question an Examiner Will Ask
Expect a request along these lines early in any exam. Show the AI inventory, and then show who approved each system for its current use. A bank that answers with records rather than slides already has AI governance in banking working.
In 2026, supervisors expect four things in that answer. They want a complete inventory, including the generative tools SR 26-2 left out, and independent challenge before release. They also want adverse-action reasons that match the model, as well as a board that sees proof. Build those four, and the rest of the exam becomes a walk through files you already keep.
Frequently Asked Questions
What is AI governance in banking?
AI governance in banking is the set of owners, independent checks, controls and records a bank applies to every AI system that shapes a credit, fraud, AML, collections or customer decision. It covers who approves each system, how the second line challenges it, how it is monitored, and what evidence the bank keeps so a supervisor can review it.
Has SR 11-7 been replaced?
Yes. On 17 April 2026 the Federal Reserve, OCC and FDIC issued SR 26-2, revised interagency guidance on model risk management that supersedes SR 11-7 and SR 21-8. It is aimed mainly at banks with over $30 billion in total assets and does not set enforceable standards, although unsafe or unsound model risk management can still draw supervisory action.
Does SR 26-2 apply to generative AI in banks?
No. Footnote 3 of SR 26-2 places generative and agentic AI models outside its scope and says the bank’s own risk management and governance practices should guide controls for them. Chat assistants, drafting tools and AI agents therefore still need an owner, a tier, review rules and monitoring under the bank’s own framework.
Can a bank deny credit using an AI model it cannot explain?
Regulation B requires a creditor to give specific principal reasons for adverse action, and for a scoring system those reasons must relate to factors the model actually scored. A bank that cannot trace a decline to scored factors and a tested reason-code map cannot meet that rule, whatever modeling technique it uses.
Who owns AI risk in a bank?
The business line that uses an AI system owns its risk as the first line. Model risk management, fair lending compliance and the BSA/AML officer provide independent challenge as the second line, internal audit tests whether the program works, and the board risk committee sets appetite and receives reporting on the whole AI portfolio.
Does a bank have to validate a vendor's AI model?
SR 26-2 keeps vendor and third-party models inside model risk management even when code, data or methods are proprietary. Sound practice includes validating the vendor product, internally or through an outside party, and understanding its design, development data and performance. Using a vendor does not reduce the bank’s own responsibility for the outcome.
What will examiners ask for when they review a bank's AI?
Expect requests for the AI inventory with tiers and owners, validation reports and open findings, committee minutes and risk acceptances, adverse-action samples traced to the deciding model version, monitoring results, incident logs and vendor files. Banks that keep these records current can answer quickly instead of rebuilding evidence during the exam.
When does the EU AI Act apply to bank credit scoring?
AI used to evaluate the creditworthiness of natural persons is high-risk under Annex III of the EU AI Act, with an exception for fraud detection. After Regulation (EU) 2026/1744, those high-risk obligations apply from 2 December 2027, and the bank’s own financial supervisor acts as the market surveillance authority for that AI.
Do the OCC Heightened Standards cover AI?
The Heightened Standards in 12 CFR Part 30, Appendix D, do not name AI, but they set the risk governance framework, front line, independent risk management and internal audit roles for OCC banks with $50 billion or more in average assets. AI governance roles at those banks should map onto that existing structure.
Are the CFPB adverse action circulars on AI still in force?
No. The CFPB withdrew Circular 2022-03 and Circular 2023-03, along with dozens of other guidance documents, effective 12 May 2025. The underlying Regulation B text on adverse action notices did not change, so creditors using AI models must still give specific principal reasons drawn from factors actually scored.
