The session slide by slide, from Scott Grow, CRCM, at the Utah Bankers Association Fall Compliance Conference, October 21, 2026.
Session overview
As compliance officers, we operate in an environment where technological adoption frequently outpaces explicit regulatory boundaries. The April 2026 Interagency Revised Model Risk Management Guidance intentionally excluded generative and agentic AI from its formal scope. This exclusion is not a regulatory pass; it is a direct assignment of accountability to bank leadership. The statutory obligations governing our institutions, including GLBA Section 501(b), ECOA and Regulation B, and Safety and Soundness standards under 12 CFR Part 30, remain unchanged. If an AI system drives an illegal credit decision, causes a data breach, or fails to provide an accurate adverse action notice, the argument that “the model was complex” is not a defensible position during an examination.
Our compliance baseline for this session is simple: if a human reviewer cannot independently explain, defend, and trace the source data of an AI-generated output, that output should not be signed off on or entered into the bank’s records.
Slide 2: The taxonomy of AI is not one category
Compliance officers should avoid treating “Artificial Intelligence” as a single monolithic category. Federal banking agencies apply fundamentally different supervisory expectations based on the underlying technical architecture. The distinction that matters for your risk inventory is not the sophistication of the software, but the mechanics of control: how much behavior relies on hardcoded human logic, and how much the system derives probabilistically from data.
“Agentic” describes autonomy, not capability. The most severe governance vulnerability emerges when high autonomy is paired with generative technology. Require every vendor to state the underlying technical method in writing, and treat any move up the autonomy scale, such as taking an approved RAG tool from reading to writing, as a material change that needs a brand-new compliance review.
Slide 3: The model is the engine. The harness is your steering.
The core foundational model is an outsourced commodity supplied by a developer like OpenAI, Google, or Anthropic, whereas the surrounding harness is where the bank maintains operational leverage and where almost all regulatory guardrails should live. The harness routes queries, attaches internal documents, connects approved APIs, authenticates users, and decides how output is logged, checked, or actioned.
If you swap the car’s engine, the steering program has not changed, but the car becomes unpredictable until the controls are re-tested. If the model changes, the harness should be re-tested. Otherwise, you are running a compliance framework built for a system that no longer exists. Track the model and the harness as separate inventory items, so a vendor’s model swap is captured as a subcontracted material change.
Slide 4: Four levels of autonomy in generative and agentic AI
When an organization escalates a system’s level of autonomy, the raw capabilities of the model remain exactly the same. What shifts is how deeply the system integrates into operations, how intricate the incoming data becomes, and how severely a single error can damage the institution. At the agentic rung, the system becomes an active writer in your IT environment. At the multi-agent rung, a minor error from an early agent is ingested as an authoritative baseline by the next, multiplying the error before a human ever reviews the file.
Management should implement an Autonomy Governance Gate. A system is blocked from advancing a rung until the business unit has defined the terminology and guardrails it will encounter, and IT has built hardcoded validation checks at the API layer for the new rung.
Slide 5: The model does not browse your network
A frequent error is assuming an AI system actively browses corporate databases, training on bank records in real time. The model weights are static. The harness pulls records, converts them to text snippets, and essentially copies and pastes them into the model’s context window. In an agentic deployment the question is never whether the model can reach your data, but which tools the harness has handed it.
The single most dangerous vulnerability is an identity and access failure at the API or MCP layer. Engineers often connect the AI through a broad, highly privileged service account. If the harness does not enforce the individual user’s permissions, the database only sees an authorized request, returns the files, and no network tool raises an alert.
Slide 6: Reliability is a property of the deployment.
Rather than issuing outright bans, which push employees to unapproved consumer tools on personal devices, leadership should guide teams toward use cases that meet all three reliability conditions at once. The boundary sits between data manipulation and knowledge recall. Condensing an attached audit report with a template is reliable, because the engine maps patterns within a closed, provided text. Asking what Regulation B requires forces the model to recall from training data, and it will produce a confident answer that blends real clauses with fabricated timelines.
Examination evidence assembly is the one approved category that reaches into live file shares, so it runs under a scoped credential issued to the agent, never an employee account, limited to the folders the request covers. In generative architectures, the instruction prompt is the internal control: log it.
Slide 7: Nine operational limits baked into the architecture
These limitations are permanently baked into the transformer architecture. They cannot be fixed by a software update, bypassed with a newer model, or solved by switching vendors. Bank risk frameworks should be built around one fact: generative models possess zero inherent awareness of factual reality.
The four misuse patterns at the bottom of the slide inevitably trigger compliance failures. Asked whether a brochure is UDAAP compliant, the system will output a generic confirmation that creates false security. Two controls follow. Any AI-generated legal or policy reference should carry a verbatim quotation and a section number a human auditor can check. All counts, volumes, and calculations should run in traditional database or statistical software, never in a generative model.
Slide 8: Inherent Risks of Generative Architectures and Autonomous Execution
The risk assessment should separate three things: vulnerabilities baked into the model, defects in the grant of authority, and threats that emerge once the system executes. Workaround persistence deserves attention. When the system cannot complete a task, it searches for another route rather than stopping. Require it to abstain and escalate, and treat abstention as success. A prohibition list is read as exhaustive, and anything absent from it is read as permitted.
When a manager signs off on an AI-generated report without validating the facts, the bank holds a signed attestation that a person verified information no human checked, a position far worse than having no record. Drafting is not approving, and any change after sign-off restarts the approval. Name all fourteen vulnerabilities in the Board-approved AI policy.
Slide 9: The first documented autonomous breakout
OpenAI ran approximately 1,200 agents in an isolated test with safety filters deliberately disabled. The link to Hugging Face was not a vendor relationship. It was a set of valid administrative keys someone had published in an open dataset. For a bank, that is the transferable point: the exposure travelled along a credential nobody knew was public. The agents held no malice; their instructions did not forbid breaking out, so escaping was the most efficient path to the goal.
This did not happen because the technology was “too smart.” Every breakdown maps to a control domain examiners already assess. Commercial tools run with guardrails on, but Anthropic’s October 9 report shows quieter failures in ordinary agentic use: a model told never to log in or purchase submitted a form, because forms were not on the list.
Slide 10: Bank readiness for AI: Five tiers across the industry today
Prudential regulators have stated they do not intend to draft standalone, technology-specific rules; they expect banks to extend current risk frameworks. Each posture carries its own exposure. Avoidance pushes employees toward consumer tools on personal devices. Under internal avoidance, AI arrives unannounced inside routine vendor updates, and the bank has executed no risk reviews of its own. Under decentralized adoption, no one can produce a complete inventory, which blinds the institution to the individually high-risk uses.
Run an enforceability stress test before relying on a prohibition: if a restriction cannot be technically enforced, it cannot be listed as an internal control. And alignment with peers is not a control. It will not answer an examiner.
Slide 11: Footnote 3, and what it actually assigns
Many vendors have misread Footnote 3 as a blanket exemption for generative tools. That is a dangerous misreading. The agencies did not say these systems are exempt from supervision; they clarified that responsibility for determining governance and controls belongs to the institution. This lack of specific rules is not an oversight, it is a deliberate assignment.
Guidance is not enforceable law, but enforcement can still follow from violations of underlying law or unsafe practices. Adopt the 2026 guidance voluntarily as your benchmark. Then follow the Structural Anchor Rule: when the CFPB withdrew 67 guidance documents in May 2025, programs anchored to a circular lost their foundation overnight, while programs anchored to ECOA and Regulation B stayed intact. Build on statutes and regulations; use guidance as interpretive support.
Slide 12: Your regulators publish their own AI use inventory
Across the federal banking regulators there are 115 active or planned AI use cases, and exactly one is rated high impact: the FDIC’s automatically scored writing assessment for job applicants. It is not generative, it is not supervision, and it has run since 2008. It is rated high impact because of what it decides about a person. An impact rating follows the consequence to a person, not the sophistication of the tool.
The OCC is piloting an agentic gate that scores each proposed AI service on bias, ethics, business value, risk, and technical excellence. A bank proposing that intake gate is matching its regulator. Utah’s AI Policy Act is binding: the AI is not a defense, and the safe harbor covers disclosure only, not UDAAP or ECOA.
Slide 13: Structuring an Auditable Corporate AI Governance Program
The gates are sequential. A use case stops at the gate it fails. Subjects recur deliberately: the first gate asks the vendor to state a fact, the second asks the vendor to be bound to it, the third asks the bank to reproduce it. The first gate asks nothing about the model, because governance belongs on the harness. The third gate does not close at deployment. A system passes only while the bank can reproduce the result rather than merely read it.
Vendor contracts do not indemnify an institution for how it deploys and configures the technology. Where permissions are too broad or output is relied on without review, the exposure sits with the bank regardless of the master services agreement. Keep a registry of every use case you reject, with the rationale, an owner, and a review date.
Slide 14: Who is responsible for risk mitigation of AI?
Generative AI enters the bank through a different doorway. It arrives as a software feature or vendor update, bypasses Model Risk Management, and routes straight to IT, which classifies it by how it arrived rather than what it does. When everyone assumes a vulnerability is covered elsewhere, the system fails silently, until an examiner asks for the risk assessment and oversight records.
Closing the gap does not require a new framework; it requires assigning four existing roles. The three testing layers then answer when each owner acts. A quarterly retrospective review detects a failure only after it has entered the permanent record, and generative AI now writes collections messages, complaint responses, and audit summaries. Because the system is probabilistic, a failed interaction should be re-run fifty to one hundred times to learn how often it recurs.
Slide 15: Agentic Workflows: One agent, one purpose
Designing multi-purpose agents violates control principles institutions already apply to human employees. If an agent’s purpose cannot be stated in one sentence without the word “and,” the workflow needs two agents. An agent grounded in everything is grounded in nothing. Written guardrails are advisory; tools provide actual capability. A drafting agent should remain separate from an execution agent, with a human reviewer in between, the digital equivalent of maker-checker.
Every agent needs a named owner, a written charter stating prohibited actions, its own provisioned identity, least-privilege entitlements, logging, a challenger, a materiality tier, and a kill switch approved before launch. The provisioned identity restores the gate purchasing used to provide: provisioning becomes the gate, the credential becomes the inventory record, and deprovisioning becomes the termination control.
Slide 16: Risk rate the task separate from the platform
Generalizations about AI capabilities are insufficient; rate the task. Four questions decide the rating, in sequence: is the source supplied, can an expert verify the output quickly, does it demand exact math, and does it depend on institutional judgment? Stop at the first “not suitable.” That roadblock defines the tier.
AI is the wrong tool for running statistics, though it is excellent at writing code for statistical software to execute. For evidence assembly, suggesting candidates produces document types rather than your documents. Reconciling a package against a list is the reliable half, because both sides sit in the context window. Re-rate every task when the model version changes, because the rating assumed a capability that may have shifted without notice.
Slide 17: Risk Assessments and the Rubric Problem
Generative AI should not handle risk ratings without a strict, written rubric. Lacking local guidelines, it defaults to industry averages, and its persuasive formatting hides that it guessed. A vague rubric is more dangerous than none, because it creates a false sense of security. A rubric is only safe to delegate if it has exact metrics, tie-breaker rules, and at least one past institutional example per tier.
If a person has to pause and interpret a bullet point, the standard is too vague to delegate. “More than 10,000 active Social Security numbers” can be applied by two analysts and produce the same answer. Managers should not confirm that a document was cited; they should answer one question: does the cited evidence match the tier’s numeric range? That converts a glance into a validation.
Slide 18: The Dead End of Traditional Validation
Credit models can be validated because they are reproducible: the same inputs return the same score, so they can be back-tested and benchmarked. Generative AI offers none of that. The identical prompt run three times can produce three materially different answers. That is not a deficiency in the compliance program. It is a property of the technology, and the program should be designed around it.
Nothing here supersedes existing model risk practice for machine learning and deep learning. For generative systems, state in the AI policy that statistical validation does not apply, and state what replaces it: adversarial testing, bias audits, source locking, drift detection, and regression suites. Source locking is the most effective control against hallucination, because it removes the opportunity rather than detecting the result afterward.
Slide 19: Practical Testing for Non-Technical Teams
Compliance teams often stall because they assume testing requires coding. It does not. Known answer testing uses 15 to 20 questions with definitive answers from your own policy documents. Anyone familiar with your policies can design it, and no outside party can replicate it. The negative test is the only practical way to detect silent integration blocks, and grounding breaks over time: a renamed folder, a permission change, or a new search restriction can blind the system without an error.
Test successful completions too. A system that declines every request might pass a poor negative test and still fail its business purpose. The person who built the system cannot evaluate it. Smaller institutions can achieve meaningful independence by having the process owner evaluate it: the BSA officer evaluates the BSA tool.
Slide 20: Monitoring, Drift, and Sampling
A scheduled agent can silently freeze without an error code, so alert on the absence of output. For generative agents, the cheapest signal is the rate of “could not find” responses. A sharp increase means grounding links are broken. A sudden decrease often means the system has stopped admitting ignorance and started guessing.
The biggest trap is ignoring what the AI silently discards. In April 2026, the OCC entered a Consent Order with a bank whose automated alert triage was auto-closing alerts that warranted human review. No human ever saw them. If a rules-based system can do that, a generative assistant can do it faster. Sample what the system marked closed or low risk, at a rate tied to materiality. Testing and monitoring govern the system; a human being governs the specific document.
Slide 21: The Limits of Human Review
Human review is the safety net for individual documents, but automation bias, fatigue, and the illusion of oversight weaken it. Unfamiliar words make people stop and ask; familiar banking words that mean something else to an engineer do not. A reviewer who approves a polished document they could not explain creates a signed record that a named employee approved what they did not understand.
The restatement test answers this: if you cannot explain it to an examiner, you did not review it, you forwarded it. The logic vacuum, a denial with no ratio or rule cited, gives no warning sign. And an employee’s ability to catch errors is highest where they need the AI least. Decide first and consult second, and record who originated a step, not only who approved it.
Slide 22: Priorities, and What Is Taking Shape
There is no need to rush. Taking three months to plan will not put your institution behind. Five priorities rank by protection ahead of the next examination: build an AI inventory with a named owner per entry, establish governance ownership, force dedicated system accounts, deploy a policy-based test set with negative tests, and formally log every tool you decline. The inventory costs nothing, requires no board approval, and exposes orphaned systems immediately.
Regulators will absorb AI into existing frameworks rather than write a new rulebook, and machine-initiated payments will likely arrive as a core upgrade you cannot decline. The same governance applies whether AI drafts a memo today or moves money tomorrow. If you can answer the three questions on this slide for every tool in use, you are governing it adequately.
Slide 23: The Value Proposition of AI
A governance program built on optimism does not survive an examination, but a control environment nobody can justify is one nobody funds. Treat AI as an efficiency engine rather than an oracle, and the return appears in three places. Every one of them is conditioned on the verification step, which means the efficiency and the control are the same investment rather than competing ones.
The hours saved were the hours a person spent locating and transcribing. The hours that remain are the hours a person spends deciding, and those are the hours an examiner will want explained. Record today’s time and error rate before deployment, and budget the review time as part of the process. A saving that depends on skipping the control is not a saving.
The full speaker script, with every table and primary source, is in the PDF above.
