How to Answer Your Examiner's AI Questions
The question is coming. The only variable is whether you are ready for it.
Federal bank examiners have been asking about artificial intelligence in vendor systems for several years. What has changed is the specificity. Early inquiries were exploratory. Today, examiners arrive with structured questionnaires, targeted document requests, and a clear framework for evaluating what they find.
Community banks that have not prepared tend to respond the same way: they answer the question they wish the examiner had asked, rather than the one that was actually asked. That gap is where findings are made.
What Examiners Are Actually Asking
The questions vary by regulator and examination type, but they cluster around four themes.
Inventory and awareness
Does your bank know which systems use AI or statistical models? This includes vendor-provided systems. Examiners are not impressed by a bank that can describe its core system in detail but cannot name the model driving its fraud alerts.
Governance and accountability
Who at the bank is responsible for AI oversight? Is there a policy? Has the board been informed that AI-driven systems are in use? Examiners are looking for evidence that someone owns this, not just that someone is aware of it.
Validation and performance monitoring
Has the bank reviewed the vendor's model documentation? Is there evidence of ongoing performance monitoring? A model that worked well in 2021 may behave differently today. Examiners want to see that the bank is watching.
Risk management and escalation
What happens when a model performs unexpectedly? Is there a documented process for escalating concerns? Has the bank ever pushed back on a vendor about model behavior?
The Answers That Create Problems
There are three responses that consistently generate follow-up findings.
The first is "our vendor handles that." SR 11-7 and OCC 2013-29 are clear: third-party ownership of a model does not transfer the bank's governance obligation. Examiners know this. Citing vendor responsibility without evidence of bank-level oversight signals that no oversight exists.
The second is "we don't use AI." In most cases, this is factually incorrect. Fraud detection, credit scoring, loan origination, and BSA/AML systems at the vast majority of community banks are model-driven. Saying otherwise invites the examiner to demonstrate it, which is a worse outcome than acknowledging it.
The third is producing documentation that was clearly assembled after the examination began. Examiners are experienced at distinguishing a governance program from a governance response. A policy dated two weeks before the exam, with no evidence of board approval or operational implementation, does not satisfy the inquiry.
What a Good Answer Looks Like
A bank that is genuinely prepared can do the following without hesitation:
- Produce a model inventory that lists every AI-driven system in use, including vendor-provided ones, with the date it was added, the business function it supports, and the name of the internal owner.
- Pull a vendor file for any system on that list that includes the vendor's model documentation, the most recent third-party validation report, and a summary of the bank's own performance monitoring activity.
- Show a board resolution or policy document that acknowledges AI use and assigns governance responsibility to a named function or individual.
- Describe the escalation process if a model produces an unexpected outcome - not in theory, but as a documented procedure that someone has actually followed.
None of this requires a dedicated model risk function. It requires that someone made it a priority before the examination began.
Begin the Conversation
Ready to close the gap before your next exam?
BankFlow delivers examiner-ready AI governance for community banks in 90 days.
Book a Discovery CallThis article is for informational purposes only and does not constitute legal or regulatory advice. BankFlow recommends consulting qualified legal counsel for guidance specific to your institution.
Able Leadership LLC DBA The AI CEO