How Do Bank Examiners View AI Underwriting Tools in 2026?

Short answer: bank examiners in 2026 view AI underwriting tools as workflow technology that has to be classified honestly, governed proportionately, and kept inside visible human decision authority. After April 17, 2026, the current supervisory guidance is no longer SR 11-7. It is the revised interagency guidance issued through SR 26-2 and OCC Bulletin 2026-13, with OCC Bulletin 2025-26 still shaping proportionality for community banks.

That means the first examiner question is what, exactly, the stack contains. Which parts are deterministic workflow software? Which parts are model-driven quantitative estimates? Which parts use generative features? If your bank cannot answer that cleanly, the control story will sound underdefined. Aloan is the AI-native commercial LOS built to answer that question by default: every extracted number carries a source-page citation, override history is preserved, and the deterministic, model-driven and generative components can be classified separately, which is the line the revised model definition turns on.

The good news is the standard is still practical. Community banks do not need a money-center model risk program for every analyst-assist workflow. They do need a documented inventory, a validation posture that matches the risk, a visible override path, and records that let an examiner reconstruct the file without calling the vendor. If you want the companion explainer on the April 2026 shift itself, read what OCC Bulletin 2026-13 means for community banks using AI in underwriting.

Model risk guidance is half of the exam picture. The credit side has its own rules that apply whatever technology sits behind a decision: adverse action reasons under Regulation B, which cover business credit, and Section 1071 small business data collection, which starts for covered lenders on January 1, 2028. This guide covers both, with the regulator documents linked so you can check every line against the source.

This guide expands the regulatory and readiness pieces of the AI-Assisted Underwriting Playbook into the version you would hand to a chief credit officer, model risk owner, or examiner prep team. If you need the workflow side next, pair it with AI underwriting use cases already in production, the AI underwriting implementation guide, and what examiners actually ask about AI in lending.

Section 01

Start with the question examiners are actually asking

Most banks still frame AI governance as a technology question. Examiners frame it as a control question. They are not trying to decide whether OCR is impressive or whether a language model can summarize tax returns. They are trying to decide whether the bank understands what this tool does, where it sits in the credit process, and what happens when it is wrong.

That distinction catches teams off guard. A lender says, "This tool only helps with spreading." Maybe. But if the spread feeds the global cash flow, the memo, the committee package, and the final recommendation, the workflow matters. Examiners want to know whether the bank can classify the moving parts, validate the model pieces, preserve the human review path, and explain what changed when the vendor updated production logic.

The current guidance gives banks a cleaner way to answer. Some underwriting components may be deterministic software. Some may be models. Some may be generative features that need separate controls because the April 2026 guidance explicitly leaves them out of scope. The hard part is not memorizing the bulletin. The hard part is documenting the product map clearly enough that a chief credit officer, internal audit, and an examiner would all describe it the same way.

Section 02

What changed when SR 26-2 and OCC Bulletin 2026-13 replaced SR 11-7

1. SR 11-7 is not the current guidance anymore

The revised interagency guidance issued on April 17, 2026 superseded and replaced SR 11-7. That matters because a lot of AI lending content, vendor decks, and even internal bank notes still talk as if SR 11-7 is the live guidance. It is not. If your documentation still frames examiner readiness as "SR 11-7 plus community-bank clarification," it is stale.

SR 26-2 also supersedes SR 21-8, the 2021 interagency statement on model risk management for BSA/AML systems. OCC Bulletin 2026-13 rescinds OCC Bulletin 2011-12, the Model Risk Management booklet of the Comptroller's Handbook, OCC Bulletin 2021-19, and OCC Bulletin 1997-24, the old examination guidance on credit scoring models. The Federal Reserve publishes the revised text itself as Supervisory Guidance on Model Risk Management. A bank policy that still cites any of those documents as current should be updated.

2. The definition of a model is narrower

The revised guidance defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. It also explicitly excludes simple arithmetic calculations and deterministic rule-based processes or software. That is a real shift for underwriting teams evaluating vendors that bundle workflow software, statistical estimation, and generative features into one product story.

3. The old habits still matter, even though the label changed

The revised guidance still centers the same serious disciplines banks should care about: model development and use, validation and monitoring, governance and controls, and considerations for vendor and third-party products. So the practical spine of examiner readiness did not disappear. The bank still needs documentation, a validation posture that matches the risk, monitoring after go-live, and governance that survives staff turnover.

The guidance is also explicit about its own weight. It "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization." Its first footnote adds the limit: "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." The adverse action rules below are law, so the non-binding status of the guidance does not reach them.

• Classification: know what part of the workflow is deterministic, what part is model logic, and what part is generative assistance.
• Validation: test model-driven outputs on your own document mix, especially the ugly files, not the vendor's clean demo pack.
• Monitoring: track overrides, regressions after vendor changes, and where the workflow breaks by form type or deal shape.
• Governance: preserve human decision authority, version history, and a record that lets someone cold-read the file later.

4. The guidance is expected to matter most above $30 billion, but smaller banks should not tune out

The revised guidance says it is expected to be most relevant to banking organizations with over $30 billion in total assets. That is important context, especially for larger regional and super-regional institutions building deeper model stacks. But the same guidance also says it may still matter for banks at $30 billion or less when model risk exposure is significant because of the prevalence or complexity of models, or because of activity outside traditional community banking.

The guidance is specific about why. Models at banking organizations of $30 billion or less "typically are subject to internal risk management and governance practices appropriate for the size and risk profile of these banking organizations," and generally excluding them "is consistent with a tailored supervisory approach." OCC Bulletin 2026-13 adds, in its note for community banks, that the guidance "is applicable to all community banks, subject to the limitations discussed in the guidance."

5. Generative and agentic AI sit outside the guidance, and bank governance still covers them

The guidance says generative AI and agentic AI models "are novel and rapidly evolving. As such, they are not within the scope of this guidance." The same footnote continues: "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document." It also says the principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."

For an underwriting stack, that splits cleanly. A trained classifier that scores risk is inside the guidance. A memo-drafting assistant, analyst chat, or document Q&A feature is governed by the bank's own risk management practices: usage rules, data handling boundaries, human review, and product-level controls. The agencies also say they plan to issue a request for information on model risk management that "considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models." The OCC 2026-13 explainer is the companion read on that split.

6. Vendor models stay inside the bank's model risk program

Section VII of the guidance covers vendor and other third-party products. It acknowledges that a bank "may not receive from the vendor the underlying code, data, or methodology that they would have if a model were developed internally," and then says: "Nevertheless, the principles of model risk management remain applicable." Sound practice, in the guidance's words, "includes developing an understanding of the vendor model, including its conceptual soundness, design, development data, and performance," along with "ongoing monitoring and outcome analysis to assess whether vendor models are accurate, remain fit for purpose, and continue to be reliable." Where a vendor model is customized for the bank, the adjustments are documented, justified and evaluated as part of validation.

Outcome analysis on a vendor tool needs the bank to see what the tool produced next to what its people accepted. In Aloan, every extracted figure carries a citation to the source page it came from, and an underwriter's correction is kept with the original value, the user and the timestamp. That gives the bank's validation team a record to sample from its own files instead of a vendor summary.

Section 03

What OCC Bulletin 2025-26 still does for community banks

OCC Bulletin 2025-26 did not get erased by the April 2026 update. It is still the clearest proportionality explainer for community banks. The bulletin says community banks can tailor model risk management practices, including the frequency and nature of validation activities, based on risk exposures, business activities, and the complexity and extent of model use. It also says OCC guidance should not be interpreted to require annual model validation.

That matters because smaller institutions can now read the stack more cleanly. Bulletin 2026-13 helps classify what is and is not a model. Bulletin 2025-26 helps decide how heavy the bank's validation and monitoring posture should be for the model pieces that remain. Read together, they push community banks toward a tighter answer than either one alone.

The real operating answer for community banks after April 17, 2026 is simple. First classify the workflow honestly. Then govern the model-driven parts with validation and monitoring proportionate to the actual risk. Then put generative assistance under separate data and review controls. That approach is easier to defend in examiner prep than either "everything is a model" or "nothing here counts because the vendor called it automation."

If you need a shorter practical summary for the credit team, the companion post on OCC Bulletin 2026-13 and community-bank AI underwriting is the best handoff note. This guide is the fuller examiner-prep version.

Section 04

Adverse action reasons still have to be specific when AI is in the file

The adverse action rule comes from the Equal Credit Opportunity Act and Regulation B, section 1002.9, and it covers business credit as well as consumer credit. The regulation says the statement of reasons "must be specific and indicate the principal reason(s) for the adverse action," and that statements based on "the creditor's internal standards or policies" or on a failure "to achieve a qualifying score on the creditor's credit scoring system are insufficient."

For business credit, section 1002.9(a)(3) changes how and when the notice is delivered. For a business with gross revenues of $1 million or less in its preceding fiscal year, the creditor follows the standard notice rules with some flexibility: the statement of the action taken may be given orally or in writing, and the right to a statement of reasons may be disclosed at application. For a business above $1 million in revenue, the creditor notifies the applicant of the action "within a reasonable time, orally or in writing," and provides a written statement of reasons if the applicant asks in writing within 60 days. Trade credit and factoring follow the second path regardless of revenue.

The CFPB applied that rule to AI in Consumer Financial Protection Circular 2022-03, published May 26, 2022. It said the adverse action notice requirements "apply equally to all credit decisions, regardless of the technology used to make them," and that ECOA and Regulation B "do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions." It also said "a creditor's lack of understanding of its own methods is therefore not a cognizable defense." The circular speaks of ECOA applicants generally and does not single out business credit.

Check the circular's status before citing it. The CFPB listed Circular 2022-03 among the guidance documents it withdrew on May 12, 2025, and said the withdrawal "is not necessarily final" while it reviews them. The circular's page on consumerfinance.gov is still published and carries no withdrawal notice. What was withdrawn is the CFPB's interpretation. The Regulation B text the circular quoted is unchanged in the current Code of Federal Regulations, so the specific-reasons requirement rests on the regulation itself.

In our view, the practical test for a commercial lender is whether the credit officer can write the principal reasons for a decline from the file: debt service coverage below policy, a global cash flow shortfall, collateral that does not support the request. Aloan does not make the credit decision and does not generate adverse action notices. Its part is keeping those facts traceable: every figure in the spread and the memo carries a citation to the page of the borrower document it came from, and the underwriter keeps the decision.

Section 05

What Section 1071 asks of small business lenders, and when it starts

Section 1071 of the Dodd-Frank Act amended ECOA "to require financial institutions to compile, maintain, and submit to the Bureau certain data on applications for credit for women-owned, minority-owned, and small businesses," in the words of the CFPB's Section 1071 page. The CFPB's rule implementing it is subpart B of Regulation B.

The compliance date has moved several times. The CFPB final rule published May 1, 2026 is effective June 30, 2026, and sets a single compliance date of January 1, 2028 "for all financial institutions that remain covered by the rule." It keeps a grace period running from January 1, 2028 through December 31, 2028. The CFPB's page also notes that court challenges to the 2023 rule remain ongoing in three jurisdictions.

The same rule narrows who and what is covered. It raises the origination threshold "from 100 to 1,000 covered credit transactions for each of two consecutive years," and whether a lender must start collecting in 2028 turns on its originations in 2026 and 2027, or 2025 and 2026 if it prefers. It changes the small business definition from gross annual revenue of $5 million or less to $1 million or less. It excludes merchant cash advances, agricultural lending, small dollar loans and Farm Credit System lenders. It removes the discretionary data points for application method, application recipient, denial reasons, pricing information and number of workers.

The CFPB retained the firewall in section 1002.108 "without modification." It "generally prohibits underwriters and other employees involved in making a determination concerning a covered credit application from accessing an applicant's demographic information collected under section 1071," with an exception where the institution determines that limiting access is not feasible and gives the applicant a specific notice. For a community bank where the lender who takes the application also underwrites it, that exception and its notice are the part to plan for.

Aloan does not file 1071 reports for the bank. Its part is the underwriting record that sits next to the 1071 data: the documents received, the spread, the memo and who approved it, with every figure cited to its source. The CFPB itself says that when regulators conduct fair lending examinations, "they analyze additional information before reaching a determination about an institution's compliance with fair lending laws." In our view, much of that additional information comes from the credit file.

Section 06

The decision authority matrix is where most programs become real

A lot of AI governance documents stay abstract because they never answer the only question that matters operationally: what, exactly, can the machine do without a human? If the answer is fuzzy, the control framework is fake. You need a decision authority matrix that maps each workflow step to the software role, the model role if one exists, the human role, and the required record. Then you need the product to enforce that matrix in code.

If you are evaluating tools for spreading, tax return analysis, or memo support, this matrix is the fastest serious filter. If a vendor cannot show how the product preserves original outputs, captures overrides, and prevents silent machine approvals, the exam conversation will get worse later. That is true whether the underlying feature is deterministic software, a model, or a generative assistant.

Section 07

The five examiner questions, updated for the current guidance

These are still the questions that separate banks that understand their control environment from banks that bought software and hoped compliance would sort itself out.

Section 08

What the examiner packet should contain before the exam starts

If you want the exam conversation to stay controlled, prepare the packet before anyone asks. The revised guidance names the inventory and documentation directly: an effective model inventory "includes sufficient information to understand model risks," and documentation supports "the tracking of recommendations, responses, and exceptions." A good packet usually includes the following.

1. Classified workflow inventory. Current production state, owners, decision authority, versions, and which parts are deterministic, model-driven, or generative.
2. Validation memo. Dataset design, document mix, accuracy results, override patterns, and conclusions about intended use. For vendor models, the bank's understanding of conceptual soundness, design, development data and performance, plus the outcome analysis it runs after go-live.
3. Decision authority matrix. Signed off internally and reflected in product controls.
4. Change management log. Version history, release notes, re-testing evidence, and approvals.
5. Operational monitoring. Override rates, exception trends, flagged edge cases, and remediation actions.
6. Third-party risk and data controls file. Data flow, training restrictions, retention, hosting posture, and security documentation for any AI or generative features touching borrower data.
7. Adverse action reasons file. For declined requests, the principal reasons given to the applicant and the file evidence behind each one, written to the Regulation B standard of specific reasons.
8. Section 1071 coverage assessment, where it applies. Covered originations for 2026 and 2027 against the 1,000-transaction threshold, and how the bank will firewall demographic data from underwriters or give the notice when it cannot.

From Aloan, the file-level pieces of that packet come out of the loan file itself: the document inventory with timestamps, the spread with every figure cited to its source page, override history with the original value, and the memo with its author and approver.

None of this needs to be enormous. That is still the point of OCC Bulletin 2025-26. A community bank should not be forced into a 200-page validation book for a narrow analyst-assistance workflow. But the artifact should be good enough that an examiner can follow the control logic without a tour guide.

Section 09

Where community banks still get this wrong

• They keep citing SR 11-7 as if nothing changed. It makes the documentation look old before the discussion even starts.
• They treat the whole product as one black box. Under current guidance, classification matters. Not every component is the same control problem.
• They confuse a vendor packet with a bank control framework. Useful input, wrong owner.
• They overfocus on average accuracy. Examiners care more about overrides, edge cases, update discipline, and whether humans can still show their work.
• They treat generative features as marketing frosting. If those features touch borrower data or committee materials, they need explicit controls.
• They treat model risk guidance as the whole exam. The guidance is non-binding by its own terms. Regulation B adverse action reasons and, for covered lenders from 2028, Section 1071 are law, and they apply whatever the model classification says.

The point is not to make the program look sophisticated. The point is to make it legible. Good community-bank AI governance should feel like a tight credit administration function, not a science project with a vendor login.

Frequently asked questions