Connecticut's Banking Department Says It Plans to Review the AI Systems of the Entities It Regulates During Supervisory Examinations

On September 22, 2026 the Connecticut Department of Banking issued regulatory guidance headed "Governance of Artificial Intelligence Systems." It is addressed to all Connecticut-chartered financial institutions and other entities licensed or regulated by the department, which it calls "Regulated Entities." It applies to AI systems used "in both consumer-facing and internal functions, including without limitation, compliance, risk management, underwriting, pricing, fraud prevention, marketing, and customer service."

An AI system, for this guidance, is "an automated system or tool that uses AI and materially influences business operations, risk management, or consumer-facing decisions of a Regulated Entity." Tools that use AI only incidentally, or whose output does not materially affect those operations or decisions, are outside its scope. AI built into a broader software product counts, third-party and software-as-a-service tools included, where it meets that materiality threshold. Conventional tools such as rule-based engines or static calculations that do not involve inference from data are not AI, and the guidance gives an example: "a model that infers credit risk from historical data is Artificial Intelligence; a spreadsheet that applies fixed debt-income thresholds is not." Parts of the guidance follow, not the whole.

A Framework and a Written Plan

The department "expects each Regulated Entity to develop and implement an effective governance framework" for its AI systems. The framework should be appropriate to the entity's size and activities and "proportionate to the scope, complexity, risk, and data sensitivity of the AI Systems used." Responsibility for developing, implementing and monitoring AI systems should be vested with senior management accountable to the board, and the board should take an active role in overseeing the entity's AI systems and its framework. Ensuring cybersecurity, privacy and the protection of consumer information "should be paramount," the guidance says, in developing, implementing, monitoring and overseeing AI systems, and entities should address those risks within their existing information security programs "rather than through a separate or parallel cybersecurity regime."

Entities should also create a written plan as part of documenting the framework, and the plan "may be part of an entity's overall risk management plan." It should apply to AI systems the entity develops itself, and should address risk management of AI systems "provided or supported by vendors in alignment with the Regulated Entity's third-party risk management program." Entities "may also consider current federal model risk management principles, including model validation practices, where relevant to their use of AI Systems," the guidance says. A footnote points to the revised model risk guidance issued jointly by the Federal Reserve, the FDIC and the OCC on April 17, 2026, and notes that generative and agentic AI "are outside the scope of the revised guidance pending further agency consideration."

What the Plan Should Cover

The components the guidance lists include policies and procedures for the full lifecycle of AI systems, "including development or acquisition, testing and validation, deployment, monitoring, material changes, and retirement or decommissioning," with appropriate controls that include pre-deployment testing, ongoing performance monitoring and "detection of model drift or degradation." They include processes for inventorying AI systems and for assessing and tiering their risks, and mechanisms for compliance with law that include "monitoring for potential unfair or discriminatory outcomes, consistent with existing federal and state fair lending laws."

On human oversight, the guidance asks for "Defined human oversight of AI Systems, including clear responsibility for AI-supported decisions, escalation protocols, and accountability for outcomes affecting consumers or regulated activities." Oversight "should be appropriate to the nature and impact of the AI System and sufficient to detect, review, and address errors, unintended outcomes, or potential consumer harm, including the ability to intervene, override, or take corrective action when warranted."

The test the guidance sets for human oversight is what it can do: detect, review, address and, when warranted, override. A sign-off that cannot do those things does not meet it.

For AI systems provided or supported by vendors, the plan should cover their governance, "including appropriate due diligence, contractual controls, audits, and ongoing monitoring throughout the relationship lifecycle." And documentation should be "sufficient to support internal governance, supervisory review, and examination readiness," including documentation of the AI system's purpose, data sources, risk assessments, testing and validation, monitoring, governance approvals and material changes.

Supervisory Expectations

Entities "are encouraged to engage proactively with the Department regarding emerging uses of AI Systems," the guidance says. The department plans to review AI systems, the entities' frameworks and written plans, "and related policies and procedures during supervisory examinations."

It also expects that AI systems "be transparent and explainable in a manner appropriate to their risk and consumer impact." At a minimum, the guidance says, entities "should be able to explain in a clear and concise manner whether AI Systems materially affect consumers and decisions regarding consumers."