Eight questions. Answer locations on one page.

Use the checklist beside your declared AI uses and supporting records.

The questions and supporting records.

Examiner question, paraphrased	Where your answer lives
Where does the institution use AI across products and internal work?	Use and Where it runs; cross-check the vendor and software registers.
Which AI systems, tools and uses has the institution identified?	Use and Owner; supporting declared-use register.
Does AI face customers or influence decisions?	Use; purpose, impact and output-review records.
Which AI capabilities rely on vendors or external platforms?	Where it runs and Evidence on hand; vendor register.
Where is AI embedded in vendor products, and what have vendors disclosed?	Evidence on hand and Question still open; vendor documentation.
Which generative AI or large language model tools are used?	Use and Where it runs; approved tools and use policies.
How are uses separated by risk, impact and review needs?	Owner and Evidence on hand; risk ratings and review records.
What customer, confidential or sensitive information enters or passes through AI?	Data it can touch; data controls and vendor terms.

CSBS framework and Core Examiner Guide, pages 3 and 4. Source checked October 4, 2026.

The checklist scope.

The CSBS framework is a guide for state examiners reviewing state-chartered banks and state-licensed nonbank financial institutions. Each state decides how to use the framework. The framework creates no new legal obligations or supervisory requirements.

National banks answer to the OCC. Credit unions use NCUA and applicable state supervision. One review covers declared uses, rather than an institution-wide census.

The answer-location mapping is a preparation recommendation, rather than CSBS text.

Download the checklist.

Download the one-page checklist PDF Read the checklist in HTML

Open the six-column evidence file.

The review boundary.

A review prepares a file. It does not certify compliance, give a legal opinion or connect to a core.