AI scoping records
Which generative AI tools are in use?
Include public assistants, enterprise copilots, vendor features, internal models and informal pilot use.
What examiners look for
The Work Program asks about generative AI in any form. Public chat tools are only one part of that picture. Enterprise copilots, vendor features, internal models, agents and pilots also matter. The review includes known informal use as well as approved tools. First identify the task and operating setting, rather than starting with a preferred product name.
CSBS Examiner Work Program, initial scoping 6. Checked October 16, 2026.
Which records answer the question
- Use the policies or limits for generative AI and language models.
- Maintain the list of approved or known generative tools.
- Keep business-purpose, data-control and output-review records.
- Retain relevant staff guidance and training materials.
Where the answer directs review
A Yes points to Generative AI and Emerging Use. The Work Program also calls for attention to governance, approved-use expectations, data controls and output oversight. A tool that can act with limited human direction raises the separate agent-control question. Keep that question linked to the use instead of treating every assistant as an agent.
Core Examiner Guide, page 3. Checked October 16, 2026.
Two gaps to check
The approved-tools list names a service but not the account or operating setting. Identify whether staff use a public, enterprise, internal or vendor-provided version. Data handling and access assumptions should be tied to that setting, rather than borrowed from another edition.
Staff use an assistant on procedure text without a controlling source version. Name the approved version and the questions that must stay unanswered. Keep a reviewer role for exceptions. A plausible answer is not evidence that the procedure question was resolved correctly.
How to prepare the record
Ask what enters the tool, what it produces and who checks the result. Record the business task, input limits and cases needed before use. Keep failed and missing attempts alongside later runs. If a tool can perform actions, also seek the allowed-action list, human checkpoints, logs, reversal steps and shutdown owner.
A row behind the question
Illustrative inputs, not a client.
| Use | Where it runs | Data it can touch | Owner | Evidence on hand | Question still open |
|---|---|---|---|---|---|
| Staff question about procedure text | Public assistant outside the institution | Procedure text only; exclude member and account data | Procedure owner role not confirmed | Procedure excerpt with version gap | Which version controls, and which questions should remain unanswered? |
What the reviewer should retain
The preparation file should make the operating boundary easy to explain. State which task was reviewed and which uses were left outside it. Keep expert observations separate from the institution's approval. Changing the source, account setting or agent permissions can create a fresh review question even when the product name stays the same.
Prepare the next step
Consider risk differences next so the review effort follows the use and its possible impact.