For the risk officer preparing the file
Put the AI question beside its record.
Use eight scoping themes to locate your institution's evidence, owner and missing answer. These are preparation prompts, not an examination result.
Source checked October 4, 2026: CSBS Core Examiner Guide, version 1.0, approved August 13 and released September 16, 2026.
Eight themes. A place to begin.
The summaries below paraphrase IS-1 through IS-8 on page 3 of the official guide. The proposed file mapping is LLM Squared's interpretation. A single decision review covers its agreed workflow; an institution-wide inventory can require separate work.
| Theme | Locate in your file | Keep open until reviewed |
|---|---|---|
| IS-1. Where AI is used | Use-case register, workflow boundary, business owner. | Known scope and sources of unknown use. |
| IS-2. Inventory of current AI | Source register with vendor, tool and version. | Whether the supplied inventory is complete. |
| IS-3. Customer-facing or decision-related use | Use boundary, affected decisions and retained tests. | Permitted use and institution acceptance. |
| IS-4. External AI providers | Vendor terms, dependencies and questions register. | Missing contract terms and responsible vendor contact. |
| IS-5. AI embedded in vendor products | Feature declarations, release sources and authority record. | Undisclosed or unclear capabilities. |
| IS-6. Generative models and similar tools | Approved-route record, required cases and output reviews. | Data handling and unsupported outputs. |
| IS-7. Different levels of risk and review | Decision reasons, assigned reviewer and use limits. | Institution-approved risk treatment. |
| IS-8. Sensitive information entering AI | Data-flow record and permitted-source boundary. | Recipients, retention and access evidence. |
Keep Supplied, Prepared and Reviewed distinct. An entered declaration is not verified source authority. Discovery is not permission to act.
Inspect the shape before sharing sources.
Read the fictional file, inspect declared agent authority, or scope an AI pilot review. Use only fictional, public or properly redacted permitted inputs in public tools.
Request a scope conversation using general business terms.
Preparation has a defined boundary.
CSBS describes a discretionary resource; each state agency decides its use. The guide creates no new legal obligations or supervisory requirements, and this page provides no certification, legal advice, examiner assurance or CSBS endorsement.