Most banks have started discussing artificial intelligence, implementing policies, or at least considering how AI may fit into their operations. However, a recent incident involving a community bank serves as an important reminder that an AI policy alone may not be enough to manage the risks associated with these tools. The incident has generated significant industry discussion because it demonstrates that AI-related events can pose serious compliance, operational, and information security risks even when no traditional cyberattack is involved.

According to public reports, sensitive customer information was entered into an unauthorized AI application by an employee during the course of normal job duties. The incident reportedly resulted in customer notification requirements, regulatory reporting obligations, and potential exposure to litigation. While many institutions focus their cybersecurity efforts on external threats, this situation demonstrates how risk can also originate from employees using tools that have not been properly evaluated, approved, or monitored by the institution.

This situation is an example of what is commonly called “shadow AI,” which occurs when employees use AI tools outside of the bank’s approved processes and controls. As AI becomes more readily available, institutions may have limited visibility into what tools are being used and what information is being entered into them.

The biggest takeaway for community banks is that an AI policy by itself is not a control. Simply telling employees not to use certain AI tools is unlikely to be effective if they do not understand what those tools are, how they work, or why the bank is concerned about them. The same is true for management and the board. Effective oversight starts with understanding the risk.

In many institutions, employees may already be using AI tools without management realizing it. This makes employee education and awareness critical components of any AI governance program.

From both a compliance and information security perspective, institutions should evaluate whether they have:

  • Board and senior management education regarding AI risks and regulatory expectations.
  • Employee training on acceptable and prohibited AI use.
  • An AI risk assessment and governance framework.
  • Vendor due diligence for approved AI solutions.
  • Technical controls and monitoring for unauthorized AI usage.
  • Ongoing review of AI-related risks and controls.

As AI adoption continues to grow, community banks should ensure their approach extends beyond policy development. Effective AI governance requires education, oversight, risk assessment, and appropriate controls to help ensure these tools are used safely and responsibly. The institutions that will be most successful with AI will be those that understand the technology, educate their people, and implement appropriate controls to manage the associated risks.

The community bank incident discussed above has received significant industry attention and provides a real-world example of how an employee’s use of an unauthorized AI tool can create compliance, information security, and reputational risks for a financial institution. Additional information can be found in the articles below:

CCI suggests sharing this CCI update bank-wide, including with the Board of Directors. CCI can assist institutions in developing AI policies, conducting AI risk assessments, and educating directors, senior management, and staff on the opportunities and risks associated with AI. In many cases, training and awareness may be just as important as the policy itself. If you have any questions regarding this information or would like more information on how CCI can help, you can contact us via inquiries@completecompli.com.

 

Sarah Smith, CRCM, CAFP