Connecticut Sets AI Governance Expectations for Financial Institutions

Connecticut has put AI governance on the examination agenda. On September 22, 2026, the Connecticut Department of Banking (Department) issued guidance outlining its expectations for artificial intelligence (AI) systems used by Connecticut-chartered financial institutions and other entities licensed or regulated by the Department (Guidance). In particular, the Guidance requires each covered financial institution to develop an AI governance framework (Framework) and lays out the Department's expectations about the scope and coverage of these frameworks.

Consistent with the principles discussed in our prior analysis of AI in financial services, the Guidance takes a risk-based approach: each institution's Framework should be proportionate to the institution's size and activities and to the scope, complexity, risk, and data sensitivity of the AI systems it uses.

Regulatory Background

What the Guidance Covers

The Guidance applies broadly, and it likely applies to many of the most common AI use cases among financial institutions. It covers financial institutions that are chartered and licensed in Connecticut, as well as other financial institutions regulated by the Department. As a result, the Guidance reaches both depository institutions, such as state-chartered banks and credit unions, and the wide range of nondepository companies licensed by the Department, including mortgage, consumer lending and servicing, money transmission, and debt collection businesses.

The Guidance defines AI broadly to cover "any machine-based system trained on data that... generates outputs, including predictions, recommendations, decisions, or content." To fall into this definition, the system must also use computational techniques that enable inference from data and operate with a level of autonomy. For example, the Department appears to include machine-learning-based underwriting models within its definition of AI while excluding a "spreadsheet that applies fixed debt-income thresholds."

It also casts a wide net in terms of the AI use cases covered. Specifically, the Guidance applies to any "automated system or tool that uses AI and materially influences business operations, risk management, or consumer-facing decisions of a [covered financial institution]." The term "business operations" is not defined further, which creates a broad hook that can encompass many AI use cases that do not involve consequential decisions about consumers, potentially making them in scope under the Guidance, even if they are not in scope under certain state laws pertaining to automated decision-making technology.

Covered AI systems can include software-as-a-service tools that embed AI if they materially affect such operations or decisions. However, tools that use AI only incidentally or that do not materially impact the operations, risk management, or consumer-facing decisions are not covered. The breadth of the Guidance's coverage makes it particularly important for financial institutions to be mindful of the Department's AI governance expectations.

Regulatory Expectations

The Department expects each regulated financial institution to develop and implement an AI governance Framework. The Framework adopted by each institution must be tailored to the size and activities of the institution and proportionate to the scope, complexity, risk, and data sensitivity of the AI systems used by the institution. Among other things, the Framework should establish clear internal roles and oversight of AI systems; identify and manage potential risks of AI systems use; incorporate best practices and recognized standards for AI systems, cybersecurity, and privacy; and ensure compliance with applicable laws.

In particular, each institution's Framework should include four key components: (i) board and senior management responsibility; (ii) cybersecurity, privacy, and protection of consumer information; (iii) incorporation of best practices and industry standards; and (iv) a written AI governance plan.

Board and Management Responsibility

The Department expects institutions' boards of directors or managing members to take an active role in overseeing the entity's AI systems and Framework. Among other things, senior leadership must have sufficient understanding of AI-related matters to exercise oversight, which may include the use of advisors. Oversight functions may include reviewing reports on the AI systems and Framework and confirming that senior leadership has allocated sufficient resources to implement, maintain, and monitor them.

Cybersecurity, Data Privacy, and Protection of Consumer Data

Per the Department, assessing and mitigating cybersecurity and privacy risks related to cyber attacks on AI systems "should be a primary focus" of each institution's Framework. The Department expects covered institutions to address these risks in their existing information security program rather than through a separate, AI-specific cybersecurity regime.

Incorporation of Best Practices and Standards

The Department expects covered institutions to review and incorporate industry best practices and standards that are appropriate for the size and scope of the institution's AI-related activities into their Framework. Among other things, these may include governance frameworks and AI risk management standards developed by official standard organizations like the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework, supervisory guidance and risk management resources issued by federal financial regulators, and current federal model risk management principles including model validation practices.

Notably, the Department's citation to federal model risk management principles comes with a wrinkle: the revised interagency guidance issued by federal banking regulators in April 2026 expressly leaves generative and agentic AI outside its scope pending further agency consideration. Institutions borrowing from that framework will therefore need to supplement it for their generative and agentic AI use cases.

Written AI Governance Plan

One of the most critical components of the Guidance is the Department's expectation that covered institutions create a written AI governance plan. The plan may be part of an entity's overall risk management plan, and it should operationalize the three other components of the Framework described above.

The Department expects each written plan to include seven components:

1. Life cycle. The written plan should include policies and procedures addressing the full life cycle of AI systems, including their development or acquisition, testing and validation, deployment, monitoring, material changes, and retirement or decommissioning. Among other things, life cycle governance should include appropriate controls for pre-deployment testing, ongoing performance monitoring, detection of model drift or degradation, change management, and orderly deactivation/retirement when appropriate.
2. Inventory, risk assessment, and management of AI systems. Institutions should have processes to inventory their AI systems and to identify, assess, tier, and manage associated risks, including operational, safety and soundness, cybersecurity, privacy, data quality, and consumer protection risks. Risk management should be integrated with the institution's broader risk management framework, including escalation and remediation processes, and tier systems by materiality, data sensitivity, and potential consumer impact.
3. Policies and procedures. The plan should include governance mechanisms to ensure AI systems comply with applicable federal and state laws, regulations, and supervisory guidance, including those relating to consumer protection, privacy, data use, and unfair or discriminatory practices. These mechanisms should include monitoring for potential unfair or discriminatory outcomes.
4. Human oversight of AI systems. Institutions should have "defined human oversight" of AI systems, including human responsibility for AI-supported decisions, escalation protocols, and accountability for outcomes affecting consumers or other regulated activities. Human oversight should be sufficient to detect, review, and address errors, unintended outcomes, or potential consumer harm, including the ability to intervene in or override AI-based decisions when warranted.
5. Training. Board members, senior management, and relevant personnel should receive training addressing AI system functionality, limitations, risks, data governance, consumer protection considerations, and applicable legal and regulatory requirements, as applicable. It should be updated to reflect material changes over time.
6. Third-party risk management. The plan should govern AI systems provided or supported by vendors through appropriate due diligence, contractual controls, audits, and ongoing monitoring throughout the relationship. This governance should be consistent with the institution's overall third-party risk management practices and reflect the risks posed by the AI system, the data involved, and the extent of reliance on the vendor.
7. Documentation. Institutions should maintain documentation proportionate to the risk and complexity of their AI systems and sufficient to support internal governance, supervisory review, and examination readiness. This includes documentation of each AI system's purpose, data sources, risk assessments, testing and validation, monitoring, governance approvals, and material changes.

Connecticut vs. Other State Requirements

Connecticut joins a growing number of state financial regulators addressing AI, and its Guidance follows the Conference of State Bank Supervisors' (CSBS) recent release of an AI supervisory framework for state examiners. However, Connecticut's Guidance stands out in a few key ways:

• Unlike state laws focused on automated decision-making technology (ADMT), which generally target consequential decisions about consumers, the Guidance reaches any AI system that materially influences business operations or risk management, in addition to consumer-facing decisions. Obviously, unlike many of the aforementioned ADMT laws, the Guidance is also not a standalone statutory requirement.
• The Guidance is also notable for its specificity: rather than articulating only high-level principles, it identifies seven components that each institution's written AI governance plan should include, and the Department plans to review those plans during supervisory examinations.
• While the CSBS framework tells examiners what to look for and expressly does not create new obligations, the Guidance sets out the Department's expectations directly for institutions, and the two documents cover largely consistent ground.
• The Guidance is silent on generative AI as a distinct risk category. The CSBS framework, by contrast, directs examiners to probe deployment models, data controls, output review, hallucination and prompt injection risk, and the permission boundaries, logging, and kill-switch controls applicable to systems that can act with limited human direction.

Practical Impact for Financial Institutions

The Guidance notes that the Department plans to review AI systems and Frameworks, including related written plans, during supervisory examinations. It also notes that "the Department expects that AI [s]ystems be transparent and explainable in a manner appropriate to their risk and consumer impact" and that, at a minimum, covered institutions should be able to explain whether AI systems materially affect consumers and decisions regarding consumers.

Nondepository licensees likely face the steepest climb. Many already run model risk management programs for underwriting and pricing, but those programs are often built around model performance and validation rather than the governance architecture the Guidance contemplates: board-level or managing-member oversight with regular reporting, enterprise-wide inventory and risk tiering, role-based training, and documentation maintained for examination readiness. Many smaller nonbanks may lack the three-lines-of-defense structure and independent audit function that banks frequently rely on, which means the harder question is often not whether the institution can validate a model but who owns the Framework or is responsible for exercising human oversight over a particular AI system. In such cases, it may also be difficult to demonstrate that ownership and oversight to an examiner.

Given the Department's focus on the varying use cases for AI systems and the AI governance programs adopted by financial institutions, covered institutions should consider doing the following:

• Inventory models, including what they are used for, the data sources they rely upon, vendor dependencies, affected financial products, and the model's role in the decision process
• Assess which tools, including vendor and software-as-a-service products with embedded AI, meet the Guidance's materiality threshold, including those used in internal functions such as compliance, fraud prevention, and marketing
• Tier AI systems by materiality, data sensitivity, and potential consumer impact, and calibrate testing, monitoring, and oversight accordingly
• Prepare or update a written AI governance plan, which may be incorporated into the institution's existing risk management plan, that addresses all seven required components
• Brief the board or other governing body on AI use and the Framework and establish regular reporting from senior management
• Integrate AI-related cybersecurity and privacy risks into the existing information security program to the extent that it does not already address those risks
• Review vendor contracts for AI tools to confirm adequate due diligence, contractual controls, audit rights, and ongoing monitoring
• Confirm the institution can clearly explain whether its AI systems materially affect consumers, and monitor consumer-facing systems for potential unfair or discriminatory outcomes
• Reconcile the Guidance's explainability expectation with existing adverse action notice obligations under the Equal Credit Opportunity Act and Regulation B, confirming that model-driven denials and pricing decisions can be traced to accurate, specific principal reasons

With the Department planning to review AI systems and governance plans during supervisory examinations, covered institutions should act now to ensure their AI governance programs are documented and examination-ready.

Conclusion

The Department's Guidance provides a useful framework for covered financial institutions—including many nonbank licensees in Connecticut—that are in the early stages of developing an AI governance program. With the CSBS framework now giving examiners in every state a common starting point for AI reviews, institution-facing guidance from other state banking departments would be a natural next step, and Connecticut's broader scope—reaching AI that materially influences business operations and risk management, not only consumer-facing decisions—may prove influential. Institutions should therefore treat the Guidance not only as a roadmap for their own programs but as a preview of the questions state examiners may ask, wherever they are licensed.