As a former financial regulator, I know my ex-colleagues worry that businesses will skimp on compliance unless they are prodded into submission.
That is not my experience when it comes to AI governance. As the head of Informed.IQ’s legal and compliance functions, I see aggressive lender oversight of vendors’ AI solutions. We handle dozens of audits from lenders who deeply interrogate our use of AI models. And many of our lenders’ audit requests go beyond legal requirements.
Here are the types of things I’m seeing lenders ask of vendors using AI:
- Lenders expect vendors to map and manage AI risks;
- Lenders are requiring specific company-wide AI governance policies;
- Lenders expect vendors to report on the use of generative AI in their models;
- Lenders expect vendors to conduct annual AI training;
- Lenders expect vendors to rigorously oversee their own vendors’ use of AI; and
- Lenders are directing vendors to maintain inventories of their AI models systems, which is not a legal requirement, but rather guidance under the new NIST AI Risk Management Framework
This active lender oversight is noteworthy because, frankly, not much happened on the AI legislative front this year.
Few AI laws passed in 2024
With all the discussion of generative AI, AI discrimination, deepfakes, etc., it’s notable that no major Federal AI law was enacted. While 45 states introduced AI legislation in 2024, according to the National Counsel of State Legislatures, only a handful of consequential measures became law, and these often had implementation dates pushed back to 2026.
Notable state laws include:
- Colorado law, SB24- 205 (effective date 2026), Colorado enacted European-like comprehensive AI legislation requiring developers and users of high-risk AI systems to (i) use reasonable care to avoid algorithmic discrimination and (ii) provide consumer disclosures;
- California law, AB 2013 (effective January 1, 2026), imposes public documentation requirements on publicly available AI systems; and
- The Utah Artificial Intelligence Policy Act. This past March, Utah passed a law clarifying that Utah’s consumer protection laws apply equally to an entity’s use of generative AI and sets certain disclosure obligations
Existing Laws Carry Weight
Given the sparsity of enacted AI legislation, one might wonder why lenders are leaning so heavily into AI compliance.
Partially, I believe lenders are asking questions of vendors because they simply want to know more about the vendors use of AI. Lenders need to manage the inputs into their businesses. To do that, they need to get a handle on the strength, potential, and limitations of these emerging technologies.
But I think there’s another angle. Lenders, including our clients, are aggressively monitoring AI because they are following the expectations of existing law.
As the Department of Justice (DOJ), Equal Employment Opportunity Commission (EEOC) Federal Trade Commission (FTC), and my alma matter the Consumer Financial Protection Bureau (CFPB), noted in an April 2023 joint statement against discrimination and bias in automated systems “existing legal authorities apply to the use of automated systems and innovative new technologies just as they apply to other practices.”
AI, like other technologies , must conform to the raft of existing laws governing civil rights, consumer protection, non-discrimination, and safety and soundness.
As someone on the receiving end of lenders’ scrutiny, I can tell you that lenders are actively monitoring their vendors’ use of AI to ensure their compliance with existing laws. Of course, generative AI and other technologies may raise new risks that existing laws don’t address. But I urge legislators and regulators to tread carefully. A lot of good compliance work is being done. We don’t want to mess it up.
