United States: NIST, Treasury & State AI Laws

The Federal Paradox

The Trump administration revoked the Biden-era Executive Order 14110 and issued new directives emphasising innovation and minimal regulatory burden. Yet financial services regulators — the OCC, Federal Reserve, FDIC, and SEC — retain full authority over AI deployment within their regulated institutions. States are filling the federal vacuum with their own legislation, creating a patchwork of obligations that is more complex to navigate than a single comprehensive federal framework would be.

The absence of comprehensive federal AI legislation does not mean the absence of AI regulation. For financial institutions, the regulatory obligations are substantial — they are simply fragmented across multiple authorities and jurisdictions.

NIST AI Risk Management Framework 1.0

Published in January 2023, the NIST AI RMF establishes a voluntary framework organised around four core functions:

Govern

Establish and maintain organisational AI risk management policies, processes, procedures, and practices. Cultivate a risk-aware culture.

Map

Identify and categorise AI risks based on context, intended use, and potential impact. Understand the AI system's operating environment.

Measure

Employ quantitative and qualitative methods to analyse, assess, and track identified AI risks. Benchmark against established metrics.

Manage

Allocate resources and implement plans to respond to, recover from, and communicate about AI risks on a regular and prioritised basis.

While voluntary, the NIST AI RMF has become the de facto standard for AI governance in the US. Critically, it provides safe harbor protections under certain state laws — making adoption a strategic decision, not merely a best-practice exercise.

Treasury Financial Services AI RMF

The Treasury Department's financial services-specific AI risk management framework bridges the gap between the NIST AI RMF and existing financial regulatory expectations. With 230 control objectives, it provides a detailed mapping of AI governance requirements to the specific context of banking, insurance, and capital markets.

For financial institutions already subject to OCC, Federal Reserve, and FDIC oversight, the Treasury framework translates general AI risk principles into the language and structure of financial regulation — making it the most practical starting point for compliance programme design.

SR 11-7 and Agentic AI

The Federal Reserve's SR 11-7 (Guidance on Model Risk Management) has long been the baseline for how banks manage model risk. The challenge in 2026 is applying this framework to agentic AI systems that do not fit the traditional definition of a "model."

Agentic AI systems should be treated as having equivalent or greater model risk than traditional models. They make autonomous decisions, interact with external systems, and can trigger cascading effects that no traditional model validation framework was designed to assess.

Financial institutions must decide whether to extend SR 11-7 to cover agentic systems, develop parallel governance frameworks, or adopt an integrated approach. Corvair's architecture supports all three strategies while maintaining a single source of governance truth.

Colorado AI Act

The Colorado AI Act, effective February 15, 2026, is the most significant state-level AI regulation in the United States. It establishes concrete obligations for deployers of high-risk AI systems.

Core Requirements

Risk management policy: Deployers must implement and maintain a risk management policy and programme for high-risk AI systems
Impact assessments: Regular assessments of high-risk systems, including evaluation of fairness, bias, and discriminatory outcomes
Consumer disclosure: Individuals must be informed when high-risk AI systems are used to make consequential decisions about them
Right to appeal: Individuals have the right to appeal AI-driven decisions and receive human review

NIST Safe Harbor

The Colorado AI Act includes a significant safe harbor provision: deployers who can demonstrate compliance with the NIST AI RMF or a substantially equivalent framework receive an affirmative defence against enforcement actions. This makes NIST alignment not just a best practice but a legally strategic decision for institutions operating in Colorado.

Federal Agency Positions

Beyond the primary frameworks, several federal agencies have issued AI-specific guidance relevant to financial services:

SEC: Focused on AI-driven investment advice, algorithmic trading, and the use of predictive analytics in broker-dealer operations. Has signalled enforcement interest in AI-related conflicts of interest.
FTC: Active enforcement of AI-related deceptive practices, with particular focus on algorithmic bias and deceptive AI claims. Section 5 authority applies broadly.
CFPB: Emphasis on fair lending implications of AI-driven credit decisions. Has issued guidance on adverse action notices for AI-based credit denials.
EEOC: Guidance on the use of AI in employment decisions, relevant to financial institutions' internal HR and recruiting AI systems.

Explore Other Jurisdictions

Navigate US AI Regulation

Understand how federal frameworks, state laws, and agency guidance apply to your institution's AI deployments.

Schedule a Briefing