As banks look to implement and scale AI within their operations, some executives want more clarity on regulations that govern how the technology can be deployed. 

“I actually don’t think there’s enough clarity right now,” Ben Xiang, executive vice president and chief technology and strategy officer at $3.7 billion Sunwest Bank, told FinAi News. “Whatever tools that we’re testing, we have to make sure that really meets the regulatory requirements of being a financial institution, which can slow down innovation sometimes.”

It’s a challenge for banks to balance tech innovation with security needs, Xiang said.  

“We don’t know if all the tools that are out there are secure,” he said, adding that Sunwest wants to make sure its use of AI isn’t stepping “on regulators’ toes.” 

Part of the reason is because AI is changing so quickly that it’s very difficult, even for people working in AI, to fully understand and grasp exactly what’s changing every month, Xiang said. 

Some 42% of financial services leaders cite staying up to date with evolving regulations as their biggest challenge, and 36% said they lack sufficient internal expertise to manage their workloads, according to a Nov. 12 report from cybersecurity company Omega System. The company surveyed 300 financial services leaders in 2025 for the study. 

Current state of regulations 

The White House’s July report “Winning the AI Race: America’s AI Action Plan” offers guidance on how various industries are to be governed with regard to AI. 

Existing regulators like the FTC and SEC will take charge of providing AI usage guidance for FIs, the report stated. 

While the Consumer Financial Protection Bureau’s funding is up in the air, regulators are sounding alarms about the need to regulate the technology without hindering innovation. 

U.S. AI Czar David Sachs said there should be a federal rule book for AI rather than allowing all 50 states to devise their own rules. 

Speaking in an interview at the All In podcast on Nov. 7, he said: “The Constitution allows to create a single national market for interstate commerce [and] AI clearly qualifies” for that. 

The Constitution’s commerce clause grants Congress the power to regulate commerce with foreign nations and among the states, rather than allowing states to dictate their own rules. 

And Fed board member Michael Barr on Wednesday said regulators must get the balance right between innovation and stability to ensure that AI boosts growth and productivity in the long term. 

Slow regulatory buildup 

Bank regulations in the U.S. are implemented differently than in other countries, Sean Viergutz, principal of banking and capital markets advisory leader at PwC, told FinAi News. 

For example, EU regulators implemented the EU AI Act in August 2024, within two years of OpenAI’s launch, Viergutz said. It establishes a risk-based regulatory framework for AI systems, banning some high-risk uses, mandating transparency and oversight, and imposing penalties for non-compliance. 

The EU AI Act has classified the use of AI for credit scoring as “high risk” requiring strict compliance, transparency, data quality, and human oversight, while prohibiting manipulative use of AI, according to the European Commission’s website. 

The U.S. will take a slower approach toward regulating AI and has already provided guidelines for companies and won’t put in guardrails until necessary, Viergutz said. 

“The core tenets of regulation and risk don’t change, and the banking industry has plenty of them,” he added. 

Citizens Bank Chief Data and Analytics Officer Krish Swamy agrees. 

“I think the regulatory frameworks that exist for the use of AI, the use of machine learning and advanced analytics in general, which now are about 10 to 15 years old, are still largely very relevant,” he said. 

The regulation that EU dropped “that gets into some very specific language on what types of AI use cases are allowed and how AI can be used is a bit of over precision,” Swamy said. 

Register here for early-bird pricing for the inaugural FinAi Banking Summit 2026, taking place March 2-3 in Denver. View the full event agenda here.