Speech by Governor Bowman on artificial intelligence in the financial system

It would be impossible to predict what the future holds for AI, or how its use and impact will evolve over time. But as the technology continues to mature, as new use cases evolve, and it is rolled out more broadly, we will almost certainly be surprised by how it is ultimately used.

Looking at the financial industry-specific implications of AI, it is helpful to consider not only how it may change the financial system, but also how regulatory frameworks should respond to this emerging technology. Are the existing frameworks sufficient? If not, how can regulators best balance the risks AI may pose to bank safety and soundness and financial stability with the need to allow for continued innovation?

While each definition of AI may serve its own purpose in the context of how it is used, any single narrow definition can be criticized. A more generic definition runs the risk of oversimplifying the range of activities, use cases, and underlying technology. A definition that captures the variability of AI technology in a more granular way runs the risk of being unwieldy in its length, and obsolete in the short-term as new forms and use cases emerge.

Within this definitional question—of whether and how you define AI—lies a more important policy question: Specifically, for what purpose is a definition required? In the context of the financial system, the definition of AI may help to delineate how the regulatory system addresses it and establishes the parameters for how it can be used by regulated institutions. Other specific contexts could also be included, like third-party service providers that support banks or other financial services providers, or use by regulators in support of their mandates.

A definition helps regulators and regulated institutions understand the activities that are subject to rules and requirements by defining the scope. While this definitional question is important to establish clarity about the scope of what constitutes AI, it can also distract us from a more important point—what is the appropriate policy framework to address the introduction and ongoing use of AI in the financial system?

I have no strong feelings about the ideal or optimal definition of AI, and some version of the many definitions floating around are probably adequate for our purposes. At a minimum though, a definition must establish clear parameters about what types of activities and tools are covered. But before leaving the topic, I want to offer a cautionary note. A broad definition of AI arguably captures a wider range of activity and has a longer “lifespan” before it becomes outmoded, and potentially never becomes outdated. But a broad definition also carries the risk of a broad—and undifferentiated—policy response. This vast variability in AI’s uses defies a simple, granular definition, but also suggests that we cannot adopt a one-size-fits-all approach as we consider the future role of AI in the financial system.

Innovation and Competitiveness

Knowing that the technology and use of AI continues to evolve leads to the question of how it should be viewed by regulators, particularly in light of the need for innovation and the effect on competition.

Innovation

AI tools have the potential to substantially enhance the financial industry. In my view, the regulatory system should promote these improvements in a way that is consistent with applicable law and appropriate banking practices.

One of the most common current use cases is in reviewing and summarizing unstructured data. This can include enlisting AI to summarize a single report or to aggregate information from different sources on the same or related topics. The AI “output” in these cases may not directly produce any real-world action, but it provides information in a more usable way to assist a human. AI use cases like this may present opportunities to improve operational efficiency, without introducing substantial new risk into business processes. In some ways, the joining of AI outputs with a human acting as a “filter” or “reality check” can capture efficiency gains and control for some AI risks. Similarly, AI can act as a “filter” or “reality check” on analysis produced by humans, checking for potential errors or biases.

If our regulatory environment is not receptive to the use of AI in these circumstances customers are the ones who suffer. AI will not completely “solve” the problem of fraud—particularly as fraudsters develop more sophisticated ways to exploit this technology. But it could be important if the regulatory framework provides reasonable parameters for its use.

AI could be used to further expand this access, as financial entities mine more data sets and refine their understanding of creditworthiness. Of course, we also know that using AI in this context—in a way that has more direct impact on credit decisions affecting individual customers—also presents more substantial legal compliance challenges than other AI use cases.

While these use cases present only a subset of the possibilities for the financial system, they illustrate the breadth of potential benefits and risks of adopting an overly cautious approach that chills innovation in the banking system. Over-regulation of AI can itself present risks by preventing the realization of benefits of improved efficiency, lower operational costs, and better fraud prevention and customer service.

Effect on Competition

The regulatory approach and framework can also promote competition in the development and use of AI tools in the financial system.

An overly conservative regulatory approach can skew the competitive landscape by pushing activities outside of the regulated banking system or preventing the use of AI altogether. Inertia often causes regulators to reflexively prefer known practices and existing technology over process change and innovation. The banking sector often suffers from this regulatory skepticism, which can ultimately harm the competitiveness of the U.S. banking sector.

In the United States, we often think about the financial system based on the regulatory “perimeter.” We view institutions within the scope of federal banking regulation (banks and their affiliates) as being “in the perimeter,” while entities that operate under other regulatory frameworks (including money transmitters licensed under state law) are “outside the perimeter.” Of course, the global financial system includes institutions that operate on a cross-border basis, and tools and approaches often permeate throughout the financial system once they have been deployed successfully in some other part of the system. But we know that the regulatory perimeter is permeable, and there is always the risk that activity pushed outside the perimeter can transmit risk back into the system even as the activities garner less scrutiny and regulation than banks. Put differently, the overly conservative approach may present only a façade of safety, masking underlying risks to the financial system and those who rely on it.

Of course, there are risks to being overly permissive in the AI regulatory approach. As with any rapidly evolving technology, supervision of its use should be nimble. Its users must make sufficient risk-management and compliance investments to conduct activities in a safe and sound manner, and in accordance with applicable laws and regulations. While the banking system has generally been cautious and deliberate in its AI development and rollout, others have not. When left improperly managed and unmonitored, it can result in unintended outcomes and customer harm. For example, certain generative AI models have been known to generate nonsensical or inaccurate outputs, sometimes called “hallucinations.” In some cases, AI hallucinations have not involved significant harm, for example when discovered in a testing environment without customer-facing implications.

When we consider AI risks, many of these are already well-covered by existing frameworks. For example, AI often depends on external parties—cloud computing providers, licensed generative AI technologies, and core service providers—to operate. AI can also pose model risks in the banking context, with associated data management and governance concerns. AI can also impact a bank’s cyber-resiliency as AI-related fraud tools become more widespread and more anti-fraud tools become available.

While AI may be on the frontier of technology, it does not operate outside the existing legal and regulatory framework. AI is not exempt from current legal and regulatory requirements, nor is its use exempt from scrutiny. This is particularly true with AI; its use must comply with current laws and regulations, including fair lending, cyber security, data privacy, third-party risk management, and copyright. And when AI is deployed in a bank, an even broader set of requirements may apply depending on the use case.

Regulators are often playing “catch-up” with banks at the forefront of innovation. As a result, they often suffer from significant disadvantages in terms of understanding how the technology works, understanding the uses of AI within financial institutions, and keeping up-to-date with the latest AI developments. Of course, further compounding this challenge is that much of the work in AI innovation occurs far outside the banking system, including in the development and testing of generative AI models and in compiling the data sources on which to train the models.

Many banks have increased AI adoption to an expanding number of use cases. As this technology becomes more widely adopted throughout the financial system, it is critical that we have a coherent and rational policy approach. That starts with our ability to understand the technology, including both the algorithms underlying its use and the possible implications—both good and bad—for banks and their customers.

In suggesting that we grow our understanding and staff expertise as a baseline, I acknowledge that this has been, and is likely to remain, a challenge. The Federal Reserve and other banking regulators compete for the same limited pool of talent as private industry. But we must prioritize improving our understanding and capacity as this technology continues to become more widely adopted.

Second, we must have an openness to the adoption of AI. We need to have a receptivity to the use of this technology and know that successful adoption requires communication and transparency between regulated firms and regulators. One approach regulators can use to reframe questions around AI (and innovation generally) is to adopt a posture that I think of as technology agnosticism.

We should avoid fixating on the technology, and instead focus on the risks presented by different use cases. These risks may be influenced by a number of factors, including the scope and consequences of the use case, the underlying data relied on, and the capability of a firm to appropriately manage these risks. Putting activities together may be a helpful way to get a sense of broad trends (for example, the speed of AI adoption in the industry), but is inefficient as a way to address regulatory concerns (like safety and soundness, and financial stability). This may seem like an obvious point, but at times regulators have fallen prey to overbroad categorizations, treating a diverse set of activities as uniformly and equally risky.

This approach allows us to be risk-focused, much like we try to do with other forms of supervision, moderating intensity for low-risk activities, and increasing the intensity for higher-risk ones.

Of course, regulatory agencies do not operate in a vacuum, so we must also ask what type of coordination we need to ensure that we promote safe and sound adoption of AI, and address broader financial stability risks, both domestically and internationally. As a threshold matter, we need coordination both within each agency and among domestic regulators that play a role in the supervision and regulation of the financial system, which requires an environment of open sharing of information.

A posture of openness to AI requires caution when adding to the body of regulation. Specifically, I think we need a gap analysis to determine if there are regulatory gaps or blind spots that could require additional regulation and whether the current framework is fit for purpose. Fundamentally though, the variability in the technology will almost certainly require a degree of flexibility in regulatory approach.

Closing Thoughts

Before closing, I want to thank the organizers of this event for the invitation to address you this evening, and to thank the many speakers and participants who have contributed to the symposium.

Artificial intelligence has tremendous potential to reshape the financial services industry and the broader world economy. While I have suggested in my remarks that we need not rush to regulate, it is important that we continue to monitor developments in AI and their real-world effects. In the long run, AI has the potential to impact many aspects of the Fed’s work, from our role in supervising the payment system, to the important work we do promoting the safe and sound operation of banks and financial stability. AI may also play a growing role in monetary policy discussions, as the introduction of AI tools alter labor markets, affecting productivity and potentially the natural rate of unemployment and the natural rate of interest.

But as we engage in ongoing monitoring—and expand our understanding of AI technology and how it fits within the bank regulatory framework—I think it is important to preserve the ability of banks to innovate and allow the banking system to realize the benefits of this new technology.