Every quarter, a chief compliance officer brings the same three questions to the AI section of the review. Which rules changed? Which dates are coming? And can the organization show that it tracks both?
For AI, the answers sit with a dozen issuers. The Federal Reserve, the OCC and the FDIC write model risk guidance. FINRA and the SEC apply their supervision and books-and-records rules. NYDFS writes cybersecurity rules and industry letters, the NAIC and state insurance departments govern insurers, and the EU and the UK legislate for their own markets. Each publishes on its own site, in its own format and on its own schedule.
We built the financial services AI regulation tracker to put those answers on one page.
One row per instrument, each with its source
Each row names the jurisdiction, the regulator and the instrument, and gives one line on what it covers for AI. It also shows the status (in force, guidance, proposed, request for comment, adopted by a number of states, announced or withdrawn), the date that matters most, the date the row was last checked, and a link to the primary source. Where we publish a Regulatory Reference entry on the instrument, the row links to it and shares its review date, so a refreshed entry refreshes the row.
You can filter by sector (banking, broker-dealers and advisers, insurance, and cross-sector and EU) and by status, and sort by key date or by review date. A filtered view has its own address, so a team can share the insurance view or the list of open proposals.
What moved this quarter
Seven changes stand out in this update. Each one has a row with its primary source.
- Third-party risk. On 11 September 2026, the Federal Reserve, the FDIC, the OCC and the NCUA proposed guidance to revise and replace their third-party risk management guidance. Comments are due by 16 November 2026. Both the 2023 guidance and the proposal treat any business arrangement with another entity that supports the bank as a third-party relationship, which takes in AI vendors and model providers.
- Insurer AI programs. The NAIC's adoption map for its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers now shows 27 states, the District of Columbia and Puerto Rico, status as of 8 October 2026. South Carolina (24 September) and North Dakota (5 October) are the latest adoptions.
- Insurer examinations. Twelve states piloted the NAIC's AI Systems Evaluation Tool, now the AI Risk Evaluation Supplement, from March 2026. Comments on version 5.0 closed on 29 September 2026, and the NAIC anticipates adopting the tool at its Fall National Meeting, 14 to 17 November 2026.
- Broker-dealer communications. FINRA's comment period on Regulatory Notice 26-14, which proposes changes to modernize Rule 2210, closed on 11 September 2026. The notice states that members are responsible for their communications whether a person or AI technology generated them.
- Model risk and AI at banks. The request for information on model risk management and AI, announced with OCC Bulletin 2026-13 in April, had not been published as of this update.
- Fair lending. The CFPB's amendments to Regulation B took effect on 21 July 2026. They provide that the Equal Credit Opportunity Act does not authorize disparate-impact liability. The CFPB had already withdrawn Circular 2022-03, its guidance on adverse action notices for credit decisions based on complex algorithms, on 12 May 2025.
- EU high-risk dates. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the AI Act's Annex III high-risk obligations, which include credit scoring and pricing for life and health insurance, to 2 December 2027.
Running the review from the tracker
- Filter to the sectors the organization is supervised in. Read the status column first. Rows marked Proposed, Request for comment or Announced are where the next change will come from.
- Carry every upcoming key date into the compliance calendar and give each one an owner. The tracker marks key dates that fall after its update date as Upcoming.
- Compare each row's last-reviewed date with the date of your previous review. A later date means the row was rechecked or changed in between. The linked reference entry explains what moved.
- Open the primary source before you rely on a row. A one-line summary is only a starting point.
What an examiner asks about
An examiner asks how the organization governs AI under the rules that already apply, and the instruments on the tracker say what that covers:
- The SEC's fiscal year 2026 examination priorities say examiners will review the accuracy of registrants' representations about their AI capabilities. They will also assess whether firms have adequate policies and procedures to monitor or supervise their use of AI.
- The NAIC Model Bulletin tells insurers to expect questions in an investigation or market conduct action about how they develop, deploy and use AI systems, and about the outcomes. Those questions cover the insurer's governance framework, risk management and internal controls.
- The NYDFS advisory of 21 May 2026 on frontier AI models asks regulated entities to review and update their risk assessments to reflect the evolving risks.
Each of these comes down to records: an inventory of the AI systems in use, the controls applied to each, and evidence that the controls ran. A dated quarterly review shows the organization knew which rules applied and responded when one changed.
Our framework pages show how the evidence Meilynx produces maps to the rules behind them.
This post summarizes publicly available regulatory material and is not legal advice. Obligations depend on an institution's charter, licenses, registration status and activities. Verify against the primary sources and consult counsel.