Four kinds of institution. Four different exposure points.

Your exposure usually starts with the systems you didn't build yourself: fraud detection embedded in your core banking platform, a chatbot bolted onto online banking, and underwriting models from third-party lending software. Examiners are already asking model-risk questions under SR 11-7 — the AI question is the same conversation with a new vocabulary.

• Vendor-embedded AI (fraud, chatbot, underwriting) that never went through a formal model-risk review
• Credit-scoring models that may fall under EU AI Act high-risk rules if you have any EU-linked correspondent relationships
• NCUA and FFIEC exam cycles that increasingly ask about AI governance directly
• Deepfake-enabled wire fraud — voice-cloned "executive" call-ins and synthetic-identity account openings, both AI Fraud & Trust territory

Underwriting and claims triage AI sit at the center of two separate regulatory conversations at once: New York's DFS circular letter on AI use in underwriting (a live US precedent, not a proposal), and the EU AI Act's explicit high-risk classification for life and health insurance risk assessment.

• Underwriting and pricing models that need documented bias testing, not just actuarial soundness
• Claims triage AI that affects real payout timing and outcomes
• EU AI Act exposure if any book of business or reinsurance relationship touches the EU
• AI-generated fraudulent claims — fabricated documentation and images designed to pass automated triage

Client-facing AI tools — robo-advisory features, portfolio-question chatbots, AI-generated market commentary — raise disclosure and suitability questions the SEC and FINRA have both signaled they're watching closely, including scrutiny of AI-related marketing claims.

• Robo-advisory and portfolio-suggestion tools that need documented suitability logic
• AI-generated client communications and the disclosure obligations they trigger
• Marketing claims about "AI-powered" advice that need to hold up under regulatory review
• Deepfake-voice account takeover — a growing vector for unauthorized transfer requests on client accounts

You ship AI features faster than a governance program can usually keep up with — and your sponsor bank's examiners now treat your AI risk as their AI risk. Proving a working governance program is increasingly a condition of keeping the partnership, not a nice-to-have.

• Sponsor banks asking for documented AI governance as part of ongoing oversight
• Underwriting or fraud models built and updated faster than compliance review cycles
• A governance program that has to scale with a product team that ships weekly
• Prompt injection and data-leakage risk in AI-powered support agents and onboarding flows