02 Adopting Disruptive Tech & AI

“Embracing AI in banking levels the playing field and provides unparalleled opportunity to enhance efficiency and optimization. Innovation and regulatory guidance must align to maintain compliance and consumer trust. By doing so, we foster a future of compliance and growth that benefits everyone.”

Adam Levy
Principal
Advisory

“As regulations across the US continue to evolve and take shape in 2026, we expect a key focus area for organizations will be ensuring they have mechanisms in place to classify and validate that AI systems and guardrails are functioning as intended and are aligned with the regulations. As a result, we expect to see an uptick in the number of organizations conducting AI risk assessments, system testing, and other AI assurance activities in 2026.”

Bryan McGowan
Principal
Advisory

Federal banking regulators continue to reiterate that existing guidance and risk frameworks (e.g., SR 11-7 and OCC 2011-12) remain fit for purpose in supervising AI applications, but recent statements suggest some revisions may be needed as AI applications continue to evolve and are deployed across financial organizations.

Examples

What to Watch

Interagency belief that existing statutory authorities are generally sufficient to supervise AI use (e.g., GAO Report)
If AI is a model, the current approach to model risk management needs to be revamped/revised (e.g., OCC Statement (Gould))
Need to review/update existing standards (e.g., FRB Statement (Barr))

Potential revisions to existing model guidance for AI-specific use cases
Potential need for enhancements to non-model risk frameworks to address transverse risks, including cybersecurity and operational risks, related to GenAI
Increasing numbers of bank/fintech relationships; heightened attention to TPRM
Growing acceptance that not all AI is a model
Consideration of new approaches for AI that is not a model

Divergent actions at the federal and state levels create risk and compliance challenges:

Executive directives promote national security and innovation and the removal of regulatory barriers that may hinder it.
Proliferation of state level laws and regulations, including broad frameworks aimed at developers and/or deployers and narrowly targeted safety and/or privacy laws (e.g., consumer protection, child protection, deepfakes, automated decision-making tools).

Examples	What to Watch
Federal actions, including: Policy recommendations for accelerating AI innovation, infrastructure, and security (e.g., AI Action Plan, EOs for data centers and “full-stack” AI exports) Identification of AI technologies constrained due to Federal statues, regulations, or policies (e.g., OSTP RFI) State actions (more than 1,000 bills introduced across 50 states in 20251), including: “Safety” laws focused on large developers (e.g., CA, NY) “Comprehensive” laws for “high risk systems” (e.g., TX) Targeted laws (e.g., NY re: child protection)	Introduction of new laws and regulations, as appropriate, to facilitate recommendations in the AI Action Plan Potential revision and/or recission of federal rules identified as inhibiting AI innovation, infrastructure Ongoing introduction of laws and regulations with varying scope and scale across all 50 states; overlaps with cyber, data privacy, and energy infrastructure laws Continued calls for federal preemption or moratoriums on enforcement of certain state AI laws Potential for increased risks from inaction in the absence or reduction of proactive federal regulatory activity

Examples

What to Watch

Federal actions, including:
- Policy recommendations for accelerating AI innovation, infrastructure, and security (e.g., AI Action Plan, EOs for data centers and “full-stack” AI exports)
- Identification of AI technologies constrained due to Federal statues, regulations, or policies (e.g., OSTP RFI)
State actions (more than 1,000 bills introduced across 50 states in 20251), including:
- “Safety” laws focused on large developers (e.g., CA, NY)
- “Comprehensive” laws for “high risk systems” (e.g., TX)
- Targeted laws (e.g., NY re: child protection)

Introduction of new laws and regulations, as appropriate, to facilitate recommendations in the AI Action Plan
Potential revision and/or recission of federal rules identified as inhibiting AI innovation, infrastructure
Ongoing introduction of laws and regulations with varying scope and scale across all 50 states; overlaps with cyber, data privacy, and energy infrastructure laws
Continued calls for federal preemption or moratoriums on enforcement of certain state AI laws
Potential for increased risks from inaction in the absence or reduction of proactive federal regulatory activity

¹Derived from Multistate.ai

Executive policy to create conditions for private sector-led innovation to flourish and enable AI adoption.

Examples

What to Watch

Promotion (e.g., AI Action Plan) of private sector through access to resources (e.g., models, data), testing facilities (e.g., “regulatory sandboxes”), and industry-specific standards
Initiatives and projects to facilitate U.S. AI leadership (e.g., EO 14318 re: data centers)
Private sector-driven innovation for AI applications in payments (e.g., FRB Statement (Waller))

Potential changes to regulatory processes, including supervision and rules identified by private industry as inhibiting AI innovation, to better facilitate development and deployment
Availability of regulatory sandboxes across different agencies
Streamlined permitting for data center and energy infrastructure along with other incentives at the federal and state levels
Federal Reserve stakeholder engagement on a "payment account" for fintechs

02 Adopting Disruptive Tech & AI:

Read the document

Download the Section

Dive into our thinking:

Ten Key Regulatory Challenges of 2026

Balancing the Regulatory Stack

Download PDF

Insights and analyses of emerging regulatory issues and their impact.

Series covering regulatory trends and emerging topics

Quick hitting summaries of specific regulatory developments and their impact.

KPMG Regulatory Insights is the thought leader hub for timely insight on risk and regulatory developments.

Laura Byerly

Managing Director, Clients & Markets, Regulatory Insights, KPMG LLP

Read bio

Adam Levy

Principal, Modeling & Valuation, KPMG LLP

Read bio

Bryan McGowan

Global and US Trusted AI Leader, KPMG US

Read bio

Laura Byerly

Managing Director, Clients & Markets, Regulatory Insights, KPMG LLP

Read bio

Adam Levy

Principal, Modeling & Valuation, KPMG LLP

Read bio

Bryan McGowan

Global and US Trusted AI Leader, KPMG US

Read bio

Relevant Results

Federal and state regulatory adaptation of existing risk frameworks and policies respond to complexities in evolving AI innovation, with increasing private sector participation.

Model Risk Management

Examples

What to Watch

Complexity & Divergence

Examples

What to Watch

Public Private Partnership

Examples

What to Watch

02 Adopting Disruptive Tech & AI:

Dive into our thinking:

Explore more

Get the latest from KPMG Regulatory Insights

Meet our team

Contact KPMG

Headline