State Regulators Enter AI Chat: CSBS Releases AI Supervisory Framework – Cooley Finsights

So CSBS has released an AI supervisory framework, which is the regulatory equivalent of a laminated note tucked under the windscreen wiper. Note the verb: released. Not enacted, not enforced, not agreed by anyone with jurisdiction over anything. The accompanying Cooley Finsights analysis delivers its verdict with the confidence of a man reading a gas bill: it 'remains to be seen' whether states will actually adopt the framework, 'and to what extent.' A framework whose applicability depends on local enthusiasm is not a framework. It is a suggestion with a letterhead. A letterhead, admittedly, is more than most AI governance has managed so far.

Meanwhile, states are 'increasingly passing legislation governing AI use,' so everyone is drafting something. Colorado, we're told, 'recently finalized its novel AI legislation in May 2026,' largely applicable to financial institutions. Novel is the word you reach for when the statute has not yet met a judge. And the target is financial institutions — an industry already garrisoned by federal supervisors, state supervisors, auditors and risk committees whose entire purpose is generating documents about other documents. Now they get another set of state expectations, enforceable to whatever degree their particular state eventually decides, at a date still to be announced.

The impressive part is the design. A bank in Denver and its branch across a state line now play two versions of the same game with two different rulebooks — compliance by postcode. We have seen this film before: Malaysia's first AI law is scheduled for early 2027, comfortably after the problems it is meant to address. This is the rhythm now — frameworks published, adoption optional, teeth pending, consequences theoretical. CSBS has entered the chat. Whether anyone in that chat is obliged to reply remains, as the analysis so bracingly puts it, to be seen.