Federal Reserve Vice Chair for Supervision Michelle Bowman used a Tuesday cyber workshop for community banks to frame artificial intelligence as a security threat that demands proactive leadership from bank boards and senior management. Her recorded remarks, played at the Denver event, matter because they signal how the Fed's top supervisory voice is positioning AI risk as a governance issue rather than a purely technical one. Bowman said security threats facing banks have increased "exponentially" because of the proliferation of both traditional hackers and AI agents, and she placed the first line of defense inside the institution itself.
Bowman tied that responsibility to concrete operational practices. She said defending against AI-related risks "begins with strong cyber hygiene," including up-to-date asset inventories, phishing-resistant multifactor authentication, strong identity and access controls, and robust vulnerability identification and patch management programs. She also called for comprehensive employee training and periodic incident response program testing. The mechanics she described are not new regulatory mandates, but they represent the Fed's current supervisory expectation that banks continuously evolve cyber defense strategies and tactics as AI tools become more accessible to attackers.
The evidence for Bowman's position comes from a single American Banker report based on her recorded remarks and her broader work at the Financial Stability Board. The report quotes Bowman directly: "Cybersecurity requires proactive risk management by boards of directors and senior management. It also requires strategic investments in people, processes, and technology that are aligned with the risk and complexity of the institution." The same source notes that Bowman has spearheaded an FSB report outlining "Sound Practices for Responsible Adoption of AI," and that the group is sorting through public comments collected over the summer. The report also indicates Bowman acknowledged that regulators have a role in ensuring risks are addressed, but that supervisory oversight needs to be tailored by size and complexity.
For banks and the broader financial sector, the implication is that AI risk management is becoming a board-level expectation rather than an optional IT project. Bowman's remarks were delivered specifically to community banks, suggesting the Fed wants smaller institutions to adopt scalable versions of the same governance discipline expected of larger firms. The Fed's stated plan to continue hosting workshops and other events as part of its "ongoing commitment to identify and equip community banks with resources that may be necessary to combat cyber risks" points to more supervisory outreach ahead. The FSB comment process also means international AI adoption practices could eventually influence U.S. supervisory expectations.
The main limitation is that the dossier contains only one secondary source read in full, so the precise scope of any forthcoming regulatory action remains unclear. The report does not specify whether the Fed will issue formal guidance, modify examination procedures, or rely primarily on workshops and FSB work. It also does not quantify the increase in AI-related threats beyond Bowman's characterization of exponential growth. What to watch is whether the FSB's final AI sound practices document leads to concrete supervisory changes, and whether the Fed begins citing AI-specific cyber hygiene expectations in examination findings for community and regional banks.