Our IT Department suggested we approve an AI policy, basically restricting it for all employees. I haven't found examples of other banks doing this. Are there other banks out there that have put together an AI policy?

basically restricting it for all employees

I am not sure what that means. Using AI in an official capacity to perform bank functions? What does that really mean? They cannot use Bing or Google, which are both now powered using AI?

If you're talking about using AI-powered models (either vended or home-grown), shouldn't this already be covered by your model risk policy?

If you're talking about employees using AI applications, like ChapGPT or Google Bard, to perform their job functions, some banks are banning this because of privacy and information security issues. These generative AI tools retain everything you use to prompt them, which could release customer data or trade secrets. According to a recent A-Team RegTech Insight I read, several large banks have banned staff from using ChatGPT and other generative AI because of these concerns. In addition, Italy has banned ChatGPT because of privacy concerns.

There are also concerns about the ability to patent inventions, obtain trade secret protection, or copyright content that was generated by AI. The US Copyright Office will only register original works of authorship created by a human. Similarly, US patent law only protects inventions made by humans.

Trade secret protection may be applicable, but with two qualifications. First, trade secret status does not prevent reverse engineering. Second, the privacy risks with use of commercial AI may result in trade secret information feed into an AI being returned as an answer to someone else's question.

Most AML/Sanctions systems use AI in some manner.

Marketing may use the heck out it when it comes doctoring photos for ads so I would be cautious about a wide ban and the BSA note is also of interest. There will be productive uses. You'd be better defining when it could not be used.

Should a risk category about AI be considered in a bank's fair lending risk assessment?

I would think so if you are using it.

Even if you are not, do regulators expect you to recognize and address it? For example, we are not using it for lending decisions, so the risk would be considered low.

i have added AI to the ID Theft Prevention Program