US Treasury Concludes AI Risk Initiative
The U.S. Treasury has concluded a major public-private initiative as part of its AI Action Plan. The effort focused on bolstering cybersecurity and improving risk management for the use of artificial intelligence in the financial services sector. The initiative aligns with broader national priorities for managing the deployment of AI technologies.
- The initiative was led by the Artificial Intelligence Executive Oversight Group (AIEOG), a public-private partnership between the Treasury's Financial and Banking Information Infrastructure Committee (FBIIC) and the Financial Services Sector Coordinating Council (FSSCC). This group brought together senior executives from financial institutions, including banks and payment firms, alongside federal and state regulators to develop the resources. - The first two of six resources were released in February 2026: an "AI Lexicon" to create a common vocabulary for technical, legal, and compliance teams, and a "Financial Services AI Risk Management Framework" (FS AI RMF). The framework is a sector-specific adaptation of the National Institute of Standards and Technology's (NIST) AI RMF, tailored to the financial industry's regulatory and consumer protection landscape. - The FS AI RMF includes practical tools for product and risk teams, such as a questionnaire to assess a firm's AI maturity and a matrix of 230 control objectives to manage risks throughout the AI model's lifecycle. It is designed to be scalable for institutions of all sizes, from large multinational banks to smaller fintechs. - Forthcoming resources from the initiative will specifically address fraud and digital identity, key areas of focus for payment and infrastructure leaders. These workstreams are expected to provide guidance on mitigating AI-driven threats like synthetic identity fraud and deepfakes, and on strengthening digital identity verification processes. - The other upcoming publications will focus on AI governance and accountability, data integrity and security, and operational resilience. This reflects an integrated approach to AI risk, addressing the entire lifecycle from data inputs to model governance and incident response. - Security and risk management experts have emphasized that for the guidance to be effective, it must include concrete guardrails for adversarial testing, model monitoring, and real-time identity validation. There is a focus on addressing specific risks such as the data poisoning of training pipelines and adversarial prompt injection. - The guidance is designed to be practical and implementation-focused rather than a set of prescriptive regulations. This approach is intended to help small and mid-sized institutions, in particular, adopt AI more securely without creating excessive compliance burdens. - This initiative is a direct output of the President's AI Action Plan, which calls for strengthening the security of AI models and data within the financial sector and promoting best practices for secure deployment.
