AI in regulatory reporting is allowed, and it changes nothing about who answers for the report. No U.S. banking rule forbids a bank from using AI to prepare or review its Call Report, and none relieves the bank of responsibility for what AI produces: the instructions make the bank answerable for the accuracy of every figure whatever software it uses, the chief financial officer still declares the report correct, and directors still attest. The interagency model risk guidance issued in April 2026 leaves generative and agentic AI outside its scope, so a bank governs those tools through its own controls. Botminds' Call Report Analysis is an agentic solution built on that footing: agents run the FFIEC edits, decompose each swing and draft each explanation with its sources cited, and people accept, approve, release and sign.
The rules below are linked where they appear; where a figure comes from the solution, it is from its fictional sample bank, Corvane National Bank.
What an AI-drafted Call Report explanation must show to stand
- Every figure opens to its source
A journal entry, subledger line, payment or document behind each amount, so a reviewer can check rather than trust.
- The drivers add up to the movement
The unexplained remainder is shown, and an explanation cannot be accepted while it is above the bank's limit.
- The parts the FFIEC guidelines ask for
Why the condition exists, the amounts and dates, and the instruction relied on, in a narrative that stands alone.
- An independent check before a person reads it
A second process that tries to break the draft, with its reasons recorded.
- A person accepts, a different person approves
The AI neither accepts nor approves; the preparer and the reviewer are different people.
- No cause the data cannot support
Peer trends, market colour and last quarter's wording are never a driver without this quarter's evidence.
- The version of the tool that produced it
Prompt and model versions recorded with each draft, and changes tested before use.
- Nothing the agencies should not receive
Explanations go to the supervisors, so they name properties and loan numbers, not borrowers.
Can AI be used for regulatory reporting?
Yes. Nothing in the Call Report instructions, the FDIC's reporting rule or the agencies' examination guidance restricts how a bank produces its figures or drafts its explanations, provided the result is accurate and filed through software that meets the Central Data Repository's technical specifications. The agencies have, if anything, invited more technology. In December 2025 they acknowledged that some banks still prepare the Call Report with manual steps between the core system and the filing (call report mapping quotes the passage), and asked: "Are there current or emerging uses of technologies that the agencies should consider when reviewing the structure, content, or publication of the Call Report forms or instructions?" (Request for Information: Streamlining the Call Report). Comments closed on January 30, 2026; no follow-on proposal had been published by late October 2026.
What the agencies have not done is write AI-specific guidance for regulatory reports. The usable ground is the general rules, which apply to AI output exactly as they apply to a spreadsheet: the report must follow the instructions, quality edits must be corrected or explained, and preparation and review must sit with different people. Federal Reserve Governor Michelle Bowman made the point in a November 2024 speech: AI is not exempt from existing legal and regulatory requirements, and its use is not exempt from scrutiny (Bowman, November 22, 2024).
Who is responsible if AI makes a reporting error?
The bank, in full. The General Instructions say each bank is responsible for ensuring the data it reports each quarter fully and accurately reflect the requirements, and that this responsibility cannot be passed to software vendors, servicers or anyone else outside the bank (FFIEC 031 and 041 General Instructions). A wrong figure produced by an AI tool is the bank's wrong figure, subject to the same amendment rules, the same violation analysis and the same tiered penalties as any other.
Two signatures make the point personal. The chief financial officer, or the person performing that function, declares the report correct; at least three directors (two at a state nonmember bank) attest. A signer who cannot see how an AI-drafted explanation was produced, checked and approved is attesting to something they cannot examine. The practical test for any AI in the reporting chain is therefore whether it leaves the signers better able to stand behind the report, not just faster to produce it. What one call report error costs shows why the evidence matters when something goes wrong.
Is AI-generated regulatory reporting a model under SR 26-2?
The drafting is not covered by SR 26-2, and the rule-based checks are not models under it. The revised guidance on model risk management that the Federal Reserve, the OCC and the FDIC issued on April 17, 2026, which replaced SR 11-7, places generative and agentic AI models outside its scope because the technology is new and changing quickly, and it excludes from its definition of a model both simple arithmetic and deterministic rule-based processes that have no statistical, economic or financial theory behind them (SR 26-2 / OCC Bulletin 2026-13). It also says it is expected to be most relevant to banking organisations with more than $30 billion in assets.
For a Call Report workflow the split is clean. The FFIEC edits, the bank's house checks, the test that drivers add up to the movement and the release checks are deterministic rules, closer to controls than to models. The drafting of explanations is generative and falls to the bank's own governance. The agencies said they plan a request for information on model risk management that will consider banks' use of AI, including generative and agentic AI; it had not appeared in the Federal Register by late October 2026. Until it does, a bank's AI policy, its third-party risk management and its internal controls over financial reporting carry the weight.
How do regulators use AI on reported data?
To find what looks wrong, with people deciding what to do about it. The Government Accountability Office reported in May 2025 that the NCUA, the CFTC and the Federal Reserve use AI to help detect errors or outliers in data that institutions submit, and described one use precisely.
NCUA uses AI to predict the future value of items in Call Reports (the quarterly financial reports that credit unions must submit) and flag those that fall outside the predicted range.
GAO-25-107197, Artificial Intelligence: Use and Oversight in Financial Services, May 2025
The rest of the passage matters as much. When discrepancies are flagged, NCUA officials told the GAO, they ask the credit union to review the flagged items and correct them if necessary; and officials across the regulators said they were not using AI to make decisions autonomously or relying on it as a sole source of input (GAO-25-107197). The supervisors' own pattern is the one a bank can defend: the machine flags and proposes, a person decides, and the institution corrects its own data.
How supervisors use AI on reported data, and the same pattern inside the bank
Supervisors, as GAO describes them: Predicts expected values and flags items outside the range.
A bank's Call Report desk: Runs the edits, decomposes swings, drafts explanations and challenges them.
Supervisors, as GAO describes them: Staff; AI is not a sole source of input and makes no decision alone.
A bank's Call Report desk: An analyst accepts, a different manager approves, the signers sign.
Supervisors, as GAO describes them: The institution, after reviewing the flagged item.
A bank's Call Report desk: A person proposes a correction; another approves it. The AI changes no figure.
Supervisors, as GAO describes them: The institution's own history and peers.
A bank's Call Report desk: The bank's journals, subledgers and documents, with every figure cited.
What are the risks of AI in regulatory reporting?
The main risk is a confident number that is wrong, followed by a confident check that is wrong in the other direction. Research on language models and financial statements shows both. A 2025 preprint on tagging financial facts to the U.S. GAAP taxonomy found that models pulled numbers out of filings well but linked them to the right taxonomy concept poorly (FinTagging, arXiv 2505.20650), which is the Call Report problem exactly: reading an amount is easy, putting it on the right line is not. A 2026 preprint testing models as verifiers of financial statements found that nine of fourteen complete runs raised false alarms on 95 to 100 percent of clean statements, while one raised none (FinVerBench, arXiv 2605.29586; quoted in generative AI in financial reporting). Both are preprints, not peer reviewed, and neither measures any product; they are reasons to measure your own tool.
Three further risks are specific to reporting. The first is the one examiners already watch in automated systems: the OCC warns that automation can reduce manual error but introduce other risks, and that a bank which does not test its data flows from time to time can end up filing inaccurate reports (OCC, Regulatory Reporting; quoted in what is a topside adjustment). The second is explanation drift, an AI that reuses last quarter's reason because it reads well. The third is the wrong kind of evidence: a peer group's movement offered as the cause of the bank's own. Each has a control, and the controls belong in the tool rather than in a training deck.
Where AI fits in the Call Report, and where it should stop
AI is most useful where the work is finding and drafting, and least where it is deciding. The table below sorts a quarter's tasks into three kinds: rules a machine should run every time, drafts an AI can prepare, and judgements that stay with people.
A Call Report quarter, task by task: rule, AI draft, or person
| Task | Who does it | Why |
|---|---|---|
| Run the FFIEC validity and quality edits and house checks | A rule, on every draft | Deterministic; the earlier and more often, the cheaper the errors |
| Turn each failing edit into a plain sentence with its figures | AI draft | Saves reading edit logic; checked against the figures |
| Split each swing into drivers and show the residual | AI, checked by a rule | Finding the transactions is search; footing them is arithmetic |
| Draft the explanation to the guidelines | AI draft | Fast once the drivers are proved |
| Challenge the draft: foot, dates, wording | A second AI and rules | Separates writer from checker |
| Accept the explanation as true | Person: the analyst | Accountability under a name |
| Approve explanations and corrections | Person: a different manager | Independent review |
| Decide whether a past error needs amending | People, with the supervisor | Materiality is a judgement |
| Release, declare and attest | People: the Head, the CFO function, directors | Required by the instructions |
The line falls in the same place in the supervisors' own use of AI and in the instructions' requirements: a machine may find, flag and draft; a person decides and signs. One failed edit traced through the agents shows each row of that table on a single item.
How Call Report Analysis divides the work between agents and people
Seven agents do the mechanical work and none of them can finish it. The Edit agent runs the edits and writes each failure as a sentence; the Variance agent splits each swing into drivers from journals and subledgers and shows the residual; the Drafter writes to the FFIEC guidelines; the Skeptic tries to break each draft; the Recurrence agent rechecks anything carried forward; the Window watcher escalates what is unresolved at day 20; and a peer context agent shows public peer trends beside an item, labelled as context, never as a cause. The agents draft, decompose, challenge and escalate; they never change a figure, accept, approve, release or submit.
A docket of sentences, each with its draft or its challenge
The governance is written into settings rather than habit. Every agent run records its prompt and model version; the Skeptic passes a draft only at 0.85 confidence or above in the sample settings; and a new agent version is tested on the last quarter's set before a second administrator approves it. That last control answers the question most AI policies ask first, how a change to the tool is validated, in the form an examiner can read: the old version, the new one, the replay and the approval.
People and agents on one trail, with versions
Treasury's 2024 report on AI in financial services recommended that firms review AI use cases for compliance with existing law before they deploy them and re-evaluate periodically (U.S. Treasury, December 2024). For a Call Report tool that review is short if the tool keeps people deciding and leaves evidence behind it. To see it on your own last quarter, start from Call Report Analysis.
How to approve an AI tool for the reporting desk
Treat it as a change to a control over financial reporting, because that is what it is. The approval does not need a new framework: the bank's AI policy, its third-party risk management and the change-management standard the OCC expects regulatory reporting policies to cover already ask the right questions. What they need is evidence specific to the Call Report, gathered before the tool touches a live window.
Four pieces of evidence settle most approvals. An inventory entry that says what the tool does and does not do, in the terms of the table above. A replay on a filed quarter, scored against what the bank filed and what its Call Report analyst accepted, with pass marks set in advance. A change-control path for the tool itself, so a new prompt or model version is tested before it drafts a live explanation. And a quality assurance review after the first live filing that reads the trail and confirms the people-only steps were taken by people.
A new agent version reaches a live window only after a replay and a second approval
A person decides
Owner proposes the changeA new prompt, model or threshold, with the reason, in the solution's settings.
Agent
Replay on the last quarterThe new version drafts and challenges last quarter's set; results are compared with the old version and with what was filed.
Never: drafts a live explanation before approval
A person decides
Second administrator approvesReads the replay, approves or returns the change; the version number moves.
Agent
Live, with its version recordedEvery draft and challenge carries the version that produced it.
Never: accepts, approves, releases or submits
A person decides
Quality assurance after filingChecks that each acceptance and approval was a person, and a different one.
Questions people ask
Do regulators allow AI in Call Reports?
They neither allow nor forbid it explicitly. The instructions require accurate data, resolved edits and a signed declaration, however the report is produced, and the agencies' December 2025 request for information asked the industry which technologies they should consider in reviewing the Call Report.
Does the FDTA data standards rule change how banks file with AI?
Not yet. The joint data standards under the Financial Data Transparency Act took effect on October 1, 2026, but the agencies said that at the effective date the rule "will not change any reporting requirements without further action by the agencies." Machine-readable formats come later, report by report.
Can an AI tool file the Call Report?
A bank can use software to transmit its report to the Central Data Repository, and must if it files electronically, but the submission follows the bank's release and the CFO's dated signature. In Call Report Analysis the agents never release or submit; the bank's regulatory reporting system transmits the approved report.
Should the AI's explanation mention that it was AI-drafted?
No rule requires it. The agency analyst judges the explanation on whether it is sufficient, accurate and complete. What should be recorded, inside the bank, is who accepted and approved it and which version of the tool drafted it, because that is what internal audit and examiners will ask.
Is AI in regulatory reporting only for large banks?
No. The model risk guidance is aimed mainly at banks above $30 billion, but every insured bank files a Call Report and every one is responsible for it. Smaller desks, where one or two people both prepare and review, may gain most from a second, independent check.