AI for credit risk management: the borrowers it says it cannot answer for

AI for credit risk management is judged by what it does when the evidence runs out, and the accuracy of an AI portfolio answer is not one number. When agents read a whole commercial book against a question, every borrower should end in one of three states. It is counted, with the passage that puts it in. It is cleared, with the passage that keeps it out. Or it is not in file, because the documents do not answer the question. A tool that collapses the third state into either of the others, by guessing or by silently dropping the borrower, produces a total that looks complete and is not. Botminds' Commercial Loan Portfolio Analysis is built the other way: its credit file reader never states anything about a borrower without a passage and marks “not in file” instead of guessing, and the answer names those borrowers so their relationship managers can be asked.

Use of AI in credit risk management: three kinds, three different risks

“AI for credit risk management” covers three different tools, and a buyer should know which one is on the table before asking how accurate it is. The first is the statistical model: probability-of-default scores, rating models, early-warning scores built on payment and account data. The second is the document reader: software that reads statements, memos and agreements and returns what they say. The third is the agent: software that plans a task, calls other tools and drafts an output, such as a board summary. Banks have used the first for decades; the Treasury's 2024 report notes that “AI has long been deployed in the financial services sector in a variety of ways, including credit underwriting” (Treasury, 2024).

The supervisory gap matters for the buyer. The April 2026 model risk guidance says “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance” (OCC Bulletin 2026-13). That leaves no federal checklist for the second and third kinds, but it does not leave the bank without duties: under the third-party guidance, “the use of third parties does not diminish or remove banking organizations' responsibilities” (88 FR 37920). A bank buying a document reader or an agent has to bring its own tests. Commercial Loan Portfolio Analysis is the second and third kind: it reads files and drafts answers about a commercial book; it does not score borrowers or set ratings.

Three answers for every borrower: in, out, or not in file

A portfolio question is a classification of every relationship, and a classification with no “unknown” class forces unknowns into the other two. A spreadsheet sent to relationship managers does this by default. A borrower nobody replied about is indistinguishable from a borrower that does not import. A code screen does it too, because an unflagged borrower looks cleared. Software that reads files can make the same mistake faster, by inferring from a borrower's industry or from a similar company what its file does not say.

The safeguard is structural. Every borrower in an answer carries a passage or a reason it has none. At the fictional sample bank used in this guide, the board's question on imported inputs ended with 63 borrowers counted, 351 relationships in trade-sensitive codes cleared, and 4 borrowers not in file. The four were Sycamore Cabinetry, Elmhurst Medical Supply, Westlake Sign Company and Dunmore Pet Products, with $20.3M committed between them. The answer's own words: “The files do not say where their inputs come from, so they are not counted; their RMs have been asked.”

AI hallucination in finance: why a confident guess is the expensive error

Generative AI's best-known failure is a confident answer that is wrong. The US Treasury's 2024 report describes such systems as susceptible to “AI hallucinations,” “producing confidently stated but incorrect output” (Treasury, 2024). In a portfolio answer that error has a particular shape. The total is plausible, so nobody checks it, and the borrowers that were guessed are invisible. The OCC's spring 2026 outlook names the governance problem: genAI and agentic AI bring challenges such as “lack of explainability,” and banks are using them “with guardrails and human-in-the-loop accountability” (OCC, 2026).

Supervisors judge credit errors asymmetrically, and portfolio answers should too. In checking risk ratings, the OCC tells examiners to “be most concerned when rating inaccuracies understate risk” (Rating Credit Risk). A board told that 59 borrowers depend on imports, when four more do and nobody knows it, has had its risk understated in exactly that way. A board told “63, plus four we cannot yet confirm” has been given the true state of knowledge. The second answer is less tidy and more accurate.

The files do not say where their inputs come from, so they are not counted; their RMs have been asked.

The sample bank’s board answer, on the four borrowers its files could not answer for

What “not in file” looked like on the import question

On the sample bank's question, “not in file” was a short list with a clear next step, not a failure. The answer writer put the four names in a highlighted box on the answer, in the board summary's footnotes (“4 borrowers with no supplier information in file — not counted”), and in the evidence table under their own filter. Their RMs received the question by name. The Federal Reserve's manual expects banks to run “a file documentation tickler system to help bank personnel obtain updated information on borrowers” (CBEM §2010.1). A not-in-file list is that tickler, generated by the question.

“Not in file” on the answer itself, beside the 63 that were counted

It also tells the bank something about its files. Four of 1,184 relationships silent on sourcing is a small gap. If a question about guarantor liquidity came back with forty silent files, the finding would be about the bank's documentation, not about guarantors. Either way, the list is the information the board needs to judge how far to trust the total.

Stale, conflicting and superseded files

Between a clear passage and no passage sits a third case: an answer from a document that may no longer be right. The OCC treats “stale financial statements, tax returns, or borrowing base certificates” as credit administration exceptions (OCC, 2026). An AI answer should treat them the same way: use the document, and say how old it is. At the sample bank, the hotel question found a guarantor whose latest personal financial statement was dated 30 June 2025. The loan stayed in the answer, marked “older than 12 months,” rather than being dropped or silently trusted.

What an answer cannot stand on yet, before anyone asks

Conflicts need a rule, written down in advance. The sample bank's reader prefers audited figures over memos and newer documents over older ones, and shows both when they disagree. A memo that describes a business the borrower has since changed by acquisition is flagged for credit review: nine such relationships were listed. And when audited statements lack a concentrations note, as 37 did, questions about customers and suppliers fall back to the memo and the field exam, and say so.

How to test an AI tool before using it for credit decisions

Test the unknowns as hard as the totals. A validator, or a portfolio manager on the first run, can check an AI answer with the same techniques loan review uses on ratings. Draw a sample, re-perform it from the file, and look for errors that understate risk. NIST's AI Risk Management Framework lists “valid and reliable” first among the characteristics of trustworthy AI (NIST AI RMF 1.0). For a reading task, valid means the passage says what the answer claims and reliable means the same file gives the same answer twice.

The model risk side of these checks, including whether a file-reading agent counts as a model under the April 2026 guidance, is set out in the second line's questions about an AI that reads loan files.

AI tools for credit risk management: what a buyer should look for

Look for evidence on every answer, an explicit “unknown” state, the bank's own definitions, totals that tie to the loan system, and hard limits on what the software may do. Everything else, including speed, follows from those. A demonstration on the vendor's data shows the first two quickly; the rest show only on the bank's own files, which is why a short trial on a past question the bank has already answered by hand is worth more than any benchmark.

Two questions separate serious tools from demonstrations. Ask what the tool did with the borrowers it could not answer for on the trial question, and ask to see one cleared borrower's passage. A tool that has no answer to the first, or clears borrowers on their industry code, will produce totals that look complete and are not. How such a tool connects to a core and a document archive is set out in loan portfolio analysis software that leaves your core where it is; what it should cost against the hand route is in loan portfolio monitoring software, priced.

What the board summary says about what it does not know

A board summary should state its unknowns in the same place as its totals, with a number, names on request and the action taken. At the sample bank the summary approved by the chief credit officer led with 63 borrowers and $611.4M committed. It then gave the 17 below covenant under stress, the five also maturing within a year, what the RMs are doing, and the four borrowers the files cannot answer for. Every number carried a footnote to its source. The approver could open any of the 63 at its passage.

That is the practical meaning of accuracy for a board deck. It is not a claim that the software is right 99% of the time. It is an answer where each number can be traced, each exclusion can be defended and each unknown is visible. The full morning is told in the board question, by the clock.

Questions people ask

Can AI read commercial credit files accurately?

It can find and quote the relevant passage in memos, reviews and statements, and the quote can be checked. Accuracy should be measured by re-performing a sample from the files, including borrowers the answer cleared, and by testing what the tool does when the answer is not in the file.

What is the best AI for credit analysis?

It depends on the job. For predicting default from account data, a validated statistical model; for reading what credit files say, a tool that cites the page behind every answer and reports the files it could not answer from. A general chat assistant without access to the bank's files and loan system can do neither for a real book.

Is generative AI covered by bank model risk guidance?

Not by the April 2026 interagency guidance, which says generative and agentic AI “are not within the scope of this guidance” and promises a request for information on AI. Third-party risk management and safety-and-soundness expectations still apply, so the bank has to test such tools itself.

Who is responsible when a vendor's AI gets a credit answer wrong?

The bank. The 2023 interagency guidance says using a third party “does not diminish or remove banking organizations' responsibilities to ensure that activities are performed in a safe and sound manner.” That is why a named person should approve any AI-drafted summary before it reaches the board.

What should happen when the credit file does not answer a portfolio question?

The borrower should be named, left out of the count and routed to the person who can find out, usually the relationship manager. Counting it, or dropping it silently, both misstate the answer.

Does a “not in file” list mean the bank's documentation is weak?

Not necessarily: credit files are built for underwriting, not for every question a board might later ask. A long list concentrated in one document type or one team, though, is worth raising with credit administration.