Financial institutions that want examiners to consider certain activities should be prepared to demonstrate the activities' qualifications.
Interagency Questions and Answers Regarding Community Reinvestment, § __.12(h)-8
CRA compliance AI is allowed: nothing in the Community Reinvestment Act, the agencies' CRA regulations or the interagency Q&A says who or what may read a loan file, geocode an address or draft a performance context. What the rules do say applies to any method. The bank must be able to demonstrate why each activity qualifies; the data it collects and reports must be accurate, and examiners will test it against loan files; and a person at the bank decides what the bank claims. Revised interagency model risk guidance issued on 17 April 2026 places generative and agentic AI outside its scope while telling banks to govern such tools through their own risk management, and it is aimed at banks over $30 billion. The practical test for AI in CRA work is therefore the examiner's: can the file show the document, the passage, the rule and the person? Botminds' CRA Compliance is built around that test. Its agents quote the deciding passage beside the rule, a second agent argues against every yes, uncertain items go to a person, and two named people decide each one.
Can AI be used for CRA compliance?
Yes, for the parts of the work that are reading, matching and drafting. A CRA program spends most of its hours on those: finding the regulatory agreement in a loan file and reading it for units, income limits and term; placing an address in a census tract; checking a reported loan amount against the note; logging and answering public comments; writing an assessment area's performance context. None of those steps is reserved to a human by regulation. Federal regulators use AI themselves: the GAO reported in 2025 that federal financial regulators had started to use AI in their own oversight of banks and markets, and that institutions' use of AI brings benefits and risks alike (GAO-25-107197).
What is reserved is accountability. The bank decides what it claims, signs its data submission and answers for both in the evaluation. AI that proposes, with its evidence, and leaves the decision to named people fits that structure. AI that decides, or that cannot show why, does not, whatever its accuracy.
What each CRA rule asks of a machine-prepared file
The obligations are the same for a qualification typed by an analyst and one proposed by an agent. Read rule by rule, they amount to a specification for any AI used in the work.
What the CRA rules ask of AI-prepared work, rule by rule
- Show why each activity qualifies
Q&A § __.12(h)-8: be "prepared to demonstrate the activities' qualifications". The file needs the source document and the passage, not just the answer.
- Apply the rule in force, and say which
The 1995 rules in appendix G to 12 CFR 25, 228 or 345 and the 2016 Q&A. The main eCFR text of those parts is the enjoined 2023 rule.
- Report accurate data
12 CFR 25.42: amount, location and revenue indicator for each small business and farm loan. Examiners "must validate the accuracy of the data".
- Count each activity once
25.12(h)(2)(i) and 25.23(b): no community development loan that is already a reported retail loan, except multifamily; no activity in two tests.
- Keep the public file clean
25.43: comments that reflect adversely on anyone other than the bank stay out; replies are the bank’s.
- Keep confidential what the statute keeps confidential
12 U.S.C. 2906(c): names of customers and employees go in the confidential section of an evaluation, not the public narrative.
- Leave the decision with the bank
The bank, not a vendor or a tool, claims the activity and signs the submission; examiners verify what it claims.
Do examiners accept AI-prepared CRA data?
Examiners do not accept or reject data by how it was prepared; they test it. For banks that collect or report CRA data, the FDIC says "examiners must validate the accuracy of the data", and its large-bank procedures have examiners test a sample of loan files against what was reported. Where a bank has analyzed its own performance, "examiners may use those analyses, after verifying their accuracy and reliability, and should supplement those analyses when questions are raised" (FDIC manual XI-4).
That is the standard AI-prepared work has to meet: verifiable accuracy, with the evidence at hand. The software errors examiners already cite are a warning about automation without checks. In 2024 Federal Reserve examiners traced wrong loan amounts to software that read the wrong fields in the core system, and recommended that banks periodically verify "the accuracy of CRA data generated or input by software systems" (Consumer Compliance Outlook, 2025). An AI tool is a software system in that sentence.
Does model risk guidance apply to CRA tools?
The interagency guidance revised on 17 April 2026 mostly does not, but its principles are a sensible checklist. The FDIC, OCC and Federal Reserve issued it "to set forth a risk-based approach to model risk management" and rescinded the earlier guidance. It describes itself as setting no enforceable standards, says it matters most to banks with more than $30 billion in assets (FDIC FIL, April 2026), and puts generative and agentic AI outside its scope altogether, leaving the controls for those tools to each bank's own risk management and governance (revised guidance, footnote 3; the agencies' exact words are quoted inthe customer risk rating model guide).
Which 2026 guidance reaches a CRA AI tool, and what it asks
| Guidance | Status | Does it reach a CRA AI tool? | What it asks |
|---|---|---|---|
| Interagency model risk management guidance | Revised 17 April 2026; not enforceable standards | Generative and agentic AI excluded; aimed at banks over $30 billion | Governance proportionate to risk; for vendor models, understand the design, monitor outcomes |
| Interagency third-party risk management guidance | 2023 guidance in force; a principles-based replacement proposed 11 September 2026 | Yes, if the tool comes from a vendor | Risk management tailored to the relationship; the bank stays responsible for compliance |
| CRA regulation and Q&A | In force (1995 rules, 2016 Q&A) | Yes, for every output it produces | Demonstrable qualification, accurate data, one count per activity |
| NIST AI Risk Management Framework | Voluntary | Yes, as a reference | "valid and reliable", "accountable and transparent", "explainable and interpretable" |
The vendor section of the model risk guidance is the most useful part for a CRA buyer, even below $30 billion. "Sound practice includes developing an understanding of the vendor model, including its conceptual soundness, design, development data, and performance", and "conducting ongoing monitoring and outcome analysis to assess whether vendor models are accurate, remain fit for purpose, and continue to be reliable." For a CRA tool, outcome analysis means comparing its proposals with what the bank's people decided, area by area and purpose by purpose.
Is an AI CRA tool a model?
Under the 2026 definition, usually not in the guidance's sense. A model there is a complex quantitative method that uses statistical, economic or financial theory to turn input data into quantitative estimates, and software that applies fixed rules with no such theory behind it is excluded (the definition is quoted in full inthe customer risk rating model guide). A rules engine that applies the CRA data edits is outside it as deterministic; a language-model agent that reads a regulatory agreement is generative AI, outside it by footnote 3. Neither exclusion means no oversight. The guidance sends banks back to their own governance, and the CRA rules still apply to every output.
What are the risks of AI in CRA?
Five, and each has a control that can be seen on screen. The best measured is invention. A peer-reviewed study of commercial AI legal research tools, which retrieve sources before answering, found that each one invented or misstated law on 17% to 33% of the questions put to it (Magesh et al., Journal of Empirical Legal Studies, 2025). A CRA tool that paraphrases a regulatory agreement can invent a restriction the same way.
Why AI in CRA work needs a quotation, a threshold and a person
17–33%
of answers from commercial AI legal research tools were hallucinated in a peer-reviewed test
$30B
the asset size above which the 2026 model risk guidance is expected to be most relevant
2people
on every qualification in CRA Compliance: one accepts, a different one signs
Five risks of AI in CRA compliance, and the control for each
The risk in CRA work: A restriction, unit count or term that is not in the document.
A control you can see: The tool quotes the passage with its page and never paraphrases it; a person reads the quote.
The risk in CRA work: An illegible scan read as text; the wrong document treated as the source.
A control you can see: Illegible pages are marked and sent back for a new scan; the source document is named on the decision.
The risk in CRA work: Definitions from the enjoined 2023 rule, which is what the main eCFR text shows.
A control you can see: A versioned rule set, recorded on every decision.
The risk in CRA work: A plausible purpose accepted without evidence, as with a clinic in the right tract.
A control you can see: A second agent argues against every yes; low confidence is always handed to a person.
The risk in CRA work: Decisions made in bulk with no one able to say why.
A control you can see: One person accepts, a different person signs, one item at a time, with reason codes.
Who signs an AI-proposed CRA activity?
A person at the bank, and preferably two different people for preparing and approving. In CRA Compliance a CRA data analyst accepts, edits or rejects each proposal with a reason code and signs nothing; the CRA officer signs, one at a time; the person who accepted an item can never sign it; and bulk signing of qualifications is off by policy. Agents read, place, propose, challenge and draft; they never sign, file, publish to the public file or change a plan.
In CRA Compliance, every step listed, and an agent that argues against the yes
How do you audit an AI CRA qualification?
The same way as a human one, with better material. An auditor needs to see, for each activity: the source document and the passage relied on; the rule and its version; the tool's proposal and confidence; who accepted it, with what reason, and who signed; and any override. With that, three tests are possible. Re-perform a sample from the documents and compare. Replay a closed year with the bank's past decisions held back and read every disagreement. And measure agreement between the tool and the bank's reviewers by category, as described in CRA community development services examples, so that low-agreement categories are always sent to a person.
The audit trail and the examiner pack in CRA Compliance
Can AI geocode CRA loans?
Geocoding itself is a lookup against Census Bureau files, and needs no AI. Where AI helps is in the step before it, the one examiners keep citing: choosing the right address. For a small business loan, the regulation locates the loan at the main business facility, or wherever the borrower says the proceeds will be applied, which is often stated in the credit memo rather than the address field. An agent that reads the memo can propose the right address and flag a mismatch with the field. How tract income levels then change over time is set out in the LMI census tract lookup guide.
For a buyer comparing products, the inputs and questions in CRA management software for banks apply to AI tools as to any other: what does the system show when an examiner asks why?
Questions people ask
Do I have to tell examiners that AI prepared our CRA file?
No CRA rule requires a disclosure of the method. Examiners will ask how activities were qualified and data were checked, and a bank should be able to describe its process, including any tools, and show the evidence for each decision.
Can AI write the CRA performance context?
It can draft it. Examiners consider demographic and economic data, community information and the bank's own capacity, and they do their own research and community contacts, so every sentence should trace to a source and a person should approve the text. Customer and employee names belong nowhere in it.
Does the 2026 model risk guidance apply to banks under $30 billion?
Generally not, unless a bank has significant exposure to model risk. The guidance says models at such banks are typically governed by internal risk management appropriate to their size, and that it does not set enforceable standards.
Can an AI tool decide CRA eligibility on its own?
It should not. The bank is accountable for what it claims, and examiners verify each activity. A tool should propose, with the passage and the rule, and a person should decide; uncertain items should always go to a person.
Is it safe to send loan files to an AI tool?
That is a third-party and information security question as much as an AI one: where the documents go, who can see them and how long they are kept. The agencies' third-party guidance applies to a vendor-hosted tool, and the bank remains responsible for compliance whoever runs it.
What is agentic AI in CRA compliance?
Software agents that carry out steps of the work, such as finding a document, reading it, geocoding the property and proposing a qualification, and hand the result to a person. The 2026 model risk guidance names agentic AI and leaves its governance to the bank's own practices.