Every regional bank CIO has sat through the same board meeting. Someone forwards an article about a money-center bank’s new machine learning platform. Someone else asks, not unkindly, why the bank doesn’t have something like it. The CIO explains, again, that the bank in the article spent more than a decade rebuilding its entire technology stack around the cloud before any of its AI work became visible from the outside, and that a two-billion-dollar bank cannot replicate that timeline by writing a bigger check. The meeting moves on. Nothing changes. Six months later, the same article gets forwarded again, from a different board member, about a different bank.
This is not a story about AI. It is a story about benchmarking against the wrong company.
More than 4,300 FDIC-insured banks and another 4,000-plus credit unions operate in the United States, according to the FDIC’s and NCUA’s most recent counts. The overwhelming majority are not money-center institutions. They run core systems from vendors who release major updates twice a year. They have compliance teams of four people covering what a money-center bank covers with four hundred. Their technology budget for an entire year might equal what a top-tier bank spends on a single AI research team’s headcount. And yet the AI conversation in the industry press is written almost entirely for banks that don’t share these constraints, which leaves everyone else either paralyzed by comparison or reckless in overcorrection.
The gap is real, and it shows up in the numbers. As of 2024, roughly 79% of banks with more than $250 billion in assets had active generative AI projects underway, according to the OCC’s Spring 2025 Risk Perspective, compared with about 40% of institutions under $10 billion. That is a meaningful gap. It is also closing faster than most people assume. Cornerstone Advisors’ 2026 survey of more than 400 banks and credit unions found that 49% of community banks and 59% of credit unions had already deployed generative AI, roughly triple the adoption level from the year before. The gap you are worried about is shrinking under you while you worry about it.
Is AI actually different from every other technology wave that hit community banking a few years late and got absorbed anyway? Not really. Mobile deposit took a while. Real-time payments took a while. The pressure to look transformed right now, though, is different, and that pressure is doing more damage than the technology gap itself. Boards are approving AI budgets before anyone has answered the harder question of what the bank is actually trying to get done, and in which order.
The real risk isn’t falling behind
Falling behind on AI adoption is a manageable risk. Banks have managed it before, with online banking, with mobile, with instant payments, and survived fine by moving in year three or four of a trend instead of year one. The risk that isn’t manageable, the one that actually costs money and trust, is adopting AI out of sequence: buying tools before the underlying data is trustworthy, automating a decision before anyone has defined who is accountable for it, launching a pilot that generates a finding nobody at the bank can act on because the control framework around it doesn’t exist yet.
And here is the uncomfortable part. Even the biggest technology companies in the world are getting this wrong at scale. MIT’s widely cited State of AI in Business 2025 research, published by its NANDA initiative in August of that year, found that 95% of enterprise generative AI pilots deliver no measurable financial return. A separate breakdown in the same body of research showed that for custom, enterprise-grade AI tools, the exact category most banking use cases fall into, 60% of organizations evaluate them, 20% get as far as a pilot, and only 5% ever reach production. S&P Global Market Intelligence’s 2025 survey of more than a thousand technology and business leaders found that 42% of companies abandoned most of their AI
initiatives that year, more than double the 17% recorded in 2024. If Fortune 100 companies with unlimited budgets are failing this badly, the problem was never really about budget.
No off-the-shelf governance framework arrives pre-tuned for your core system, your examiner relationship, and your particular mix of legacy vendors. Not one. Nobody sells that, because it can’t be sold, it has to be built, and building it is unglamorous work that competes for the same budget line as the flashy pilot.
Here is where regional and community banks actually have an advantage nobody talks about: smaller, less siloed organizations can move faster on governance than sprawling ones, if leadership treats governance as sequencing rather than paperwork. A twelve-person technology team that agrees on five questions can move through them in a week. A twelve-thousand-person technology organization needs eighteen months of committee meetings to agree on the same five questions. Size is a liability for AI hype. It is an asset for AI discipline, if you use it.
What sequencing actually looks like
Five questions separate a use case worth funding from one that just sounds good in a slide deck, and they apply whether the use case is fraud detection or loan document review.
- Is the problem big enough?
- Is the data underneath it actually usable?
- Where does a human still have to look at the output before it becomes a decision?
- What controls need to exist around the model once it’s live?
- Can you actually measure whether it worked?
Is the problem big enough to matter. Not would this help, almost anything helps a little, but does solving it move a cost line, a risk exposure, or a revenue number that a board member would recognize by name. Fraud is an easy yes here. A slightly friendlier chatbot usually is not.
Is the data underneath it actually usable. This is where most projects quietly die, and it’s rarely dramatic. It’s a customer field that’s been populated three different ways by three different systems since 2011, and nobody flagged it because nobody needed it to be consistent until now. You find this out in week three of a pilot, not in the planning meeting, which is exactly why it needs to be asked in the planning meeting.
Where does a human still have to look at the output before it becomes a decision. Fraud scoring needs an analyst in the loop for the ambiguous cases. Document summarization for an underwriter needs a human sign-off before it becomes the file of record. Skip this question and you find out the hard way, usually from an examiner, sometimes from a customer complaint that reaches a regulator before it reaches you.
What controls need to exist around the model once it’s live. Not before. Once. This is where the ground actually shifted under the entire industry this year, and most banks have not caught up to it yet. For fifteen years, model risk management in US banking ran on SR 11-7, the joint Federal Reserve and OCC guidance issued in April 2011. On April 17, 2026, the Federal Reserve, the OCC, and the FDIC jointly replaced it with SR 26-2, a genuinely new rulebook covering how banks identify, validate, and govern the models they rely on. It is aimed most directly at institutions above $30 billion in assets, but examiners use it as the benchmark for sound practice industry-wide, the way SR 11-7 was treated for the fifteen years before it.
Here is the part that matters most for this conversation. SR 26-2 explicitly places generative and agentic AI outside its formal scope. The agencies called them too novel and too fast-moving to regulate with the same validation machinery built for credit scorecards, and told institutions to apply their own existing risk management practices instead. Read that again. The regulators just rewrote the entire model risk rulebook, and the technology every bank is racing to deploy right now is the one thing they explicitly declined to write rules for. Nobody is coming to hand you a governance framework for this. You have to build it, and you have to build it before the pilot, not after the exam.
Can you actually measure whether it worked. Not does the team like it; measure it. Baseline first, pilot second, comparison third. Skip the baseline, and you’ll be arguing about anecdotes in six months instead of looking at a number.
Fraud detection gets funded easily, because everyone already agrees fraud is expensive, and for good reason. Financial services fraud losses reached $12.5 billion in 2024, up 25% over the year before, with more than half of that fraud now involving AI on the attacker’s side, according to industry loss data compiled through McKinsey’s late-2025 banking analysis. Customer identity monitoring gets funded when an examiner asks a pointed question about it in the exam letter. Testing and quality assurance, the function nobody puts on a strategy slide, gets funded never, until a bad release reaches production and the decision gets made for you, at a much worse time and a much higher cost than if someone had asked for the budget a year earlier.
If you cannot say which cost line an AI project moves, or which specific control gap it closes, stop funding it. That’s not a harsh standard. It’s the standard your credit committee already applies to every loan over a certain size, and nobody accuses the credit committee of being anti-growth for asking the question.
The first step doesn’t need a vendor
None of this requires hiring a chief AI officer or signing a seven-figure platform contract before you’ve even mapped out where the value actually sits. It requires an afternoon, honestly, and a willingness to be specific instead of aspirational about which of your bank’s functions are ready and which aren’t.
Maveric built a scorecard that walks through this exact sequencing across thirty-six real use cases spanning nine banking functions, from fraud and KYC through lending, operations, compliance, testing, data, and cybersecurity. You tick the ones relevant to your bank, score each against the five questions above, and get back a ranked list instead of a wish list. It takes about the length of one skipped meeting, and it’s built to be shared with your risk lead, your operations head, and whoever else in your bank actually has visibility into functions you don’t. Open it here: AI Banking Scorecard
You don’t need a mega-bank’s decade or its balance sheet to make a disciplined first move. You need an honest answer to five questions, applied thirty-six times, and the willingness to build the one framework nobody, not even your regulator, has finished writing for you yet.
