Eliza Ward: Hey — you looked at the Odense finding before this?
Brian Reed: Yeah. Sat with it a while, actually.
Eliza Ward: What's your read?
Brian Reed: So — let me see if I can say this right. Forty-seven percent of Odense's municipal employees were pasting sensitive citizen data into public AI tools. Before any approved system existed. And they weren't breaking rules — because there weren't any.
Eliza Ward: The policy chased them.
Brian Reed: Which means by the time governance showed up, the behavior was already baked in. And I think that's the actual shape of the bank problem — not 'will AI arrive' but 'it's already there and nobody's counted it yet.'
Eliza Ward: Right — and the SEC isn't waiting for the count. Items 101, 105, 303 of Regulation S-K. Material AI use, disclose it. Meanwhile the Fed, OCC, FDIC dropped revised guidance in April 2026 that literally excluded generative AI from SR 11-7 scope.
Brian Reed: The part I don't get — how do you disclose what you haven't inventoried, under a framework that just officially stopped covering the technology?
Eliza Ward: That's the actual thing that shifted, though — because the old story was rogue employees opening a personal ChatGPT tab. That's not the new story. Think of it like... your company approved a word processor years ago. One day the word processor quietly gains the ability to read and summarize every document you type. You never approved that feature. It just arrived.
Brian Reed: The procurement trigger never fired.
Eliza Ward: Right. And the software was already approved — for a different purpose. So no new approval cycle. No one flags it.
Brian Reed: Okay, so — make it concrete. What does that actually look like inside a bank?
Eliza Ward: A bank has 8,000 customer service reps using a CRM. Standard renewal, nothing dramatic. Vendor pushes an update — now there's an embedded AI assistant summarizing account notes for every rep. The bank did not approve the AI. It approved the CRM renewal. Those are not the same decision, but only one of them got a signature.
Brian Reed: And 8,000 reps are now running it — before anyone's noticed. So when did it 'deploy,' legally? The moment the update landed? The first time a rep clicked it?
Eliza Ward: Nobody actually knows. That's — wait, that's not me hedging, that's genuinely unresolved. And that ambiguity matters because whoever owns the deployment moment owns the governance obligation. And right now that's — I mean, SR 11-7 was the framework that would've assigned that obligation. April 4, 2011, that guidance. Model inventory, validation, monitoring. The Fed, OCC, and FDIC just superseded it in April 2026 and explicitly cut generative AI out of scope.
Brian Reed: So the framework that would have told someone 'this is your problem to track' — that framework just said 'not this technology.' Which means the CRM scenario, the 8,000 reps — who do they even escalate to?
Eliza Ward: That's the part we don't have an answer to yet. The governance obligation exists somewhere. It just hasn't been assigned.
Brian Reed: And that's the part where I want to push back on a take that's been going around — this idea that the April 2026 exclusion was pragmatic regulatory humility. That Bowman's May roundtable statement was the Fed being honest about its limits. I mean, I've heard that framing. I've partly believed it.
Eliza Ward: What's wrong with it?
Brian Reed: Bowman's language was — okay, she said SR 11-7's validation machinery doesn't fit generative and agentic AI's novel and rapidly evolving characteristics. That's real. That's a scoping problem. But the consequence of that honest admission is that the Fed, OCC, and FDIC together — all three — issued revised guidance that left zero federal model risk framework covering the exact technology banks are deploying right now.
Eliza Ward: Right — and I'd actually separate those two things more sharply. 'SR 11-7 doesn't technically apply' is a scoping decision. 'We have no replacement framework' is a supervision decision. Bowman described the first one. But from inside a bank compliance function — do those actually feel different?
Brian Reed: No. No, I don't think they do.
Eliza Ward: And FSOC created a working group — not rules. A standing interagency AI working group with no specified timeline, no content commitment. So the pragmatic-humility framing sort of... I mean, it converts a structural absence into a virtue? The machinery didn't fit, so they removed it, and there's nothing underneath.
Brian Reed: I'll say — this is me guessing at intent — but it looks less like humility and more like the Fed stepping back while the SEC's Items 101, 105, and 303 stay fully armed. No carve-out, no materiality clarification for generative AI. That clock did not stop in April 2026.
Eliza Ward: Which is — wait, that's the thing that should make people uncomfortable about the 'pragmatic' read. You can't call it pragmatic when one regulator quietly exits and the other one doesn't move at all. That's not coordinated humility. That's a gap.
Brian Reed: And the compliance officer who gets the SEC comment letter asking 'describe every material AI system' — that person is sitting in the middle of that gap. We'll get to exactly what their options are, and neither one is clean.
Eliza Ward: And that person — the compliance officer with the SEC comment letter — their two options are both bad. Disclose incompletely, you're exposed for omission. Disclose fully, you're now on record saying 'we use AI systems we cannot govern.'
Brian Reed: That second one — hang on — that's actually the worse outcome? You've just handed the SEC a confession.
Eliza Ward: Under Items 101, 105, and 303, yeah. You disclosed. You also admitted you can't produce an auditable inventory. That's not a clean filing — that's a materiality assessment built on a gap you've now named out loud.
Brian Reed: So what does that compliance officer actually point to? Like — what's the framework they're working from when they try to build the inventory in the first place?
Eliza Ward: NIST AI Risk Management Framework. That's the thing most U.S. banks cite. Treasury adapted it for financial services. But — it's voluntary, and genuinely messy. The OCC applies it differently than the CFPB applies it differently than FinCEN.
Brian Reed: So a shared vocabulary, but not a shared standard. The NIST AI RMF gives everyone the same words — 'govern, map, measure, manage' — and then five different regulators decide independently what those words require. OCC, Federal Reserve, FDIC, CFPB, FinCEN. That's — I mean, that's not coordination. That's the appearance of coordination.
Eliza Ward: The CFPB's AI circular is its own layer entirely — no coordination with the prudential regulators on timing or substance. So that compliance officer isn't navigating one fragmented framework. They're navigating five distinct governance layers with no integrating structure underneath.
Brian Reed: And their SVP wants an answer by end of quarter. That person's call — what to disclose, how to word it, what to escalate — that happens before any enforcement action. Before any litigation. It's genuinely unguided.
Eliza Ward: What to watch: does any bank's public SEC filing in the next reporting cycle actually name embedded vendor AI as a material risk? That's the concrete signal. If they do — and they word it carefully — that's legal counsel deciding the confession is safer than the silence.
Brian Reed: And if that filing lands — if some bank actually names embedded vendor AI as a material risk — I don't think it teaches the next bank what compliance looks like. I think it teaches them what the liability looks like. Those are different lessons.
Eliza Ward: Wait — say that again.
Brian Reed: The first enforcement action — SEC-driven, prudential, whatever it is — the institution on the receiving end didn't get there by doing something obviously wrong. They got there because the April 2026 revised guidance left generative AI outside SR 11-7, the SEC's Items 101, 105, and 303 stayed unamended, and somebody had to file something. So the action doesn't clarify what compliance requires. It clarifies that the gap between regulatory intent and what a bank can actually document — that gap itself is the exposure.
Eliza Ward: Which means 'we excluded it because it doesn't fit old validation machinery' is — I mean, operationally — indistinguishable from 'we left it unregulated.' Bowman said one thing. The consequence is the other.
Brian Reed: And no FSOC working group timeline changes that. The question I don't have an answer to is: does the first action come from the SEC asking about a disclosure, or from a prudential examiner asking about a model that isn't in any inventory? Because those are different sequences with different institutions on the hook first.
