AI-Enabled Knowledge Work in Banking: Start With a Use-Case Control Card

Describe the use, not the technology label

Record the business process, users, affected customers or stakeholders, input data, model or tool role, output destination, human decision, potential harm, and accountable owners. State whether the AI drafts, ranks, predicts, recommends, or executes. Capture third-party dependencies and the conditions under which the output must be rejected or escalated.

In April 2026, the Federal Reserve issued SR 26-2 with revised model risk management guidance, superseding SR 11-7 and emphasizing a risk-based approach tailored to an organization’s model profile, size, complexity, and use (Federal Reserve SR 26-2). Applicability depends on the institution and use; this article does not interpret supervisory obligations.

Sources: [1]

Build the control card

Use nine fields: intended decision, permitted users, approved data, model role, required source evidence, validation or testing route, human review, monitoring signal, and stop condition. Link the card to current policies and system versions. If the workflow relies on a vendor claim, record the evidence available to the institution rather than copying the vendor’s assurance language.

NIST’s voluntary AI RMF provides govern, map, measure, and manage functions for use-case-aware risk work (NIST AI RMF). It can help organize questions across the lifecycle but does not certify a banking control or replace applicable regulation, supervisory guidance, or institution-specific standards.

Sources: [2]

Worked artifact: credit-policy briefing

Imagine a synthetic internal assistant that drafts a weekly briefing from approved credit-policy documents. The card permits summarization for trained policy staff and prohibits customer communication or credit decisions. Inputs must come from a versioned repository. Every material statement requires a source reference, and the reviewer must check effective dates and conflicts.

A test set includes current rules, superseded versions, an absent answer, and contradictory regional guidance. The stop condition is any unsupported statement presented as current policy. When that condition occurs, the workflow returns to controlled testing. The evidence packet contains the source snapshot, test questions, outputs, reviewer dispositions, tool version, and release decision.

Revisit the card when context moves

Review the use case after model, source, permission, policy, vendor, or population changes. Monitor for missing citations, stale sources, override patterns, and use outside the approved destination. A passed test in one configuration does not establish continuing effectiveness or suitability for a different banking process.

Separate assessment evidence from authorization

A controlled work simulation can show how a participant handled sources, uncertainty, verification, and communication in that task. It cannot grant system access, approve a banking use case, or determine whether the person may perform a regulated activity. Store the observed evidence with its scenario, assistance, scoring method, and limitations, then let authorized people decide what follow-up is appropriate.

If the simulation omits a relevant control or the participant never had an opportunity to demonstrate it, mark the evidence as missing. Do not convert an absent signal into a failure or claim that the assessment covered the entire operating role.

This page is educational and is not legal, regulatory, compliance, credit, or model-risk advice. It does not claim that Two Prune covers banking controls or that an assessment proves workplace performance. Banking organizations must use their current obligations, policies, qualified professionals, and operating evidence.

Where a workflow crosses entities or jurisdictions, create separate card entries for materially different rules, data, and decision owners. A global label should not hide local operating differences. If the required authority is uncertain, keep the use case in investigation or testing until the appropriate banking owner resolves it.