Congress orders financial regulators to police AI—but leaves liability questions unanswered

What it does

This bill amends financial regulation to address risks posed by artificial intelligence (AI) in the financial sector. It directs the Financial Stability Oversight Council to research AI use by financial institutions, identify threats to financial stability (including deepfakes, AI agents, and infrastructure concentration), and submit a report within 180 days with recommendations for regulatory gaps. It also requires the SEC to issue rules within 180 days mandating that securities firms, brokers, and exchanges implement AI governance policies covering testing, deployment, monitoring, and human oversight. The bill does not create new restrictions on AI use itself—it creates oversight, reporting, and governance requirements for financial regulators and regulated entities.

Why we flagged it

The bill's core function is to establish oversight mechanisms and governance requirements for AI use in financial services. It is not a prohibition, subsidy, or carve-out—it is a regulatory process bill that mandates study, reporting, and rule-making by existing agencies.

What the text implies

• The 180-day reporting and rule-making deadlines are aggressive and may result in preliminary or incomplete guidance, creating regulatory uncertainty for financial institutions during the transition period.
• The bill references the NSA/FBI/CISA Cybersecurity Information Sheet (Sept 12, 2023) as a model for recommendations, potentially embedding classified or sensitive cybersecurity standards into financial regulation without explicit congressional review.

The full analysis lists 5 implications of this text.

Who stands to gain

financial technology and AI compliance software vendors; large financial institutions with compliance infrastructure; consulting firms specializing in regulatory compliance