The Governance Gap in Lender AI Adoption

The Flock story is worth reading closely. On September 16, 2026, Propmodo reported that, since the start of 2026, more than 50 cities and counties canceled or deactivated automated license plate readers. On September 14, 2026, HousingWire reported that Flock’s reported reach exceeded 6,000 communities, including private neighborhoods and homeowners associations.

The technologies are different, but the governance lesson travels. The bigger risk in lender artificial intelligence (AI) adoption right now is the governance gap. It’s the distance between what a system does and what an institution can document, explain, audit, and govern.

That’s the governance gap, and the fundamental question that needs to be addressed is, “How does this work, and what happens to the data?”

What the Flock Backlash Reveals About Governance

On September 16, 2026, Propmodo described automated license plate readers that photograph and identify passing vehicles. The publication reported that resulting data can enter searchable networks accessible beyond the jurisdiction that deployed the cameras.

Propmodo editor Franco Faraudo recommended documenting collection, retention, access, purpose, and disposition. That is a sound governance standard. It’s his recommendation, not a statement of resident expectations or a legal requirement.

A lender’s standard must go further. A camera network presents a disclosure and data-governance problem. An AI-supported draw workflow can influence a documented credit action that an examiner may later review.

On September 14, 2026, HousingWire reported that homeowners association documents may predate this technology. That leaves buyers and agents asking questions after deployment.

AI adoption can become a series of decisions that don’t always feel like decisions. What data enters the system? Who can access it?

What does the reviewer see? How are exceptions cleared? What record remains?

The 2026 Guidance Leaves the Standard to Lenders

On April 17, 2026, Office of the Comptroller of the Currency (OCC) Bulletin 2026-13 replaced OCC’s 2011 guidance. Federal Reserve Supervisory Letter (SR) 26-02 replaced SR 11-7.

The revised guidance states that “Generative AI and agentic AI models are novel and rapidly evolving. As such, they aren’t within the scope of this guidance.” It also says the guidance doesn’t set enforceable standards or prescriptive requirements.

The Federal Reserve guidance says it’s expected to be most relevant to banking organizations with more than 30 billion in total assets. It may still be relevant below that threshold when model risk is significant or complex.

Agentic AI sits outside the 2026 model risk guidance, so the lender must set and defend its own governance standard. The exclusion puts more weight on institutional judgment, documentation, and existing risk practices.

Third-party oversight still applies. On June 6, 2023, OCC Bulletin 2023-17 stated that interagency third-party risk guidance applies to all banks with third-party relationships.

Credit, model risk, vendor risk, information security, and technology leaders need one shared answer. That requirement doesn’t go away because the decision involved a model.

Explainability Starts with the Draw File

Follow the record an examiner may review

Start with the record. A construction draw file may contain the draw request, pay application, inspection report, budget-to-complete, exception record, reviewer action, and disbursement decision. The sequence shows where an AI tool enters the workflow and where human judgment remains.

If the system flags a discrepancy, the file should preserve the decision context. The record should answer one question: “What triggered it, what data supported it, and what the loan officer saw before making a final call?”

The reviewer decides how to resolve the exception. The record should show that action and the final disposition.

It doesn’t matter how fast it runs. The institution must be able to explain the flag and audit the record. This is an operational standard for defensible AI use.

More flags create more documentation work

Consider an illustrative book of 40 active construction loans with two draws per loan each year. That produces 80 draw decisions. If an AI-assisted process flags two in 10 draws, 80 × 0.2 = 16 flagged draws requiring traceable records.

Each record needs a trigger, supporting material, reviewer action, and final disposition. Finding more risks can improve oversight. Each flag also creates more evidence to retain, review, and explain.

Put Vendor Controls into Writing

Contract for data use, audit access, and exit

The interagency guidance published in the Federal Register on June 9, 2023 identifies risk-based contract considerations for third-party relationships. They cover data access and use, sharing permissions, confidentiality, audit and remediation rights, incident notice, ownership, and return or destruction at termination.

Ask for written answers across raw, de-identified, and aggregated data. Ask which subprocessors receive data, how long each party retains it, and what evidence supports deletion. Ask the direct question: “Does my data train your model?”

This analysis does not perform a fair lending evaluation of any specific model, nor does it resolve questions regarding Built’s training data or isolation protocols without written confirmation. Such answers must be provided in writing directly by the vendor.

Ownership, return, retention, deletion, and offboarding terms also belong in the contract, and no specific claims are made regarding Built’s terms in these areas without explicit written verification.

Ask for evidence on a real draw

A policy document isn’t enough. Ask the vendor to demonstrate one flag from source document through reviewer disposition. Verify the policy that triggered it, the evidence that supported it, the information shown to the reviewer, and the record retained after the final action.

Get those answers during vendor review, before they become audit findings.

Apply the same standard to Built

Built’s AI Draw Agent is trained on each lender’s own policies and procedures. It flags discrepancies rather than resolving them silently. Built’s approved product testing shows 95% faster draw processing, 2x more risks flagged than manual review, and draw review in under three minutes.

For category context, read Built’s article on agentic AI in lending.

Built completes institution-specific security questionnaires. Existing and prospective clients can access information security materials and audit reports through its Security Trust Center, subject to a click-through nondisclosure agreement. The training-data and offboarding answers still need written confirmation.

Close the Governance Gap with Four Questions

Put the four questions into the next vendor questionnaire. Ask for the flag record on a real draw. Put data-use, retention, deletion, ownership, and offboarding terms into the contract.

Assign owners across credit, model risk, vendor risk, information security, and technology.

1. Can I audit every decision this system influences?
2. Is my data isolated from other lenders’ data?
3. Can I explain to a regulator how a risk was flagged?
4. Who owns the data if I leave?

These criteria should be applied to Built as well, because vague answers serve as a clear indicator of potential governance issues.

Built supports residential, commercial, homebuilder, and private credit lenders, with 45 of the top 100 U.S. banks active on the platform.

Book a demo today.

AI Governance for Lenders FAQs

Does SR 11-7 apply to generative AI or agentic AI?

No. OCC Bulletin 2026-13 and Federal Reserve SR 26-02, issued April 17, 2026, replaced the prior guidance and exclude generative and agentic AI from their scope. Banks’ own risk-management and governance practices should guide controls for systems outside the guidance’s scope.

What should a bank ask an AI vendor about training data?

Ask whether raw, de-identified, or aggregated customer data trains any model. Request written terms covering customer-level scoping, subprocessors, access, retention, deletion, ownership, and offboarding. Apply the questions to every vendor, including Built.

Does AI in loan operations need to be explainable to examiners?

A lender should maintain an operational record showing the trigger, supporting data or document, reviewer view, final action, and disposition. This is a practical governance standard, not a stated requirement for agentic AI under the April 17, 2026 model risk guidance.

What should an AI vendor contract say about data ownership and offboarding?

The June 9, 2023 Federal Register guidance identifies risk-based considerations covering ownership, permitted use, return, retention, deletion, audit access, incident notice, and termination support. The contract should match the relationship’s risk, complexity, and data flows.