It’sÌýimportant for audit committeeÌýmembers,Ìýin theirÌýoversightÌýroleÌýto understand how Artificial Intelligence (AI)ÌýimpactsÌýtheir institution’sÌýday-to-day operations. For example, AIÌýcould beÌýused in financial reporting, enterprise-wide risk management, fraud risk mitigation, and data privacy and security.Ìý
To ensureÌýtheirÌýeffectiveness, adaptiveÌýAIÌýmodelsÌýrelyÌýonÌýdataÌýquality, accuracy, reliability,Ìýand integrity. As such,ÌýauditÌýcommitteesÌýshouldÌýfocus on andÌýunderstand data management related to the following: Ìý
- DataÌýgovernanceÌýto ensureÌýdata privacyÌýandÌýaccessÌýcontrols areÌýestablishedÌýand implementedÌýwithÌýsupportiveÌýemployee education and training.
- DataÌýsecurityÌýto ensureÌýsensitive or confidential informationÌýfed intoÌýAI modelsÌýis protected, especially ifÌýtheÌýdata leavesÌýfinancial institutions’ÌýsecureÌýIT systems.
- TransparencyÌýto helpÌýregulators understand howÌýtheÌýselectedÌýAIÌýmodelsÌýoperate, respond, and provide conclusions and reporting that informs decisions about policies,Ìýoperations,Ìýand strategic planning.
- HumanÌýoversightÌýproceduresÌýtoÌýensureÌýpeople review, evaluate, and are accountable forÌýAI outcomesÌýto avoid overreliance and reduce risk. Ìý
Cybersecurity First
Because the use of AI integrates systems and data, which is often shared outside financial institutions’ networks, it can increase the risk of cyberattacks. Ongoing investment in thorough monitoring and oversight of cybersecurity measures is critical to protect confidential data and marketplace reputation. Aligning processes to recognized frameworks like those recommended by the National Institute of Standards and Technology (NIST), International Standard for Organization (ISO), or Cybersecurity and Infrastructure Security Agency Industrial Control Systems (CISA ICS) provides an oversight structure to track effective, secure, and compliant AI use and data collection.Ìý
HowÌýAI Can AddressÌýOBBBÌýReporting RequirementsÌý
The One Big Beautiful Bill Act of 2025 (OBBB) includes new reporting requirementsÌýwithÌýtax benefitsÌýforÌýbanks,Ìýcredit unions,Ìýand their borrowers.ÌýÌýAIÌýsolutionsÌýcan help ensureÌýaccurateÌýand secureÌýcollection and reporting of dataÌýnot only toÌýcomply withÌýOBBBÌýrequirements, but also to realize financial benefits, such as:Ìý
Agricultural Loans:ÌýQualified lenders can deduct up to 25 percent of interest income received for loansÌý
originated after Jul.Ìý4, 2025. The loans must beÌýsecured byÌýreal propertyÌýthatÌýisÌýlocatedÌýinÌýthe U.S. or a U.S.ÌýterritoryÌýandÌýproducesÌýagricultural products, supportsÌýaÌýfishingÌýor seafood processing businesses, orÌýoperatesÌýan aquaculture facility.ÌýWhen accurately tracked and accounted for, thisÌýnew deductionÌýprovides financial incentive to growÌýthis segment of the loan portfolioÌýin certain regions.Ìý
Auto Loans:ÌýFor tax years 2025 through 2028, individual taxpayersÌýwhoÌýpurchaseÌýqualifying new vehicles for personal use areÌýentitled to an annual deduction of up to $10,000 ofÌýinterest paidÌýon loans originated after Dec. 31, 2024.Ìý
On Dec. 31, 2025, the IRSÌýproposed regulationsÌýto clarify lenders’Ìýauto loanÌýreporting requirements,Ìýincluding:ÌýLenders receiving $600 or more in interest on a qualifying auto loanÌýwouldÌýbe requiredÌýto report.Ìý
- Lenders required to report must provide toÌýthe IRS and taxpayers: the name, address, and taxpayer identification number of the payor of record and the interest recipient; the amount of interest received for the calendar year; the outstanding loan principal as of the beginning of the calendar year; date of loan origination; year, make, model, and VIN of the vehicle that secures the loan; and date the vehicle was acquired.ÌýÌý
WhatÌýAudit CommitteesÌýNeed to Know About Their Institution’s Use of AIÌý
Realizing the full potential of AIÌýmeansÌýaudit committeesÌýmust fullyÌýunderstandÌýtheÌýrisksÌýand opportunitiesÌýthe tool posesÌýtoÌýensure management hasÌýdefinedÌýand implementedÌýpolicies, processes,Ìýand controlsÌýthatÌýgovern the acceptable use of AI.ÌýAuditÌýcommitteeÌýmembersÌýshouldÌýaskÌýmanagementÌýquestionsÌýaboutÌýAIÌýresponsible useÌýand cybersecurity protections, such as:Ìý
- How are you using AI?ÌýWhat are your competitors doing,Ìýand how are youÌýmaximizing opportunities?
- What are yourÌýprocedures to testÌýAIÌýmodels for accuracy, reliability, data bias,Ìýand other risks? HowÌýisÌýhumanÌýreview verifying theseÌýoutcomesÌýandÌýforÌýongoing monitoring of AI post-implementation?
- Are you using AIÌýmodels you consider toÌýbeÌýhigher risk? WhyÌýandÌýwhat are the benefits?Ìý
- HowÌýis data used,Ìýprotected,Ìýand secured againstÌýrisks of cybercrime and data breaches?
- How are employees educated and trainedÌýonÌýthe importance of cybersecurity practices? How are you documenting that leadershipÌýprovidesÌýclear guidanceÌýto employees about theirÌýresponsible useÌýof AIÌýtoÌýsupportÌýdata security?
- What’sÌýyour business continuity planÌýforÌýa data breach resulting from a cyberattackÌýorÌýAIÌýfailure?Ìý
By prioritizing cybersecurityÌýandÌýleveragingÌýproven principlesÌýregardingÌýtheÌýacceptableÌýuse of AI, yourÌýfinancial institutionÌýcanÌýnot onlyÌýstrengthen itsÌýdata management and reportingÌýbut alsoÌýupgradeÌýdigitalÌýdefenses withÌýstrategiesÌýthatÌýprotect systems,ÌýdriveÌýinnovation, deliver on customer expectations, and reduce unnecessaryÌýrisk. Contact your ÐÜèÊÓƵ advisor orÌýLiz Ziesmer, CPA,ÌýatÌý[email protected]ÌýorÌý616.975.4100Ìýor Jessica Dore, CISA,ÌýatÌý[email protected]ÌýorÌý989.799.9580Ìýfor a personal consultation.Ìý