AI Readiness Review Weekly Series Week 2 What Do You Have and Where Does It Touch Your Customers?

Written by: Rob Ellis, Senior Compliance Consultant, CRA & Fair Lending Specialist

Can You Name What You Have?

Knowing that AI is somewhere in the building is different from knowing where.

Examiners ask a simple follow-up: has the institution identified the AI systems, tools, models, or use cases it currently uses? Not "does AI exist somewhere." Not "is there a policy." Which ones, where, and doing what.

For most institutions, the answer is a partial list at best. The LOS is on it. Maybe the chatbot. The servicing model that quietly started scoring accounts last year is not. The marketing platform that now generates borrower-facing content is not. The BSA tool that added a machine-learning layer in a routine update is not.

An inventory is not a spreadsheet someone built once. It is a living record that has to survive every vendor update, every new subscription, every "quick win" a business unit turned on without telling anyone.

The gap is not malicious. It is structural. Software procurement and AI oversight are two different conversations, and in most shops, they have never been connected.

What we help institutions do is close that gap — build a record of what is actually in use, connect it to ownership and risk, and keep it current as the environment changes.

If your list of AI tools fits on a napkin, that is worth knowing before someone asks for the full version.

Where AI Touches Your Customers

Not all AI use is equal. Examiners draw a hard line between AI that runs in the background and AI that touches a customer or shapes a decision.

A model that optimizes internal reporting is one thing. A tool that drafts a denial letter, prioritizes a collections queue, recommends a product, or influences a credit outcome is another. The second category triggers a different level of scrutiny — consumer protection, fair lending, explainability, adverse-action exposure.

The problem is that the line has moved without most institutions noticing. Features that used to be purely internal now generate customer-facing content. A "productivity" tool starts writing the notice. A "servicing enhancement" starts recommending the next action on an account.

When that happens, the question stops being "do we use AI" and becomes "what is this AI doing to our customers, and can we defend it."

That is a much harder question — and it is the one that ends up in front of a board, a regulator, or a plaintiff's attorney.

The institutions that handle this well are the ones that knew where the line was before it was crossed. The ones that struggle found out after.

If you cannot say with confidence which of your AI tools touch customers or influence decisions, that is the first thing to find out. Reach out to us today!