What AI Underwriting Means For Corporate Lenders

Nobody Decided to Put AI on the Credit Committee: Governance, Documentation, and the Corporate Credit File after SR 26-2.

The credit committee used to be a room: a conference table, a few senior bankers, a credit officer with a marked-up memo, and someone asking whether the EBITDA add-backs had gotten a little too “creative.” The room still exists. What has changed is how much of the work is finished before anyone sits down.

A corporate borrower seeking a revolving credit facility may be scored, spread, risk-rated, and benchmarked by artificial intelligence (AI) before the relationship banker picks up the phone. Often, no one formally introduced this capability to the credit policy, the model inventory, or the validation program. The shift is quiet. The questions it raises — about explainability, documentation, and accountability for a rating no one can reconstruct — are not.

AI tools review financial statements, flag covenant issues, identify unusual trends, summarize borrower documents, and help draft credit memoranda. They are not one technology, and the legal risk changes with the type of tool. Predictive models such as the statistical and machine-learning systems that score, rate, and classify raise familiar questions of validation, drift, bias, and explainability. Generative systems, which summarize source material and draft narrative, add hallucination and source-provenance risk. Agentic systems, which sequence tasks and take permitted actions across platforms with limited human intervention, add questions of authority, access control, stopping rules, and action logging. A single vendor platform may do all three.

All of it can be enormously useful. It can also outrun the governance built for it, creating legal, regulatory, and deal-management risks that are not always fully mapped. For corporate lending counsel, the practical issue is rarely adoption; that decision usually gets made somewhere else in the institution, and often before anyone asks legal. The issue is whether the credit policy, the model inventory, and the credit file can still account for how a decision was reached.

AI Is Shaping the Decision, Not Just the Workflow

The obvious benefit of AI in commercial lending is efficiency. Faster financial spreading. Faster document review. Faster risk alerts. Faster first drafts of credit memos. But speed is not the whole story.

The more consequential shift is that AI may influence the substance of the credit decision itself—risk ratings, pricing, covenant packages, collateral requirements, monitoring frequency, even workout strategy. That matters because credit decisions need to be explainable, and not only to regulators, but also, to borrowers, participants, and anyone reviewing the file after a default.

The credit file is where that explanation either exists or does not. AI can help prepare the credit file: organizing information, surfacing issues, identifying inconsistencies, and reducing mechanical work. What is cannot supply is the thing the file is supposed to evidence: that someone who understood this borrower made this decision.

A good credit memorandum shows human judgment, explaining why the deal makes sense, which risks matter, how those risks are mitigated, and why the proposed structure fits. If the memo instead reads like a machine-generated summary of borrower data — accurate but uninflected, comprehensive but unweighted — it may not carry weight with a credit committee, an examiner, a participant lender, or a workout officer reading backward from a default.

If AI materially contributed to the decision, someone at the institution will eventually be asked what it reviewed, what it ignored, what it assumed, and where human judgment entered the process. “The model said so” is not a credit policy. It is an invitation to a bad deposition.

The Governance Problem Nobody Planned For

Most AI risk in corporate lending does not arrive as a robot banker denying loans from a glass tower. It comes from ordinary institutional drift. Nobody decides to let a workflow efficiency tool into the credit decision. It gets there anyway.

Consider this scenario: a bank buys a tool to help with financial spreading. The tool starts flagging covenant headroom. It then begins drafting credit memo language. Portfolio managers start to rely on its risk alerts. Risk ratings start moving with its output. Suddenly, the tool has become part of the underwriting process and nobody updated the credit policy, the model inventory, or the validation program to reflect that.

That is the point at which the issue stops being operational and becomes legal. Where AI touches the credit lifecycle, the institution should be able to answer some basic questions:

• Who owns the tool internally?
• Has it been validated?
• Is it in the model inventory?
• What data does it use, and where does that data come from?
• Can its output be explained to a regulator or a judge?
• Can a human override it, and are those overrides tracked?
• What happens when the tool is wrong?

These are not technology questions. They are legal, supervisory, and credit-risk questions. The technology team may have answers. The question is whether legal and compliance have asked.

Which Rules Actually Apply?

On April 17, 2026, the federal banking agencies replaced the model risk framework banks had worked under for fifteen years. The revised interagency guidance on Model Risk Management — SR 26-2 and OCC Bulletin 2026-13 — supersedes SR 11-7 and OCC Bulletin 2011-12 and applies a risk-based approach to quantitative models. It also expressly excludes generative and agentic AI from its scope. That exclusion concerns this model-risk guidance, not other applicable risk-management expectations.

That exclusion is not a safe harbor. Supervisory guidance does not carry the force of law in either direction: it describes what examiners expect to see, and its silence on a technology does not place that technology outside supervision. Depending on the use case, existing safety-and-soundness expectations, credit policy, privacy and information-security rules, and the 2023 interagency third-party risk guidance may all still reach a tool the model framework does not.

ECOA and Regulation B reach business credit as well. Notice procedures vary for certain business applicants, but the substance does not bend to the technology: where a statement of reasons is required, a creditor has to identify the specific principal reasons for the adverse action. A model that cannot produce them can be a compliance problem, not an explanation.

New state AI disclosure laws overlap with corporate lending more narrowly. Utah¹, as amended in 2025, generally requires a supplier to disclose generative AI use in a consumer transaction when the individual clearly and unambiguously asks, with heightened obligations for regulated occupations in high-risk interactions. Colorado’s SB 26-189², effective January 1, 2027, governs automated decision-making technology used in consequential decisions about individuals, including lending, and carries notice, explanation, correction, and human-review rights, subject to statutory limits and a provision allowing qualifying federal credit notices to avoid duplicative state notices.

Neither statute converts a credit decision about a corporate borrower into a consumer matter, but either may become relevant, depending on the transaction and use case, when the workflow touches a natural-person owner or guarantor, a personal guaranty is underwritten alongside the corporate credit, or the institution deploys a customer-facing chatbot. A single AI policy applied across the commercial credit process is unlikely to fit every use. The variables that matter are the user, the borrower type, the state, and the function.

AI Monitoring Can Create “Knowledge” Issues

A tool that continuously scans borrower performance for liquidity deterioration, covenant stress, litigation exposure, management changes, or industry headwinds can be valuable. It also creates something the old process did not: a dated record showing that the lender knew about a problem earlier than it otherwise would have.

That raises operational questions with legal weight. If the bank receives an AI-generated risk alert, who reviews it? Who decides whether to escalate? Is the response documented? Does the bank’s conduct after the alert align with its rights and obligations under the loan documents?

A risk alert is not automatically legal knowledge, and it does not by itself create a duty to protect the borrower or pursue a particular remedy. The effect depends on the governing law and loan documents, whether the alert reached an authorized decision-maker, the bank’s policies and course of conduct, and what the bank did after review.

But the alert, the review queue, and the response log may all become evidence of actual notice, of a control failure, or of a departure from the institution’s own policy. In a healthy credit, none of this surfaces. In a troubled one, it can surface in a workout, a bankruptcy, a lender liability dispute, or a syndicate disagreement. Escalation protocols and response documentation are what can keep that record defensible. Without them, a bank may end up with a great many early warnings and no explanation of what it did with any of them.

More alerts do not mean more control. If thresholds are poorly tuned, if alerts duplicate each other, or if review capacity does not scale with volume, false positives and queue growth can normalize inaction — until managers treat significant warnings as background noise. Monitoring in that condition is not an improvement on the process it replaced. It can increase operational and credit risk rather than reduce it.

A clear public record of how that failure looks comes from BSA/AML monitoring rather than corporate credit. FinCEN’s 2018 action against U.S. Bank cited alert caps, inadequate staffing, and thousands of suspicious transactions that went uninvestigated and unreported; its 2024 TD Bank action cited significant backlogs and monitoring gaps. Those matters arose under a different statutory regime and do not establish a lender-liability rule for credit alerts. What they do establish is the control lesson: automation that generates more alerts than the institution can prioritize, investigate, escalate, and close can make the institution’s risk posture worse and leave a record of exactly how.

Syndicated Loans: The Agent Bank Problem

Syndicated facilities add a party who relies without seeing. If the administrative agent uses AI to review borrower reports, test covenant compliance, or prepare the compliance summaries it circulates, participant lenders may rely on those outputs without knowing—or asking—how they were generated.

Consider how that looks after a default. The agent’s covenant calculation misread an add-back, or the summary of a reporting package omitted a disclosed event. Participants say they were not told. The agent points to the agency provisions: no duty to investigate, entitlement to rely on documents believed genuine, no responsibility for the accuracy of borrower information, each lender making its own credit decision. Those provisions were drafted against a world of manual review. Whether they reach an output the agent itself generated with a model is a question most credit agreements do not consider.

Agent banks have long used third-party tools — covenant calculators, data room platforms — so this is evolution rather than rupture, and in many deals the existing language may still hold. In larger or more complex facilities, the question worth asking is whether agent responsibilities, reporting standards, reliance provisions, and liability limitations still describe how the work is actually done. The answer is not to prohibit AI at the agent level. It is to make the documents and the internal policies match the operational reality.

What a Defensible Program Looks Like

The task for corporate lending counsel is rarely to slow AI adoption. It is to be able to account for it afterward. Programs built with that in mind tend to share a few features:

• A map of the AI touchpoints. Where AI is used in origination, underwriting, monitoring, covenant testing, and workouts, keep the map current as tools acquire functions nobody bought them for.
• Visible human judgment in the file. Credit files that show actual review and decision-making, rather than AI-generated summaries.
• A record of overrides. When a human accepts, rejects, or modifies an AI-generated conclusion—and why.
• Written escalation rules. Set before the first alert rather than during it, covering what happens when a tool flags borrower deterioration, covenant risk, or other material issues.
• A tested alert workflow. Measure alert volume, precision, queue age, closure times, overrides, escalations, and staffing capacity, with thresholds tuned and duplicative warnings suppressed under documented controls.
• Controls on agentic actions. Permitted tools and data, least-privilege access, approval gates, stopping conditions, and rollback procedures, with input, output, action, exception, and performance logs retained. AI may assemble the audit trail, but a record whose only custodian is the system that produced it is not an independent one.
• Attention to syndicated loan practices. Whether agent-bank AI use belongs in the transaction documents, internal policies, or participant communications.
• Plain-English reporting to boards and credit committees. Governance that is actually reported, rather than buried in model risk documentation.

The Bottom Line

AI is not replacing the credit committee. It is changing what the committee sees, how quickly it sees it, and how much of the first draft may be assembled before anyone enters the room.

Used well, AI can improve consistency, speed, and risk detection. Used poorly—or left ungoverned—it can produce unexplained decisions, thin credit files, unclear escalation records, and regulatory exposure. The institutions that do this well will not be the ones that adopt AI most aggressively. They will be the ones that can use it, explain it, and defend it.

The algorithm can help with the analysis. The judgment still belongs to the institution.

Footnotes

1. Utah Code § 13-77-103

2. Colorado SB 26-189

GC provides outside general counsel services to companies of all sizes, offering project-based support, subject-matter expertise, and day-to-day GC services through a team of partner-level business attorneys. For more information visit: Outside General Counsel Corporate Legal Services.