AI governance
Also called artificial intelligence governance, AI risk governance
AI governance is the set of policies, roles, controls and records an organisation uses to decide which AI systems it builds or buys, how they are tested and who answers for them. At regulated firms it sits alongside model risk management and data protection. It turns rules such as the EU AI Act into daily controls.
How it works
Most firms start with an inventory of every AI system in use, including vendor tools. Each system is classified by risk, with tighter checks for uses such as credit decisions or customer onboarding. A committee or named senior manager approves deployments. Model owners document data, testing and limits, while the risk function and internal audit check that controls work.
Regulators judge firms on outcomes, not on the technology. A biased credit model or an unexplained customer decision is a conduct and data protection problem. The EU AI Act sets duties for high-risk systems from 2 December 2027. In the US, SR 26-2 replaced SR 11-7 in April 2026 as the banking agencies' model risk guidance.
The rules
Sets risk-based duties, with Annex III high-risk obligations applying from 2 December 2027 after the 2026 omnibus amendments.
Providers and deployers of AI systems placed on or used in the EU marketReplaces SR 11-7 and SR 21-8 with risk-based model risk guidance scaled to the size and complexity of the bank.
Banking organisations supervised by the Federal Reserve, OCC and FDICVoluntary framework organising AI risk work into four functions: govern, map, measure and manage.
Any organisation designing, developing or using AI, on a voluntary basisCertifiable management system standard setting requirements for policies, risk assessment and controls over AI.
Any organisation that develops, provides or uses AI systemsCommon questions
Who is responsible for AI governance in a bank?
The board sets risk appetite and senior management owns the framework. Many banks name an accountable executive and run an AI or model risk committee. Model owners run day to day controls, the risk function challenges them and internal audit tests the whole framework.
Is AI governance a legal requirement?
The EU AI Act sets binding duties for providers and deployers, mainly for high-risk systems. In the UK and US, regulators apply existing rules on model risk, consumer protection, data protection and senior management accountability to AI. Voluntary standards such as NIST AI RMF and ISO/IEC 42001 fill in the detail.
How does AI governance relate to model risk management?
Model risk management covers the validation and monitoring of quantitative models, including many AI models. AI governance is wider. It adds data protection, fairness, transparency, third-party AI and use cases such as chatbots that may not count as models under traditional definitions.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech PostAI Without Oversight: The New Fault Line in Corporate GovernanceRead the article →RegTech PostEU AI Act: A Global Benchmark for Governing Artificial IntelligenceRead the article →
