Introduction
AI is already making consequential decisions at your institution — approving loans, flagging suspicious transactions, routing customer complaints. The question examiners are now asking boards isn't whether you use AI. It's whether you can prove it's working, explain how you'd know when it isn't, and show who's accountable when something goes wrong.
Most boards cannot answer that question. AI governance hasn't been treated as a board-level risk obligation. It gets handed to data science teams, buried in model risk committee agendas, or deferred pending clearer regulatory guidance. Examiners at the OCC, CFPB, and Fed are already citing model risk management gaps in supervisory findings — and that trend is accelerating.
This post covers:
- What AI model governance actually means in a financial services context
- The specific risks boards are underestimating
- How to build a framework that holds under regulatory scrutiny
- How to clarify decision rights so oversight is inspectable, not just documented
Key Takeaways
- AI governance is a board-level obligation, not a data science team problem
- Regulators hold institutions accountable for AI-driven outcomes regardless of whether a vendor or algorithm made the call
- Governance starts with knowing what AI you actually have — including vendor-embedded and shadow AI
- Decision rights and escalation thresholds must be defined before something goes wrong, not after
- Waiting for final rules is itself a governance risk — the regulatory direction is already clear enough to act
What Is AI Model Governance in Financial Services?
AI model governance is the structured set of policies, processes, accountability structures, and controls that ensure AI and machine learning systems operate as intended, remain within regulatory boundaries, and are subject to clear human oversight — from development through retirement.
That definition matters because it's broader than what most institutions currently have.
How AI Governance Differs from Traditional Model Risk Management
SR 11-7, the Federal Reserve and OCC's foundational model risk management guidance (issued April 2011 and updated in April 2026 as SR 26-2), was designed for traditional statistical models: static, auditable, explainable. A loan pricing model built in 2015 operates the same way today as it did at deployment.
Machine learning models don't work that way. They can:
- Drift — produce systematically different outputs as input data changes over time
- Degrade silently — perform worse without triggering an obvious error or alert
- Resist explanation — complex architectures like deep learning often improve predictive accuracy at the expense of interpretability
These characteristics create governance gaps that traditional MRM frameworks weren't designed to catch.
Governance vs. Compliance
Having a model risk policy on paper is not governance. Effective governance requires three things examiners look for directly:
- A named owner with clear accountability for each model
- An escalation path that has been tested, not just written down
- Board-level evidence that oversight is happening — not just documented as having happened
The Unique AI Risks Financial Institutions Face
Financial institutions face a specific set of AI risks that differ from those in other industries — because the outputs of AI systems in this sector affect regulated outcomes with real consumer consequences.
Bias and Fair Lending Exposure
AI credit models trained on historical data can encode discriminatory patterns without any intent on the institution's part. In July 2025, the Massachusetts AG announced a $2.5M settlement with Earnest Operations LLC over alleged algorithmic discrimination against Black, Hispanic, and non-citizen borrowers in student lending decisions.
The regulatory principle is unambiguous: ECOA and the Fair Housing Act apply regardless of how the decision was made. CFPB Circular 2022-03 explicitly states that model complexity or opacity does not relieve creditors of adverse-action notice duties.
Black-Box Vendor Models
Most institutions don't build their own AI — they buy it embedded in vendor products. Regulators don't accept "the vendor won't tell us how it works" as a defense. The institution is responsible for understanding, validating, and being able to explain any model that influences a regulated outcome.
Model Drift
AI systems can begin producing different outputs as market conditions or customer behavior shifts. Without continuous monitoring, an institution may not know a model has drifted until harm has occurred or an examiner surfaces it.
BSA/AML-Specific Risk
The April 2021 Interagency Statement on Model Risk Management for BSA/AML systems establishes that institutions are responsible for the results of AI-based transaction monitoring systems. That responsibility covers both ends of the problem: excessive false positives and missed suspicious activity. The vendor relationship doesn't transfer accountability.
Agentic AI
As AI systems move from analysis into autonomous action — executing transactions, approving requests, issuing customer communications — governance frameworks built for passive models don't hold. The 2026 revised MRM guidance acknowledges that generative and agentic AI fall outside its current scope, with future guidance planned. Institutions deploying these systems today are operating ahead of the regulatory framework, which means the governance work falls entirely on them.
Building an AI Governance Framework That Holds Under Scrutiny
Establish Your AI Inventory First
Governance cannot cover what leadership doesn't know exists. The starting point is a complete inventory of every AI and ML system in use — including tools staff adopted without formal approval and AI embedded in vendor products not typically flagged as "AI systems."
A 2023 survey cited in Treasury's December 2024 report found 86% of financial firms expected significant or moderate growth in their model inventory due to generative AI adoption. Most institutions are not ready for that volume.
To surface the full inventory:
- Survey all business lines — not just technology
- Review vendor contracts for language referencing machine learning, automated decisioning, or predictive analytics
- Bring compliance, risk, IT, and operations into one room — no single function has complete visibility
- Treat anything that generates a decision or score as a candidate for the inventory
Once you know what exists, the next question is how much scrutiny each system deserves.
Classify Models by Risk Tier
Not all AI warrants the same oversight intensity. A tiered approach allocates resources proportionally:
| Risk Tier | Examples | Governance Requirement |
|---|---|---|
| High | Credit underwriting, BSA/AML, fair lending, regulatory capital | Full MRM treatment, independent validation |
| Medium | Customer service routing, marketing analytics | Meaningful oversight, documented testing |
| Low | Grammar tools, scheduling assistants | Acknowledgment, no intensive validation |
Classification should address: what data the model accesses, which customers it affects, what the exposure is if outputs are wrong, and whether outputs can be explained to an examiner or customer.
Tier classification determines where to invest governance effort. That effort then needs to run through every phase of a model's life — not just at launch.
Embed Controls Across the Model Lifecycle
Governance controls must exist at every stage — deployment is not the finish line:
- Pre-implementation: Compare false positive and miss rates against incumbent systems
- Validation: Independent review before go-live, conducted by a team separate from those who built or use the model
- Ongoing monitoring: Track performance metrics, bias indicators, and data integrity continuously
- Annual review: Assess whether each model still aligns with current products, customers, and risk appetite
Documentation matters here, but not as a bureaucratic exercise. The standard regulators apply is whether a knowledgeable third party could understand the model's purpose, assumptions, testing methodology, and limitations without access to the underlying code.
Clarifying Decision Rights and Board-Level Oversight
Most institutions have governance policies. Far fewer have clear decision rights. When a model produces anomalous outputs, when a vendor pushes an undisclosed update, or when a regulator requests an explanation, the critical question becomes: who has authority to act, who must be notified, and what does escalation look like?
Ambiguity in those answers is where governance breaks down under pressure.
What Board Oversight Actually Looks Like
The board doesn't need to understand every model's architecture. It does need to:
- Understand the institution's AI risk appetite
- Approve governance policies and escalation thresholds
- Receive regular reporting on AI-related risk posture — trend, not activity logs
- Be confident management has both the obligation and the authority to escalate material AI events
The FSB's June 2026 consultation on sound practices for AI adoption by financial institutions reinforces that boards and senior management are ultimately accountable for AI use — not the teams operating the systems day to day.
Building Accountability Structures That Hold
Effective structures require specificity:
- Named model owners responsible for performance, documentation, and escalation
- A model review committee with representation from risk, compliance, technology, and at least one business line
- Escalation thresholds defined in advance — triggering senior leadership or board notification automatically, not after someone decides whether something "feels" material
Many institutions building AI governance for the first time benefit from an independent advisor who can assess gaps without organizational bias, help establish frameworks that are inspectable rather than just documented, and prepare leadership for examiner scrutiny.
That outside perspective matters most when internal teams are simultaneously managing day-to-day operations and standing up governance from scratch. Tyson Martin's board-level AI governance advisory engagements are designed for exactly that context — drawing on the Cloud Security Alliance's AI Controls Matrix, which provides control objectives across governance, accountability, and model lifecycle management.
Navigating the Regulatory Landscape
The regulatory environment for AI in financial services is already structured — and examiners are using it.
Federal frameworks:
- SR 26-2 / OCC Bulletin 2026-13 (April 2026) — the updated model risk management guidance superseding SR 11-7
- 2021 Interagency Statement on BSA/AML model risk — applies MRM expectations explicitly to AI-based compliance systems
- NIST AI RMF 1.0 (January 2023) — voluntary but increasingly examiner-referenced; Treasury adapted it for financial services in February 2026
- CFPB Circulars 2022-03 and 2023-03 — adverse action notice requirements apply regardless of model complexity
Fair lending laws (ECOA, Fair Housing Act) apply to AI-driven credit decisions as fully as to human decisions.
State-level requirements are tightening:
- Colorado SB24-205 requires reasonable care to prevent algorithmic discrimination in high-risk AI systems
- California finalized automated decision-making regulations effective January 1, 2026
- Utah and Texas have enacted AI-specific legislation with compliance obligations
- Freddie Mac Bulletin 2025-16 (effective March 2026) requires Seller/Servicers to establish formal AI/ML governance frameworks under Guide Section 1302.8
Taken together, these obligations leave little room to wait. The posture of holding off until a single, unified federal AI rule arrives is not defensible — examiners are applying existing frameworks now. Institutions with documented, operational governance structures enter examinations with a concrete record; those waiting for perfect guidance enter with nothing to show.
Common AI Governance Gaps Financial Institutions Should Close
Three gaps appear consistently across institutions at various stages of AI governance maturity:
The vendor accountability gap. Institutions treat vendor-embedded AI as the vendor's problem. Regulators treat it as the institution's. Contracts need to hold vendors accountable — even when they resist. That means requiring:
- Advance notification of material model changes
- AI-specific due diligence documentation
- Independent validation rights
The board reporting gap. AI risk frequently lives in technology or model risk committees and never reaches the board in a form that enables oversight. Boards receive activity updates rather than risk posture assessments. Effective governance requires a consistent reporting cadence that shows trend, flags exceptions, and surfaces decisions the board needs to make or ratify.
Tyson Martin's board reporting framework delivers a standing dashboard — top risks, spend status, incidents, and decisions needed — on a quarterly formal cycle with monthly updates between.
The training and culture gap. Governance frameworks depend on people executing them. Compliance officers who can't evaluate vendor AI documentation, audit teams without AI-specific testing protocols, and staff using AI tools without understanding their limitations are all vulnerabilities that policy documents alone won't close.
Director education on AI risk governance — including what questions boards should be asking — is a prerequisite for closing this gap, not an optional add-on.
Frequently Asked Questions
What is model governance in AI?
AI model governance is the structured set of policies, processes, and controls that ensure AI systems operate as intended, stay within regulatory boundaries, and remain subject to clear human accountability — from development and validation through deployment, monitoring, and retirement.
What are the 5 principles of AI governance?
Most frameworks, including NIST AI RMF, converge on five core principles:
- Transparency — models and their limitations must be explainable
- Accountability — clear human ownership of outcomes
- Fairness — bias must be actively tested and mitigated
- Security — AI systems must be protected from manipulation
- Continuous oversight — governance requires ongoing vigilance, not a single validation event
How does AI impact governance in finance?
AI raises governance stakes in financial services because AI-driven decisions affect regulated outcomes like credit approvals and fraud alerts, can drift or produce biased results without visible signals, and are often embedded in third-party systems where institutions have limited visibility. Structured oversight frameworks are a regulatory necessity, not a best practice.
What is the board's role in AI model governance at a financial institution?
The board's role is not technical oversight of individual models — it's setting AI risk appetite, approving governance policies, receiving regular risk posture reporting, and ensuring escalation paths exist so that material AI events reach decision-makers before harm compounds.
What regulations apply to AI models in financial institutions?
Key frameworks include:
- SR 26-2 — updated model risk management guidance
- NIST AI RMF — the primary federal AI risk framework
- Fair lending laws — ECOA, Fair Housing Act, and CFPB adverse action circulars
- State-level AI legislation — Colorado, California, Utah, and Texas
Examiners apply existing frameworks to AI even where AI-specific rules are not yet finalized.
What is the difference between model risk management and AI governance?
Model risk management (originally SR 11-7, now SR 26-2) was designed for traditional statistical models and centers on validation and documentation. AI governance is broader: it adds accountability structures, board oversight, vendor management, cultural readiness, and continuous monitoring suited to the evolving, often opaque nature of machine learning systems.
