01
Purpose and accountability
Name the business decision, accountable owner, affected parties and prohibited uses.
AI governance in banking
Govern the banking decision, not only the AI model.
AI governance in banking is the system of ownership, controls, evidence and review that keeps AI-supported decisions lawful, fair, secure, explainable and operationally reliable. It must cover the full use-case lifecycle, from approval and data to human oversight, third parties, monitoring, incidents and retirement.
Seven control gates
A lifecycle model for banking AI
02
Risk classification
Tier the use case by impact, autonomy, data sensitivity, customer effect and reversibility.
03
Data and knowledge
Control provenance, permissions, quality, privacy, retrieval sources and retention.
04
Model and prompt controls
Document selection, testing, limitations, change control and security safeguards.
05
Human oversight
Define when people review, override, escalate or stop the system, and what evidence they receive.
06
Third-party assurance
Assess providers, contracts, sub-processors, resilience, portability and evidence access.
07
Monitoring and incidents
Track performance, drift, bias, misuse, exceptions and control failures through retirement.
Use-case register
Minimum evidence by lifecycle stage
| Stage | Decision to record | Evidence example |
|---|---|---|
| Discover | Is AI necessary and proportionate? | Problem statement, alternatives and affected stakeholders |
| Approve | What risk tier and control path apply? | Use-case owner, risk assessment and conditions |
| Build or procure | Can the system be tested and governed? | Data lineage, model card, vendor evidence and test plan |
| Deploy | Are people and controls ready? | Approval, training, runbook, access and fallback |
| Operate | Is the outcome still within tolerance? | Monitoring, overrides, incidents, complaints and changes |
| Retire | What must be removed or retained? | Access closure, data disposition and archived evidence |
Agentic AI
More autonomy requires stronger decision boundaries.
Agentic systems can plan, call tools and take multi-step actions. Banks should define permitted objectives, tool access, transaction limits, approval points, memory boundaries, safe failure modes and complete action logs before increasing autonomy.
Current regional sources
Use guidance as a control input, not a copy-and-paste policy
These primary sources provide current reference points for regulated adoption. Institutions should map them to their own legal obligations, policies, risk appetite and operating model.
Sources reviewed 11 July 2026. Confirm the current text before relying on any requirement.
Related original analysis
The earlier analysis behind the governance perspective.
These published articles remain part of Ahmed's public body of work. Their original dates are retained, and each page now connects back to the current decision guides.
NLP and Generative AI for Risk Management in Banking
Explore NLP and generative AI use cases in banking risk, alongside data, governance, validation, human oversight and implementation constraints.
Read original articleESG Risk Management in Banking: A Practical Guide
A practical introduction to ESG risk in banking, covering materiality, governance, data, scenario analysis, monitoring and financial decisions.
Read original articleQuantitative Risk Management in Banking: 7 Practices
Seven practices for using models, scenarios, stress tests, data, expert judgement and cross-functional collaboration in banking risk management.
Read original articleThese articles are preserved as dated analysis and should be read alongside the current guide above.
Questions
Banking AI governance questions
Who should own AI governance in a bank?
The board and senior management set accountability and risk appetite. Day-to-day governance is usually cross-functional across business, risk, compliance, data, technology, security, legal, procurement and audit, with a named owner for every use case.
Is model validation enough for GenAI?
No. GenAI governance also needs controls for prompts, retrieval sources, confidential data, output use, human review, provider changes, security, content safety and operational monitoring.
How should banks prioritise AI use cases?
Balance business value with customer impact, data sensitivity, autonomy, explainability, control maturity and reversibility. A high-value use case may still need a lower-autonomy first release.
What changes for third-party AI?
The bank remains accountable for the decision context. Contracts and assurance should address data use, sub-processors, security, model changes, service resilience, evidence access, portability and exit.
Start with the decision
Bring the context. We can define the right next question.
For advisory, executive education, media or academic enquiries, share the decision you are facing, the audience involved and the outcome you need.