AI Governance in Banking: What to Do Right Now, Not Someday
Here is the truth that catches a lot of bankers off guard: you do not have to decide whether your institution will use AI. It already does. Your core provider, your fraud detection tool, your chatbot vendor, and probably your loan origination system all run on some form of artificial intelligence today. The real question is whether your policies, your vendor oversight, and your board know it. Kevin Olson made this point clearly in his July 2026 BankersHub webinar on AI and electronic banking regulation, and it is the starting point every compliance officer needs to internalize. You are not waiting for AI to arrive. You are managing something that is already inside the walls.
AI Is Already in Your Institution, Whether You Planned for It or Not
Nearly every core banking platform, fraud monitoring system, and customer service tool on the market today embeds some form of machine learning or generative AI, usually delivered through a third-party vendor rather than built in-house. That reality shifts the compliance conversation. Instead of asking "should we adopt AI," your team needs to ask "what AI are we already running, who built it, and how do we know it works the way the vendor says it does." AI is already reshaping how banks operate across lending, fraud detection, marketing, and customer service, and that momentum is not slowing down. Treating AI governance as a future project rather than a current obligation leaves real gaps in oversight, and examiners are increasingly aware of it.
What Regulators Actually Expect Right Now
It helps to separate what is settled from what is still developing, because this is a fast-moving area and overstating certainty does nobody any favors. The NIST AI Risk Management Framework is real, and it offers a voluntary, sector-agnostic structure for identifying, measuring, and managing AI risk across the lifecycle of a system, from design through retirement. It was not written specifically for banks, but its four core functions, govern, map, measure, and manage, translate cleanly into a financial institution's existing risk management vocabulary.
On the Treasury side, the department published a report in 2024 titled "Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector," built on interviews with dozens of financial services and technology firms. It does not create new rules. Instead, it documents how AI is changing both the defensive tools banks use and the tactics fraudsters use against them, and it recommends that institutions manage AI risk within the risk management principles already found in existing laws, regulations, and supervisory guidance, rather than waiting for AI-specific rules to appear.
As for the OCC, FDIC, and NCUA, none of the three has issued a final rule that governs AI on its own. What has happened is more incremental. The federal banking agencies updated their model risk management guidance in 2026, and that update explicitly states that generative and agentic AI models are not yet within its scope, with the agencies signaling more specific guidance is still to come. The OCC has said publicly that it supports banks integrating AI into core functions as long as the risk is managed safely and soundly, and NCUA has built out an AI resource hub for credit unions along with internal AI officer roles to support exams. In short: the frameworks are developing quickly, but as of today, examiners are largely evaluating AI risk through the lens of existing safety and soundness, IT, and compliance reviews rather than a dedicated AI rulebook. That is exactly why building your own governance now, ahead of any final rule, puts you in a stronger position rather than a reactive one.
The Three Risk Categories Worth Your Attention
Cut through the noise and AI risk in banking really comes down to three categories. Bias and fairness sit at the top of the list, especially for anything touching credit decisions, pricing, or marketing, because a model trained on historical data can quietly reproduce historical inequities. Explainability comes next: if your fair lending team or an examiner asks why a model declined an application, "the vendor's algorithm decided" is not an answer anyone can work with. You need enough visibility into a model's logic to explain outcomes in plain language. Cybersecurity rounds out the list, and it cuts both ways. AI strengthens your fraud detection and threat monitoring, but it also hands criminals new tools, from voice cloning to highly convincing phishing content, which raises the stakes for the vendors and systems you trust with sensitive data.
Build the Inventory Before You Build the Policy
You cannot govern what you have not counted. An AI inventory is simply a documented list of every AI-enabled tool your institution uses, whether built internally or delivered by a vendor, along with what it does, what data feeds it, and who owns oversight of it. NCUA has published its own AI use case inventory approach as part of its compliance planning, and it is a useful model for credit unions and banks alike to adapt, even though it was written for NCUA's internal use rather than as a mandate for every institution. Once you have the inventory, vendor due diligence gets much sharper. FS-ISAC has published practical guidance for evaluating generative AI vendors that walks through use case, data sensitivity, business integration, and resiliency, which gives compliance teams a repeatable way to size up a vendor's AI claims instead of taking a sales deck at face value. That kind of structured due diligence also pairs well with the broader fraud awareness your frontline staff need, since recognizing AI-driven fraud tactics is quickly becoming a frontline skill, not just a back-office one.
Keep a Human in the Loop
Human-in-the-loop oversight means a person reviews and can override an AI-driven decision before it becomes final, particularly for anything with a real impact on a customer's finances or an institution's risk profile. It is not about slowing AI down for the sake of caution. It is about making sure a person with judgment and accountability stands behind every consequential outcome. Even as AI takes on a meaningful share of routine analysis and monitoring, that human layer remains essential, both for regulatory comfort and for the simple reason that a model can be confidently wrong. Your policy should spell out exactly which decisions require human sign-off, who has authority to override a model, and how those overrides get documented.
You will also see more conversation about designated AI leadership roles inside organizations. That idea gained visibility through federal initiatives requiring government agencies to name Chief AI Officers to coordinate their own internal AI adoption, a structure aimed at federal agencies themselves rather than a regulatory mandate for banks. Even so, plenty of financial institutions are borrowing the concept voluntarily, naming a senior owner, whether that is a compliance officer, a risk officer, or a dedicated AI lead, who is accountable for governance across the institution. You do not need a new title to do this well. You need a clear owner.
Your 60 to 90 Day Action Plan
Start with the inventory in the first few weeks: list every AI tool in use, its vendor, its purpose, and the data it touches. In parallel, draft or update your AI use policy so it names your risk categories, your human-in-the-loop requirements, and who approves new AI tools before they go live. By day 60, run your vendor contracts and due diligence questionnaires through a fresh lens using a framework like the one FS-ISAC offers, checking that your existing vendor management program actually captures AI-specific questions rather than assuming your standard third-party risk checklist covers it. By day 90, bring your board or risk committee a summary: what you found in the inventory, what policy changes you made, and what training your staff still needs. None of this requires waiting on a final rule from your primary regulator. It requires treating AI governance as an extension of the risk management discipline you already practice every day.
Frequently Asked Questions
Do banks need new AI-specific regulations before they act?
No. The OCC, FDIC, and NCUA are currently evaluating AI risk through existing safety and soundness, IT, and compliance frameworks rather than a dedicated AI rulebook, and Treasury's own guidance points institutions back toward the risk management principles already in existing law. Waiting for a future rule is not a defensible strategy when the tools are already in production today.
What is an AI inventory, and do we really need one?
An AI inventory is a documented list of every AI-enabled system your institution uses, whether built in-house or delivered through a vendor, along with its purpose, the data it processes, and who owns its oversight. You need one because you cannot assess risk, respond to an examiner's question, or manage a vendor relationship for a tool you have not formally identified.
What does human-in-the-loop actually mean in practice?
It means a qualified person reviews and has the authority to override an AI-driven output before it becomes a final decision, especially for anything affecting a customer's credit, pricing, or account status. Your policy should specify which decisions require that review and how overrides get documented for later audit.
Is the NIST AI Risk Management Framework mandatory for banks?
No. It is a voluntary, non-sector-specific framework, but its structure, covering governance, mapping risk, measuring it, and managing it, maps naturally onto the risk management language banks already use, which is exactly why so many institutions are adopting it as a practical starting point rather than waiting for a banking-specific version.
The regulatory picture around AI will keep shifting, but the fundamentals will not: know what AI you are running, understand where bias, explainability, and cybersecurity risk actually live in your systems, and keep a person accountable for every consequential decision. If you want a deeper walkthrough of how to translate today's guidance into a workable program for your institution, BankersHub's on-demand session AI in Banking, Managing Risk and Regulation breaks down the regulatory landscape and gives your team a practical playbook you can start using this week.