Most financial firms have a gate for approving AI. Far fewer have an AI governance checklist for what happens once a system goes live. In the Bank of England and FCA's October 2026 survey of 196 UK firms, more than 90% used human approval, pre-deployment review and vendor due diligence. Only around half ran ongoing monitoring or periodic review.

US firms feel the same gap. Grant Thornton's April 2026 survey of nearly 1,000 US senior leaders found 78% lack full confidence they could pass an independent AI governance audit within 90 days.

Approval isn't the finish line. This AI governance checklist covers the full path from pilot approval to production and retirement, with an owner, a sign-off, and the evidence each step should leave behind. It's written for risk, compliance, data, and business leaders at lenders, insurers, wealth managers, broker-dealers, and other financial firms.

Expectations will be higher in 2027. State examiners now have the CSBS AI Supervisory Framework, and the NAIC model bulletin has been adopted in 27 states plus DC and Puerto Rico. The FSB finalized 12 sound practices for AI in October 2026. For the wider picture of what regulators expect, see our guide to AI governance in financial services.

Three Foundations for AI Governance Implementation

Every AI governance framework development process starts here. The checklist works only if these three exist first.

1. A named executive AI owner: One senior person answers for AI risk across the firm and reports to the board.
2. Agreed risk tiers: A simple scale, such as low, medium, and high, with the controls each tier triggers. A meeting summarizer and a credit model shouldn't pass through the same gates.
3. An AI inventory that includes vendor and embedded AI: You can't govern what you haven't listed. Investment advisers are ahead here. In the IAA, ACA Group and YCC July 2026 survey, 86% of 411 adviser firms keep an inventory of AI tools.

With these in place, AI governance implementation becomes a repeatable process rather than a one-off project.

The AI Governance Checklist for Financial Services

The ten stages below are grouped into five steps. They're Muoro's synthesis of what US regulators and standard setters expect, not a list any single regulator publishes. Each step ends with who owns it, what sign-off moves it forward, and what evidence it should leave.

1. Intake and risk tiering

This is where AI compliance risk assessments start. State examiners using the CSBS framework will ask "who is responsible for oversight" of each AI use and how use cases are reviewed and approved.

• Register the use case in the AI inventory with its purpose, data sources, and business owner.
• Record whether it's built in-house, bought from a vendor, or embedded in software you already use.
• Rate the risk against your tiers, based on customer impact, the decisions it informs, and regulatory exposure.
• List the controls that tier triggers.

Owner and evidence: The business owner registers the use case, and second-line risk sets the tier. Evidence is the inventory entry and tier rating.

2. Pilot design and pilot run

Urgency is where pilots skip the process. In EY's September 2026 survey of 202 US senior AI decision-makers, 47% said their organization had previously skipped its own AI governance process for urgent deployments. SR 26-2 gives a better answer. If a model must be used early, apply usage limits or closer monitoring.

• Agree on the scope, approved data sources, and user limits.
• Set success criteria and stop criteria before the pilot starts.
• Log prompts, outputs, and model versions from day one, as FINRA expects.
• Review results against the criteria you set, not against enthusiasm for the tool.

Owner and evidence: The business owner designs the pilot and data, and engineering runs it. Evidence is the pilot charter, logs, and results.

3. Validation and production approval

This is the gate most firms already run, and where AI governance oversight needs real independence. SR 26-2 says validation "generally occurs prior to a model's first use" and that effective challenge needs "sufficient independence." Reviews do find problems. After formal assurance reviews, 29% of EY's respondents paused, and 25% fully stopped a quarter or more of their AI systems.

• Test accuracy, fairness, robustness and security with someone independent of the build team.
• Validate vendor models too, since SR 26-2 still covers them.
• Record one of five outcomes, which are approve, approve with conditions, reject, escalate, or defer.
• Write each condition down with an owner and a due date.

Owner and evidence: An independent validator tests, and an approval committee or the executive AI owner decides. Evidence is the test results and a recorded go or no-go with any conditions.

4. Deployment and stop rights

Good AI operational governance means the controls are live before the system is. CSBS examiners will confirm "the ability to restrict or halt" AI agents. FINRA warns that agents may act beyond their "intended scope and authority." EY found 26% of organizations using agentic AI can't detect unauthorized agents.

• Confirm monitoring, logging, and human review are live before launch.
• Name who can pause or stop the system, and test that they can.
• For AI agents, set limits on what they can do and check you can spot agents running outside them.

Owner and evidence: Data and engineering deploy, and the business owner confirms the controls are live. Evidence is monitoring records and a documented way to stop the system.

5. AI governance monitoring, change and retirement

This is the weakest stage across the industry. Only 37% of firms in the IAA survey have policies for testing and validating AI outputs, and 14% have updated incident response plans for AI. Grant Thornton found only one in five organizations has tested a response plan for AI failures.

• Review drift, fairness, and incidents on a set schedule, more often for high-risk systems.
• Re-approve after material changes to the model, data, vendor, or use.
• Test the AI incident response plan at least once a year.
• Plan retirement, including what happens to the data.

CSBS examiners check monitoring when "AI systems, data, vendors, or operating conditions change." AI governance continuous improvement means feeding each review's findings back into your tiers and controls.

Owner and evidence: The business owner stays accountable, supported by data, engineering, and model risk. Evidence is review reports, a change log, and a retirement record.

Who Owns What: AI Governance Stakeholders at Each Stage

Every stage should answer four questions. Who owns it? Who signs off? Who fixes errors? Who answers regulators? The table below works as an AI governance framework template you can adapt. Titles vary by firm, and smaller firms often combine roles.

An AI system should pass through defined governance checkpoints before it reaches production and throughout its operational life. Each stage has an accountable owner, a sign-off requirement and documented evidence to establish that the necessary controls are in place.

1. Intake and registration: The business owner submits the AI use case for review and ensures it is entered into the organisation's AI inventory. The record includes its purpose and owner.

2. Risk tiering: The second-line risk team assigns a risk tier and identifies the controls required for that level of risk. The output is an agreed risk rating and corresponding control requirements.

3. Pilot design: The business owner defines the pilot's objectives, success criteria and stop conditions. The pilot charter also specifies approved data sources and user limits.

4. Pilot run: Data and engineering teams execute the pilot and document its performance. Pilot logs and results are reviewed against the agreed criteria before proceeding.

5. Validation and testing: An independent validator assesses accuracy, fairness, robustness and security. The system must pass validation or receive clearly defined conditions before moving forward.

6. Production approval: An approval committee or executive AI owner records the go or no-go decision. Any conditions attached to approval must also be documented.

7. Deployment: Data and engineering teams confirm that operational controls are live, including monitoring, logging, human review and the ability to stop the system.

8. Monitoring: The business owner oversees periodic reviews and tracks model drift, fairness issues and AI incidents. Review findings are documented in monitoring reports.

9. Change and re-approval: The business owner ensures that material changes to the model, data or intended use undergo re-approval. The process produces a change log and updated validation evidence.

10. Retirement: The business owner obtains approval to retire the AI system and documents the retirement decision, including how associated data will be handled.

The business owner should be accountable from intake to retirement. Other teams own specific gates, but one person answers for the system throughout. A committee isn't an owner. Unclear ownership shows up in the data. In Grant Thornton's insurance survey, 68% of insurers say their AI controls exist but are fragmented across teams and tools.

A top-down AI governance structure ties it together. The board sets AI risk appetite and receives reporting on high-risk systems. Internal audit tests whether the whole process works. Procurement and third-party risk own vendor due diligence. The NAIC bulletin describes this as "lines of defense at successive stages" of the AI life cycle.

How to Scale Your AI Governance Checklist to the Risk

A meeting summarizer doesn't need every gate. An underwriting, claims, or credit model does. Even the Fed's SR 26-2 letter says it's "expected to be most relevant to banking organizations with over $30 billion in total assets" and tailors its practices to size and complexity.

A low-risk tool might need only an inventory entry, a named owner, and an annual review. A high-risk system goes through all ten stages. Some firms face extra rules. Mortgage lenders, for example, must meet Fannie Mae Lender Letter LL-2026-04, which requires written AI policies with owners who review them at least annually.

Common AI Governance Mistakes in Financial Services

• Approving a pilot with no stop criteria. Without them, pilots drift into production by default.
• No named owner after go-live. The build team moves on, and nobody watches the system.
• Switching on vendor AI without review. In the UK survey, 54% of firms named applying model risk management to vendor models as a governance challenge. Third parties now account for 53% of high-materiality AI systems, up from 35% in 2024. In the US, only 30% of adviser firms have policies on third-party AI use.
• No re-approval after changes. A new data source or model version can change results as much as a new system.
• No way to stop an agent. If nobody can pause it, it isn't under control.

Put the Checklist to Work

Want to know where your AI governance stands today? Muoro's AI governance assessment maps your AI systems against these stages, shows where ownership and evidence are missing, and gives you a prioritized plan to close the gaps before examiners ask. Book your AI governance assessment.

Frequently Asked Questions

What is an AI governance checklist?

An AI governance checklist is the set of steps and sign-offs an AI system must pass from first idea to retirement. In financial services, a good one names an owner for each step and records the evidence regulators and auditors will ask to see.

What should an AI governance framework include?

At minimum, an AI inventory, risk tiers, clear roles, an approval process, independent validation, ongoing monitoring, change control, and incident response. The NAIC model bulletin expects insurers' AI programs to cover the full life cycle from design to retirement. The checklist above turns those parts into steps.

Who should be responsible for AI governance?

Accountability sits at three levels. The board sets AI risk appetite and oversees high-risk systems. A named executive owns AI risk across the firm. A business owner answers for each system from intake to retirement, while risk, compliance, and model risk own specific gates.

Who should approve AI for production?

An approval committee or a named executive AI owner should make the final decision, after an independent validator has tested the system. The business owner, risk, compliance, legal, and information security should all have input.

What does an AI governance committee do?

It reviews and approves AI use cases, sets policy and risk tiers, decides on high-risk deployments, and tracks open conditions and incidents. It usually brings together business, risk, compliance, legal, technology, and information security leaders. A committee approves, but it shouldn't replace a named owner for each system.

Does every AI tool need the full checklist?

No. Scale it to the risk tier. A low-risk internal tool may need only registration, an owner, and periodic review. Systems that affect customers, credit, claims, or regulatory reporting should go through every stage.

How do you manage third-party AI risk?

Treat vendor AI like your own. Add it to the inventory, tier it, check the vendor's data, testing, and controls, and write audit and notification rights into the contract. SR 26-2 keeps vendor models in scope, and the NAIC bulletin sets expectations for insurers using third-party AI. Watch for AI switched on inside software you already use.

How often should approved AI be reviewed?

Set the schedule by risk tier. High-risk systems need continuous monitoring and frequent formal reviews. Lower-risk tools can be reviewed annually. Every system should be re-reviewed after a material change to its model, data, vendor, or use.

How often should AI models be retrained?

There's no fixed calendar. Retrain when monitoring shows drift, falling accuracy, or a change in the data or the customers the model serves. In a governed process, a retrained model counts as a material change. It goes back through validation and re-approval before it replaces the live version.