Financial firms are putting AI into credit decisions, fraud detection, claims, advice, and customer service faster than they are putting controls around it. That gap is now a regulatory issue. In 2026 alone, US banking regulators rewrote their model risk guidance, the Treasury published an AI risk framework built for the sector, and state examiners received a dedicated AI exam framework.

AI governance in financial services is how a firm keeps that AI accountable, explainable, and safe while still getting it into production. This guide covers what AI governance in finance means, which rules apply, what a working framework contains, and how to put one in place. Each section gives a short, practical summary of one part of the topic.

1. What is AI Governance in Financial Services? Meaning, Principles, and Core Pillars

AI governance in financial services is the set of policies, controls, roles, and evidence that keep a firm’s AI systems accountable, fair, secure, and compliant across their whole life, from the first idea to retirement. As a working AI governance definition, it shows who owns each AI system, what that system is allowed to do, and how the firm can prove it works as intended.

AI governance for financial institutions focuses on decisions that affect customers and markets, such as who gets credit, which transactions are flagged, how claims are priced, and what advice a client receives. Regulators already expect firms to explain and defend these decisions. AI raises that bar rather than creating a new one.

AI governance principles

Most frameworks trace back to the OECD AI Principles, adopted by more than 40 countries. They set out five values-based principles.

1. Inclusive growth, sustainable development and well-being
2. Human rights and democratic values, including fairness and privacy
3. Transparency and explainability
4. Robustness, security and safety
5. Accountability

The core pillars for financial firms

The table outlines six core pillars of responsible AI governance in financial firms. Each pillar defines an expectation for how AI systems should be developed, deployed and monitored.

1. Accountability: Every AI system must have a clearly identified owner. The board must also oversee AI systems that pose significant risks to the organisation.

2. Transparency and explainability: Financial firms must be able to explain how AI systems make decisions. These explanations should be understandable to customers, auditors and regulatory examiners.

3. Fairness: AI models must be tested for bias and discriminatory outcomes, particularly in areas such as lending, pricing and customer service.

4. Robustness and security: AI systems must operate reliably and be protected against manipulation, data leaks and cyberattacks.

5. Privacy and data governance: Customer data must be collected and used lawfully. Firms should also maintain traceability from the original data source through to the AI-driven decision.

6. Human oversight: People must be able to review AI decisions, override them when necessary, or stop systems when the risks warrant intervention.

AI governance vs AI compliance, model risk management and data governance

These terms overlap, but they are not the same.

• AI compliance is meeting the specific rules that apply today. AI governance is the wider operating system that makes compliance repeatable as rules and models change.

• Model risk management validates and monitors models, traditionally quantitative ones. AI governance includes it, and also covers generative AI, AI agents, vendor AI, and how staff use AI tools.

• Data governance controls the data itself. AI governance depends on it, because a model is only as defensible as the data it learned from and acts on.

2. Key AI Risks and AI Governance Benefits for Financial Firms

AI governance benefits are easiest to see in what goes wrong without it. Financial firms face five kinds of AI risk.

• Regulatory risk. A model that cannot be explained or documented can fail an examination or breach fair-lending, consumer protection, or privacy rules.

• Consumer harm and bias. Models trained on historical data can repeat past discrimination in credit, pricing, or claims.

• Operational risk. Models drift as markets and customer behavior change, and generative AI can produce confident, wrong answers.

• Security and data risk. AI systems use large volumes of sensitive data, which makes them a target and a route for leakage.

• Reputational risk. One unfair or unexplained AI decision can become a public story about the whole firm.

Good governance turns those risks into managed ones, and that has commercial value. Firms with clear approval paths get AI into production faster, because risk and compliance teams know what evidence to expect and when. Shared standards stop each team reinventing controls. And a documented, defensible approach is what lets a firm move from pilots to AI that customers and regulators can trust. That is what responsible AI in financial services looks like in practice. It is not a brake on innovation but the condition for scaling it.

3. AI Governance Examples Across Financial Services

The table shows how AI is being used across different areas of financial services and the governance requirements associated with each use case.

1. Credit and lending: AI is used to assess creditworthiness, approve loans and set credit limits. Governance must ensure that models do not discriminate against applicants, that rejected applicants receive specific reasons for adverse decisions, and that every input can be traced to its source.

2. Fraud and AML: AI helps monitor transactions, prioritise suspicious activity and screen for sanctions. Governance must track false positives and false negatives, allow investigators to override AI-generated alerts, and maintain an audit trail for every alert.

3. Insurance: AI supports underwriting, pricing, claims assessment and fraud detection. Governance must test for unfair discrimination, monitor the use of external consumer data and ensure customers receive appropriate notices.

4. Wealth and asset management: AI assists with financial advice, portfolio analysis and investment research. Governance must address suitability, conflicts of interest, the accuracy of AI-generated content and misleading claims about how AI is used, commonly referred to as AI washing.

5. Payments: AI is used to detect fraudulent transactions and make payment authorisation decisions. Governance must balance decision speed with human escalation paths and ensure declined payments can be explained.

6. Capital markets and trading: AI supports trade execution, market surveillance and financial research. Governance must cover system testing under stressful market conditions, emergency shutdown mechanisms (kill switches) and controls against market abuse.

7. Customer service: AI powers chatbots, assists human agents and routes customer complaints. Governance must ensure response accuracy, disclose when customers are interacting with AI, provide escalation to human support and retain conversation records.

An example in practice. An insurer uses a model to triage claims. Governance means the model has a named owner and a risk rating. Its training data is documented, and it is tested for unfair outcomes before launch. Claims handlers can override it, every decision is logged, and drift is checked monthly. If the model starts flagging one group of customers more often, the firm finds out from its own monitoring, not from a complaint or an examiner.

4. AI Governance and Compliance under US Regulations and Global Frameworks

The US has no single AI law for financial services. Instead, AI governance and compliance draw on sector guidance, existing consumer protection law, state rules and voluntary frameworks. The table summarizes the main US regulations and guidelines as of October 2026.

The table outlines key US regulatory rules and guidance governing AI use in financial services. Each framework addresses different aspects of AI risk, from model validation and lending decisions to cybersecurity, consumer protection and regulatory supervision.

1. SR 26-2, Model Risk Management (Fed, OCC, FDIC): Applies to banking organizations and requires risk-based model risk management tailored to each firm's model risk profile. Issued on April 17, 2026, it replaces SR 11-7. Generative and agentic AI are outside its scope. Read the guidance.

2. Treasury Financial Services AI Risk Management Framework (FS AI RMF): A voluntary framework for financial institutions that provides 230 control objectives based on the NIST AI RMF. It covers lifecycle governance, data quality, third-party AI, cybersecurity and human oversight. It was released on February 19, 2026. Read the framework.

3. Equal Credit Opportunity Act and Regulation B (CFPB): Applies to lenders and requires them to provide specific principal reasons for every adverse credit decision, including decisions made using AI models. The requirement remains in force even though the CFPB withdrew its AI-specific circulars in May 2025. Read Regulation B.

4. SEC Examination Priorities: Applies to investment advisers and broker-dealers. It focuses on policies for supervising AI use and ensuring that firms make accurate claims about their AI capabilities. AI was named as a fiscal 2026 examination focus area. Read the SEC examination priorities.

5. FINRA 2026 Regulatory Oversight Report: Applies to broker-dealers and addresses how generative AI fits within existing supervision, testing, logging and vendor oversight requirements. GenAI appears as a standalone topic in the report for the first time. Read the FINRA report.

6. NAIC AI Model Bulletin: Applies to insurers in states that have adopted the bulletin. It expects insurers to maintain a written AI governance programme, conduct vendor due diligence and provide appropriate consumer notices. As of October 2026, it has been adopted by 27 states, Washington DC and Puerto Rico. Read the NAIC Model Bulletin and view the state adoption map.

7. NYDFS Guidance: Applies to New York-regulated banks, insurers and financial firms. Its October 2024 letter addresses AI-related cybersecurity risks under Part 500. Read the cybersecurity guidance. Circular Letter No. 7, issued in July 2024, addresses the use of AI and external consumer data in insurance underwriting and pricing. Read Circular Letter No. 7. Both are in force.

8. Colorado SB 26-189: Applies to firms using automated decisions in financial services and other covered areas. It provides for advance notice, explanations of adverse decisions within 30 days and human review where commercially reasonable. It is scheduled to take effect on January 1, 2027, although enforcement is currently paused by a court order. Read the bill.

Two cross-currents matter.

• First, Executive Order 14365 (December 11, 2025) set up a federal task force to challenge state AI laws, although it does not repeal any state law by itself.

• Second, SR 26-2 leaves generative and agentic AI to firms’ own governance, which means the Treasury framework and NIST guidance carry more weight for those systems.

The same rules also cover firms using AI for regulatory compliance in finance, such as transaction monitoring or regulatory reporting. Those tools need governing too.

Global frameworks and standards

Global standards for AI governance matter for any US firm with international operations, customers, or parent companies.

• NIST AI Risk Management Framework (2023). The US reference framework, organized around four functions (Govern, Map, Measure, and Manage). Its Generative AI Profile adds GenAI-specific risks.

• ISO/IEC 42001 (2023). An international standard for an AI management system. It is certifiable, which makes it useful evidence for clients and partners.

• OECD AI Principles. The values most national frameworks build on (see section 1).

• EU AI Act. In force since August 2024. Credit scoring of individuals and life and health insurance pricing are high-risk uses. The AI Omnibus, in force since July 27, 2026, moves these high-risk obligations to December 2, 2027. Fines reach up to €35 million or 7% of global turnover for the most serious breaches.

• United Kingdom. The FCA and PRA rely on existing rules, such as the Consumer Duty, the Senior Managers regime and the PRA’s model risk principles (SS1/23), rather than AI-specific rules. The FCA’s Mills Review (July 2026) considers how these may need to adapt as AI becomes more autonomous.

• Singapore. The Monetary Authority of Singapore issued AI risk management guidelines for all financial institutions on October 7, 2026, taking effect from October 2027.

5. Core Components of an AI Governance Framework Across the AI Lifecycle

An AI governance framework works best when its controls follow the AI lifecycle. That way, every system meets the right check at the right stage. This is sometimes called the AI compliance lifecycle

Around the lifecycle sit five components that hold the framework together.

• AI inventory. One register of every AI system, including vendor tools and AI built into software the firm already uses.

• Risk tiering. Low-risk internal tools get light controls, while customer-facing decisions get the full set.

• AI governance policy. Rules for building, buying, and using AI, including an acceptable use policy for public GenAI tools so staff do not paste customer data into them (often called shadow AI).

• Documentation. Standard records of each system’s purpose, data, limitations, test results, and approvals.

• Incident response. A clear route to report, investigate and fix AI failures, and to pause a system if needed.

6. AI Governance Roles and Responsibilities

Effective AI governance requires clear ownership across the organisation. Each function plays a distinct role in setting expectations, managing risks, implementing controls and ensuring accountability.

1. Board: Sets AI risk appetite, approves the governance framework and receives regular reports on AI-related risks.

2. Executive owner: Usually a Chief AI, Data or Risk Officer who oversees the framework and resolves conflicts between business priorities and risk controls.

3. First line (business and model owners): Takes responsibility for individual AI systems, their outcomes and day-to-day controls.

4. Data and engineering teams: Build data lineage, testing, monitoring and logging into AI systems.

5. Second line (risk and compliance): Sets governance standards, reviews high-risk use cases and challenges model owners where necessary.

6. Third line (internal audit): Independently tests whether the governance framework works as intended and reports findings to the board.

People need the skills to play these roles. Regular AI literacy training helps reviewers spot weak outputs instead of approving them by default. Some firms also back key staff to earn professional certifications, such as the IAPP’s Artificial Intelligence Governance Professional (AIGP), which signals expertise to clients and examiners.

7. AI Data Governance starts in the Data Layer

Most AI governance failures start in the data, not the model. A credit model cannot give accurate adverse-action reasons if no one can trace which data drove the decision. A GenAI assistant cannot be trusted if it can read files the user asking the question is not allowed to see. Policies written on paper do not fix either problem. Controls in the data layer do.

AI data governance gives every AI system four things.

• Lineage. Every input can be traced from its source system to the model and to the decision. A reviewer can then check a result the way an auditor checks a number.

• Quality. Data is tested for completeness, accuracy, and consistency before it trains or feeds a model, with agreed definitions for key fields.

• Access control. AI sees only what the person or process using it is entitled to see, enforced in the data layer rather than in a prompt instruction.

• Auditability. The firm can show which data, version, and logic produced any decision, months after the fact.

This is where governance becomes practical. When lineage, quality checks, and access rules are built into data pipelines, much of the evidence examiners ask for is produced automatically, and each new AI use case starts from a governed foundation instead of from scratch.

See how Muoro builds governed data foundations for AI.

8. AI Security Governance and Data Privacy

AI creates new ways for data to leak and for systems to be manipulated. Security and privacy therefore need their own controls within the governance framework. These are the main threats.

• Prompt injection. Hidden instructions in a document, email, or web page that make an AI system ignore its rules.

• Data leakage. Customer or confidential data exposed through AI outputs, training data, or staff pasting it into public tools.

• Deepfakes and impersonation. AI-generated voices, faces, and documents used to get past identity checks or trick staff.

• Model theft and tampering. Attempts to copy a model or poison the data it learns from.

Existing rules already apply. The Gramm-Leach-Bliley Act governs how financial firms protect customer information, and the New York DFS has made clear that its cybersecurity regulation (Part 500) covers AI risks. Its guidance stresses vendor due diligence and multi-factor authentication, and encourages authentication methods that can resist deepfakes.

Practical controls include least-privilege access for AI systems, approved tools for staff, data loss prevention on AI interactions, red-team testing before launch, and logging of every prompt and output on high-risk systems.

9. Generative and Agentic AI Governance in Financial Services

Generative AI and AI agents are where governance is least settled. SR 26-2, the US banking regulators’ revised model risk guidance, explicitly places generative and agentic AI outside its scope. That does not mean they are ungoverned. It means each firm must decide how to govern them, and examiners will ask how it did. The Conference of State Bank Supervisors’ AI supervisory framework, for example, tells examiners to look at controls for hallucinations, data leakage, prompt injection, and the ability to stop automated activity. Generative AI governance focuses on what the system says.

• Evaluate outputs against test sets approved by subject-matter experts before launch and after every change.

• Ground answers in approved sources and show those sources to the user.

• Set rules for where GenAI can draft and where a person must approve, especially in customer communications.

Agentic AI governance in financial services focuses on what the system does. Agents can take actions, such as updating records, sending messages, or moving cases through a workflow. That is why they need extra controls.

• Clear limits on which actions an agent may take, and which need human approval.

• A log of every action, input, and decision, which allows any outcome to be reconstructed.

• A way to pause or stop an agent immediately.

• Monitoring for agents behaving outside their expected pattern.

As a practical rule, start agents in assist mode, with a person approving each action, and widen their authority only once the controls have been shown to work.

10. Managing Third-party and Vendor AI

A firm stays accountable for AI it buys, not just AI it builds. Regulators are consistent on this point. Oversight follows the use case, not who wrote the model. That covers more than it first appears.

• Foundation model providers whose large language models sit behind internal assistants and chatbots.

• AI built into existing software, such as CRM, core platforms or contact-center tools, often switched on by a vendor update.

• Specialist AI vendors for credit decisioning, fraud, underwriting or compliance.

• Fintech partners whose AI makes or shapes decisions under the firm’s name.

• Fourth parties, the vendors your vendors depend on, whose outage or breach can reach you.

Good third-party AI governance adds AI questions to existing due diligence. It asks what data the vendor uses and keeps, how the model was tested for bias and accuracy, what documentation and audit rights the contract gives you, and how you will be told about model changes. Vendor AI then goes into the same inventory, risk tiers, and monitoring as AI built in-house. The NAIC model bulletin, for example, expects insurers to build audit and cooperation rights into contracts with AI and data vendors.

11. AI Model Governance in Finance: Monitoring, Fairness and Explainability

Approval is not the end of governance. Models change in production even when no one touches them, because the world they model changes. AI model governance in finance keeps watching three things after launch.

Performance and drift

Track accuracy against agreed thresholds and check whether incoming data still looks like the data the model learned from. Set alerts so a model that drifts past its limits is reviewed, retrained, or paused.

Fairness and bias

Test outcomes across customer groups before launch and on a regular schedule after it. In lending and insurance, this is how firms show their models do not discriminate, and it is a regular focus for examiners.

Explainability

Be able to say why a model reached a decision, in terms a customer and an examiner can understand. For lenders, this is a legal duty. Regulation B requires the specific principal reasons for any adverse action, and a complex or proprietary model does not change that. Saying an applicant fell below the model’s cut-off is not enough.

Customers increasingly expect to know when AI is involved. The NAIC bulletin expects insurers to tell consumers when AI is in use, and Colorado’s new law requires notice before automated decisions in financial services. A short, plain disclosure, with a route to a human, is becoming standard practice.

12. Tools and Technology for AI Governance

You do not need a dedicated platform to start governing AI, but you do need tooling that produces evidence without manual effort. Whatever you choose, an AI governance stack should cover five areas.

• Inventory and workflow. One register of AI systems, with intake, risk tiering, and approvals.

• Data lineage and quality. Tracing data from source to model to decision.

• Testing and evaluation. Accuracy, fairness, robustness, and, for GenAI, output quality.

• Monitoring and logging. Drift, performance, incidents, and a record of AI decisions and actions.

• Access and security controls. Who and what each AI system can see and do.

Many firms already own much of this in their data platforms, MLOps tools, and GRC systems. The build-versus-buy question is less about software and more about connecting what exists so governance runs inside the workflow. When comparing the best AI governance tools for financial services, check whether they work with your existing data stack, cover vendor and GenAI systems, and export the evidence your examiners expect.

13. Implementing AI Governance with an Assessment and a Phased Roadmap

Start with an AI governance assessment. It shows where AI is already in use, how it is controlled today, and where the gaps are against the rules that apply to you. The Treasury FS AI RMF includes an adoption-stage questionnaire that is a useful benchmark for this.

Timelines depend on how much AI a firm runs, how mature its data is, and how many jurisdictions it operates in. Those same factors drive cost.

Governance should scale with the firm. Regulators, including those behind SR 26-2 and Singapore’s new guidelines, expect controls proportionate to risk. A mid-size lender with a handful of models does not need the structure of a global insurer, but it still needs an inventory, risk tiers, clear owners, and evidence for its highest-risk decisions.

14. What Supervisors Expect in AI Examinations

Supervisors are moving from asking whether firms use AI to asking them to prove it is controlled. Three recent documents show what they look for.

• The CSBS AI supervisory framework (September 2026) guides state bank examiners through four areas, namely the firm’s AI footprint, governance and oversight, AI inventories and use cases, and controls for generative and agentic AI.

• FINRA’s 2026 Regulatory Oversight Report expects GenAI to sit inside existing supervision, with testing before launch, monitoring after it, and logs of outputs.

• The NAIC bulletin expects insurers to be able to produce their AI governance documentation during an investigation or market conduct review.

In practice, keep this governance documentation ready for any AI system an examiner might ask about.

• A current AI inventory with owners and risk tiers

• The AI policy and evidence that staff follow it

• Validation and testing results, including fairness testing

• Approval records showing who signed off and when

• Monitoring reports, incidents and how they were resolved

• Vendor due diligence and contract terms for third-party AI

• Board and committee reporting on AI risk

If assembling this takes weeks of manual work, that is itself a finding. The aim is for the evidence to come straight out of the systems described in sections 5 to 11.

15. AI Governance Best Practices and Common Mistakes in Financial Services

Best practices.

1. Match controls to risk. Put the most effort into decisions that affect customers, markets, or capital, and keep low-risk internal tools simple.

2. Build governance in from the design stage. Adding approvals, logs, and tests after launch costs more and works less well.

3. Govern the data first. Lineage, quality, and access controls make every later control easier to prove.

4. Keep one inventory. Include vendor AI, embedded AI, and staff use of GenAI tools, not just models the firm built.

5. Use existing structures. Extend model risk, third-party risk, and change management processes rather than creating a parallel system.

6. Review and update. Rules and models change. Review the framework at least once a year and after any major rule change.

Common mistakes

• Governance on paper only. A policy no system enforces does not control anything.

• Treating a prompt instruction as a control. Telling a model to ignore certain data does not stop it from reading that data. Access must be restricted in the data layer.

• Ignoring vendor and embedded AI. Some of a firm’s riskiest AI arrives through software updates, not projects.

• Governing the pilot, not the spread. Controls set for the first use case are not extended as AI use grows.

• One set of controls for everything. Treating a meeting summarizer like a credit model wastes effort and slows adoption.

• Reviewers who rubber-stamp. Human oversight only works if reviewers can see how an output was produced and have time to challenge it.

The common challenges behind these mistakes are fragmented data, unclear ownership between risk and technology teams, and governance skills that lag behind AI adoption.

16. How to Measure AI Governance with Metrics and KPIs

Governance that cannot be measured cannot be managed or reported to the board. A small set of KPIs is enough.

1. Inventory coverage: Measures the share of AI systems, including third-party and vendor-provided AI, that are registered and assigned a risk tier. The target should be close to 100%.

2. Lineage coverage: Tracks the share of high-risk AI systems whose decisions can be traced back to their source data. The target should be 100%.

3. Time to approve: Measures the number of days between use-case submission and approval, broken down by risk tier. Approval times should decrease without skipping required review steps.

4. Overdue reviews: Counts models that have passed their scheduled validation or review dates without being assessed. The target should be zero.

5. Fairness test pass rate: Measures the share of tested models that meet agreed fairness thresholds. The pass rate should increase over time.

6. AI incidents: Tracks the number and severity of AI-related failures, along with the time taken to resolve them. Both incident severity and resolution time should decrease.

7. Policy exceptions: Measures instances of unapproved AI tools or uses detected within the organization. The target is to reduce these occurrences over time.

For the board, report a short version every quarter covering total AI in use by risk tier, the highest-risk systems and their status, incidents, overdue reviews, and changes in regulation that affect the firm.

17. AI Governance Trends and What’s Next for Financial Services

Four AI governance trends will shape the next two years for financial firms.

• Agentic AI comes under supervision. Examiners already ask about controls for AI agents, and Singapore’s regulator plans to consult on agentic AI guidance in 2027. Expect US guidance to follow.

• The federal–state contest continues. Federal action against state AI laws and new state laws, such as Colorado’s, will keep pulling in different directions. Firms will need governance that works under either outcome.

• Deadlines get firmer. EU high-risk obligations are now set to apply from December 2, 2027, and Singapore’s guidelines from October 2027.

• Evidence over policy. The AI governance future is less about writing principles and more about proving, system by system, that controls work.

18. How Muoro Helps FSI Firms with AI Governance Services

Muoro helps financial services firms get AI into production with governance built in, starting where most governance breaks, which is the data. We work with risk, compliance, data and technology teams in four ways.

• Assess where AI is in use today, how it is controlled and where the gaps are against the rules that apply to you.

• Build governed data foundations with lineage, quality checks and access controls that produce audit evidence automatically.

• Embed controls such as testing, approval workflows, monitoring and logging into the AI systems you run, including GenAI and AI agents.

• Scale governance across use cases, which lets each new AI project start from a controlled foundation.

19. Frequently Asked Questions

What is AI governance in financial services, in simple terms?

It is the way a financial firm makes sure its AI is used safely, fairly, and lawfully. In practice, that means every AI system has an owner, a risk rating, approved data, tested results, human oversight where needed, and records that prove all of this to customers and regulators.

What are the pillars of AI governance?

Most frameworks share six pillars, namely accountability, transparency and explainability, fairness, robustness and security, privacy and data governance, and human oversight. They come from widely adopted principles such as the OECD AI Principles and are turned into controls across the AI lifecycle.

What are the key elements of AI governance?

Two elements matter most. The first is people and process, meaning clear owners, policies, risk tiers, and approval routes. The second is technical controls such as data lineage, testing, monitoring, and logging. One without the other fails, because policies need systems to enforce them and systems need owners to act on them.

What is an example of AI governance for finance teams?

A lender using a credit model registers it in an AI inventory, rates it high-risk, documents its data, tests it for bias, has it independently validated, and logs each decision with the reasons behind it. When a customer is declined, the firm can give specific reasons, as US fair-lending rules require.

How are large financial firms using and governing AI?

Large firms use AI for fraud detection, credit decisions, customer service, research, and software development. The leaders govern it through a single AI inventory, risk-based approval routes, central standards for testing and monitoring, and board-level reporting, often by extending the model risk and third-party risk processes they already run.

What is the difference between AI governance and AI compliance?

AI compliance means meeting the specific rules that apply today. AI governance is the wider system of ownership, controls, and evidence that makes compliance repeatable as rules, models, and use cases change. Good governance makes compliance easier to prove, but compliance alone does not create governance.

Is AI governance a legal requirement for US financial firms?

There is no single federal AI law for financial services, but existing rules on fair lending, consumer protection, privacy, cybersecurity, and model risk already apply to AI. Some states add AI-specific duties, and examiners now ask about AI controls. In practice, firms need governance to show they meet these obligations.

Does SR 26-2 apply to generative AI and AI agents?

No. SR 26-2, issued in April 2026, explicitly places generative and agentic AI outside its scope and covers traditional models, including machine learning. Firms still have to govern GenAI and agents, usually by drawing on the Treasury FS AI RMF, the NIST AI RMF, and their own risk frameworks.

Who should own AI governance in a financial institution?

The board sets risk appetite and oversees AI risk, and a named executive owns the framework. Business owners are accountable for each AI system, risk and compliance set and check the standards, data and engineering teams build the controls, and internal audit tests that it all works.

Do smaller and mid-size financial firms need a formal AI governance framework?

Yes, but it can be simple. Regulators expect controls proportionate to risk. A smaller firm needs an inventory, risk tiers, clear owners, an AI use policy, and evidence for its highest-risk decisions, not the structure of a global institution.

How long does it take to put AI governance in place?

A foundation (inventory, risk tiers, owners, and policy) typically takes one to three months. Building controls into priority systems takes several more months, and extending them across the firm is ongoing. The pace depends on how much AI you run and how mature your data is.

Does the EU AI Act apply to US financial firms?

It can. The Act applies to AI systems placed on the EU market or whose outputs are used in the EU, regardless of where the firm is based. For financial firms, credit scoring of individuals and life and health insurance pricing are high-risk uses, with obligations now set to apply from December 2, 2027.