Govern AI, model and operational risk with controls you can use this month
Practical guidance for banks, insurers, brokerages and fintechs on AI governance under SR 26-2, the FSB and MAS, built on a free register of 1,208 risks and 3,267 controls and on cloud software you can start within 24 hours.
| Risk | Rating |
|---|---|
Agent acts outside its intended authority
| High |
Hallucinated or inaccurate outputs
| Medium |
Incomplete AI inventory
| Medium |
What are financial institutions asking about AI and risk right now?
Three questions dominate board agendas and supervisory conversations in 2026. Each has a complete guide with tables, checklists and primary sources.
How do we govern generative and agentic AI now that SR 26-2 excludes them?
How to govern traditional, generative and agentic AI under SR 26-2, the FSB sound practices and the MAS guidelines.
Read the full guideHow does AI change operational, cyber and third-party risk?
How AI changes operational, cyber and third-party risk, and the controls that keep critical services running.
Read the full guideHow do we prove our AI is fair, explainable and lawful?
Fair, explainable and lawful AI in lending, AML and customer service, and how to evidence it.
Read the full guideWhat are the key risks and controls in each banking function?
The free register covers 32 functions, from retail banking and treasury to information security and a new AI and model risk function.
Open the registerWhat changed in AI and model risk regulation in 2026?
Four supervisory texts reshaped expectations this year. In short: model risk is now explicitly risk-based, generative and agentic AI need their own governance, and supervisors expect boards to own AI risk appetite.
- 17 Apr 2026: SR 26-2 replaces SR 11-7Federal Reserve, OCC and FDIC issue risk-based model risk guidance; generative and agentic AI excluded.
- 7 May 2026: EU AI Act high-risk deadline movedDigital Omnibus provisional agreement: credit scoring and other Annex III obligations to 2 December 2027.
- 7 Oct 2026: MAS Guidelines on AI Risk ManagementApply to all MAS-regulated institutions and all AI; core expectations from October 2027.
- 15 Oct 2026: FSB final sound practices for AITwelve practices for organisation-wide AI governance and the AI life cycle.
Why practitioners use this guidance
The recommendations come from someone who has run these functions, not only advised on them. Ahmer Nehal spent more than 30 years with eight large commercial banks across the GCC, including Mashreq Bank Dubai and HSBC MENA, as Head Risk and Fraud and SVP and Head of Operational and Environmental Risk. He implemented operational risk frameworks, built in-house risk software, and reduced fraud incidents and operational losses.
He has trained senior management on operational risk, compliance risk and FATCA, and spoken at the Excellence in Operational Risk MENA conference in Dubai. The same experience shaped the risk register and the risk management software.
Which path fits your institution?
Implement now
Small or mid-sized bank, fintech, insurer or brokerage that needs an industry-standard register, RCSA, KRIs, incidents and an AI inventory without a long project. Start within 24 hours.
See the softwareBuild capability
Board, risk, compliance or audit teams that need to understand AI governance, SR 26-2 model risk or operational resilience well enough to challenge and decide.
See trainingGo deeper
An AI governance framework, a model risk gap assessment against SR 26-2, or facilitated RCSA workshops designed with a practitioner.
See advisoryLatest articles
The Venture Capitalist Mindset And How to Get One on Your Side
Discover the unique mindset of venture capitalists, their approach to risk, opportunity, and long-term thinking, and learn how founders can attract the.
Why Vocalink was Fined 11 Million Pounds by the Bank of England
A landmark enforcement action by the Bank of England highlights critical lessons for financial infrastructure firms. Discover what it means for the future.
Citigroup's $81 Trillion Dollar Mistake
Discover insights behind a staggering $81 trillion transaction error by one of the world’s largest financial institutions. How prepared are you for such.
The One Thing Every HR Head Fears
Explore the hidden challenge keeping HR leaders up at night and discover practical, human-centered strategies to stay ahead of it. It is a fear that all HR.
Frequently asked questions
What does Doorstep International do?
Doorstep International helps banks, insurers, brokerages, money service businesses and fintechs manage AI, model, operational, cyber and compliance risk. It publishes a free risk register organised by banking function, provides cloud risk management software that institutions can start using within 24 hours, and delivers training and advisory work led by founder Ahmer Nehal.
Who is behind Doorstep International?
The founder, Ahmer Nehal, has more than 30 years of experience in governance, risk and compliance with eight large commercial banks across the GCC region, including Mashreq Bank Dubai and HSBC MENA. His roles include Head Risk and Fraud and SVP and Head of Operational and Environmental Risk.
Does SR 26-2 apply to generative AI?
No. SR 26-2, issued on 17 April 2026 by the Federal Reserve, OCC and FDIC, states that generative AI and agentic AI models are outside its scope because they are novel and rapidly evolving. It still expects institutions to use their risk management and governance practices to decide appropriate controls for them.
What is the FSB guidance on AI in financial institutions?
On 15 October 2026 the Financial Stability Board published 12 sound practices for responsible AI adoption. Four cover organisation-wide governance and eight cover the AI life cycle: materiality assessment, technology selection, data governance, explainability, performance evaluation, human oversight, AI-related cyber and ICT risk, and third-party AI dependencies.
Is the risk register free to use?
Yes. Every function in the register can be read free online, with its risks and best-practice controls. You can also request any function as a spreadsheet-ready RCSA workbook (CSV) after confirming your email address with a 6-digit code.
How quickly can we start using the risk management software?
Institutions can start using the cloud subscription within 24 hours of agreeing terms. It is designed for small and mid-sized banks, fintechs, insurers and brokerages that need industry-standard risk management without a long implementation project.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.