AI risk governance and model risk management for financial institutions
AI risk governance means deciding, at board level, where AI may be used and how much risk is acceptable, then giving every AI use case an owner, an inventory entry, a materiality rating and controls in proportion to that rating. Since April 2026, traditional and machine-learning models follow the risk-based SR 26-2 model risk guidance, while generative and agentic AI need a separate AI governance track benchmarked to the FSB and MAS texts.
What do supervisors expect from banks on AI in 2026?
The direction is consistent across jurisdictions: board ownership, a complete inventory, risk-proportionate controls across the AI life cycle, human oversight, and no outsourcing of accountability to vendors.
| Text | Scope | Core expectations | Key dates |
|---|---|---|---|
| SR 26-2 (Fed, OCC, FDIC) | Models and non-generative AI; most relevant above $30bn assets | Risk-based MRM by materiality; effective challenge; validation; monitoring; vendor models | Issued 17 Apr 2026 |
| FSB sound practices | All AI, all financial institutions | 12 practices: governance plus life-cycle controls incl. human oversight and third-party AI | Final 15 Oct 2026 |
| MAS AI guidelines | All MAS-regulated FIs and all AI | Oversight, inventory, materiality, life-cycle controls, independent validation for high materiality | Issued 7 Oct 2026; from Oct 2027 and Oct 2028 |
| EU AI Act | AI on the EU market; credit scoring is high-risk | Risk management system, data governance, documentation, human oversight | High-risk obligations moved to 2 Dec 2027 (provisional) |
| NIST AI RMF | Voluntary, any organisation | Govern, Map, Measure, Manage | AI RMF 1.0, Jan 2023 |
How should a bank structure AI and model governance?
Use one inventory and two governance tracks. Models within SR 26-2 scope go through model risk management; generative and agentic AI go through the AI policy. Both feed the same board reporting, so nothing is governed twice or not at all.
| Type of system | Governed by | Controls that matter most |
|---|---|---|
| Statistical and financial models (credit, market, ALM) | Model risk management (SR 26-2 style) | Materiality tiering, independent validation, outcomes analysis, monitoring |
| Machine-learning models (fraud, AML, scoring) | Model risk management plus fairness checks | Validation, drift monitoring, explainability, fairness testing |
| Generative AI (assistants, drafting, chat) | AI policy and AI inventory | Human review, retrieval from approved sources, prompt-injection defences, data terms |
| Agentic AI (agents acting in systems) | AI policy plus operational risk | System-enforced limits, approval gates, kill switch, full logging, fallback |
| Vendor and embedded AI | Third-party risk plus the above | Due diligence, contract clauses, outcome monitoring, exit plans |
What are the minimum AI controls every institution should have?
- A board-approved AI risk appetite with measurable limits and quarterly reporting.
- A named business owner for every AI use case, recorded in the inventory.
- A complete AI and model inventory, reconciled twice a year against contracts and licences.
- A documented materiality method based on impact, exposure, purpose, complexity and autonomy.
- Testing before launch and monitoring after, proportionate to materiality.
- Human oversight designed for each use, with approval gates for irreversible actions.
- A tested kill switch and manual fallback for every material AI process.
- Provider contracts that ban training on your data and require notice of model changes.
Each control comes from the AI and model risk register, where it is linked to the specific risk it mitigates.
How can a small or mid-sized institution get started in 90 days?
Days 1 to 30: inventory and appetite
Collect every AI and model use including vendor-embedded AI, name owners, and agree an AI risk appetite statement with the board.
Days 31 to 60: rate and control
Score materiality, tier each use case and apply the minimum controls, starting with high-tier and customer-facing uses.
Days 61 to 90: evidence and report
Record tests, approvals and monitoring in one system, set KRIs, train the board and report the first AI risk profile to the risk committee.
The cloud risk management software holds the inventory, ratings, controls, KRIs and actions in one place and can be live within 24 hours.
Guides in this topic
SR 26-2 model risk management: what changed and what to do now
SR 26-2 replaced SR 11-7 in April 2026. What changed in model risk management, why generative and agentic AI are excluded, and what banks should do now.
How banks govern generative AI: key risks and controls
How banks govern generative AI: hallucination, prompt injection, data leakage and misconduct risks, with controls that work, from the Doorstep risk register.
Agentic AI controls for financial institutions
Agentic AI controls for banks: hard limits, human approval, kill switches and full logging for AI agents that act in systems on the institution's behalf.
FSB sound practices for responsible AI adoption: what financial institutions should do
The FSB published 12 sound practices for responsible AI adoption on 15 October 2026. What each means for banks and insurers, applied proportionately.
How to build an AI and model inventory with risk tiering
Step-by-step: build an AI and model inventory, rate each use case by materiality and set controls by tier, in line with SR 26-2, the FSB and MAS.
MAS Guidelines on AI Risk Management: key expectations and timeline
MAS issued Guidelines on AI Risk Management on 7 October 2026. Who they apply to, the timeline to October 2027 and 2028, and the key expectations explained.
Applying the NIST AI Risk Management Framework in financial services
How banks use the NIST AI Risk Management Framework: Govern, Map, Measure and Manage translated into practical controls for financial institutions.
The EU AI Act for banks: credit scoring, deadlines and what applies now
What the EU AI Act means for banks and insurers: credit scoring as high-risk AI, the Digital Omnibus delay to December 2027, and what still applies now.
What happened in AI and model risk regulation this year?
- 17 Apr 2026: SR 26-2 replaces SR 11-7Federal Reserve, OCC and FDIC issue risk-based model risk guidance; generative and agentic AI excluded.
- 7 May 2026: EU AI Act high-risk deadline movedDigital Omnibus provisional agreement: credit scoring and other Annex III obligations to 2 December 2027.
- 7 Oct 2026: MAS Guidelines on AI Risk ManagementApply to all MAS-regulated institutions and all AI; core expectations from October 2027.
- 15 Oct 2026: FSB final sound practices for AITwelve practices for organisation-wide AI governance and the AI life cycle.
Primary sources (reviewed 17 Oct 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
- Regulation (EU) 2024/1689, the EU Artificial Intelligence Act
- NIST: Artificial Intelligence Risk Management Framework (AI RMF 1.0, January 2023)
- NIST AI 600-1: Generative Artificial Intelligence Profile (July 2024)
- ISO/IEC 42001:2023, Artificial intelligence management system
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
What is AI risk governance in banking?
AI risk governance is the set of board-approved policies, roles, inventories, assessments and controls that decide where a bank may use AI, how much risk it accepts, and how each AI use is tested, monitored and stopped if needed. It extends model risk management to generative and agentic AI and links AI to operational, cyber, conduct and third-party risk frameworks.
Does SR 26-2 replace SR 11-7?
Yes. SR 26-2, issued on 17 April 2026, supersedes SR 11-7 and SR 21-8. It keeps effective challenge, validation and model inventories but makes the approach explicitly risk-based by model materiality.
How should a bank govern generative AI if SR 26-2 excludes it?
Through an AI policy and AI inventory that sit alongside model risk management, with controls proportionate to materiality: human review, input and output filtering, testing before launch, monitoring, data protection terms with providers, and kill switches for agents. The FSB and MAS texts cover all AI and are the best benchmarks.
Who should own AI risk in a bank?
The board sets AI risk appetite and oversees it. A named business owner is accountable for each AI use case, the risk function owns the AI risk framework and independent challenge, compliance covers conduct and legal risk, and internal audit gives independent assurance.
How long does it take to set up AI governance?
A proportionate baseline (policy, inventory, materiality method, minimum controls and reporting) can be in place in about 90 days for a small or mid-sized institution. Validation and monitoring of material use cases then follows a risk-based schedule.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.