AI governance in a bank is not one rule but six obligations assembled from different places: the board owns an inventory of what is running; predictive models are validated under model-risk guidance while generative and agentic AI are governed through broader enterprise risk; the data behind every model is owned, traceable and complete; bought models and cloud providers sit under third-party risk management; a person can explain and override any decision that touches a customer's credit; and voluntary frameworks from NIST and Treasury fill the gaps the rules leave. Each pillar below states the expectation in a few sentences and maps it to the documents that ask for it, across the 41 authorities this tracker follows.
Two of the pillars have their own pages: model risk management (the framework, model inventory, validation and the three lines of defense) and, for the customer-facing side of human oversight, AI chatbots in banking.
Who has to own AI in a bank?
Every supervisor that has spoken puts AI under the board and senior management, through the same governance architecture that already covers models and technology: named accountability, an inventory of what is running, policies for how it is approved, and effective challenge from risk, compliance and internal audit. US model-risk guidance revised in April 2026 keeps that structure for predictive models and leaves generative and agentic AI to broader enterprise governance; the UK's SS1/23 names a senior manager; the ECB's supervisors have said accountability for AI decisions must be clear and oversight must match AI's strategic weight.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2 / OCC Bulletin 2026-13 / FDIC FIL-15-2026 | Federal Reserve | Board and senior-management governance, a model inventory and independent validation for models in scope; generative and agentic AI are outside scope and left to broader risk-management and governance practices. | In force from Apr 17, 2026 |
| PRA SS1/23 | UK (BoE / PRA / FCA) | Five model-risk principles for all models informing business decisions regardless of technology, AI-relevant tiering factors (unstructured data, explainability, bias), and a named Senior Management Function holder accountable for the framework. | In force from May 17, 2024 |
| ECB: 'Technology is neutral, governance is not' | ECB | Clear accountability for AI decisions, senior-management oversight matching AI's strategic importance, and effective challenge from risk, compliance and internal audit. | Stated Feb 24, 2026 |
| FSB sound practices 1–4 (consultation) | FSB | Strategic direction and oversight, governance and accountability, AI inside the risk-management framework, organisational adaptability. | Final report expected Oct 2026 |
| NCUA Letter 26-CU-01 | NCUA | Credit-union supervisory expectations for AI governance, risk assessment and vendor oversight. | In force |
Which AI systems count as models, and what validation do they need?
In the US, a machine-learning system that processes input data into quantitative estimates is a model and needs documented development, independent validation, ongoing monitoring and outcomes analysis scaled to its materiality. The 2026 revision narrowed the definition so that simple arithmetic and deterministic rules fall out, and it explicitly excludes generative and agentic AI from model risk management while promising an interagency request for information. Outside the US the perimeter is wider: the PRA keeps AI and machine learning inside model risk management, and the ECB's internal-models guide tests machine-learning capital models for explainability and justified complexity.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2 (Fed) | Federal Reserve | Risk-based, materiality-driven validation and monitoring; 'complex quantitative method' definition; generative and agentic AI out of scope. | In force from Apr 17, 2026 |
| SR 11-7 (the 2011 framework) | Federal Reserve | The validation disciplines that carry over: conceptual soundness, ongoing monitoring, outcomes analysis, effective challenge. | Superseded Apr 17, 2026 |
| ECB Guide to internal models, ML section | ECB | Machine-learning capital models must be adequately explainable and their complexity justified by performance. | In force from Jul 28, 2025 |
| EBA follow-up report on ML for IRB models | EBA | Principle-based recommendations on understanding, documentation, validation and stability of machine-learning capital models. | Published Aug 4, 2023 |
| OCC Bulletin 2023-17 / SR 23-4 (third-party models) | Federal Reserve | Vendor models are the bank's to understand and validate, with due diligence and monitoring through the relationship's life. | In force |
What do regulators expect of the data behind AI models?
Owned, traceable, complete and current: the BCBS 239 vocabulary that examiners use for risk data applies to training sets, feature stores and retrieval corpora, and the Basel Committee's January 2026 newsletter said AI makes robust data management more important, not less. The EU AI Act turns data governance into a legal duty for high-risk systems such as consumer credit scoring, with provenance, preparation, bias examination and gap analysis to be documented, from December 2, 2027 after the Digital Omnibus deferral.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| BCBS 239 | Basel Committee | Fourteen principles for risk-data governance, aggregation and reporting: ownership, architecture, accuracy and lineage, completeness, timeliness, adaptability. | G-SIBs from 2016 |
| BCBS 239 implementation newsletter | Basel Committee | AI and advanced automation depend on high-quality data; lineage and ad hoc reporting still 'a work in progress'. | Published Jan 6, 2026 |
| EU AI Act, Article 10 | EU AI Act | Documented data governance for training, validation and testing data of high-risk systems, including credit scoring of natural persons. | Stand-alone Annex III systems from Dec 2, 2027 |
| Treasury AI cybersecurity report | U.S. Treasury | Identified a 'fraud data divide' and proposed data 'nutrition labels' for vendor AI; became the AIEOG workplan. | Published Mar 27, 2024 |
How is a bank's reliance on external AI models and cloud providers supervised?
Through third-party risk management rather than a separate AI rule. The 2023 US interagency guidance covers the full lifecycle from due diligence to termination and expects validation of purchased models; the Basel Committee's December 2025 principles reach nth-party supply chains and concentration; and the FSB has singled out generative AI's dependence on a small number of hardware, cloud and model suppliers as a financial-stability vulnerability to monitor.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 23-4 / OCC 2023-17 / FDIC FIL-29-2023 | Federal Reserve | Planning, due diligence, contracting, ongoing monitoring and termination for every third-party relationship, including AI tools and foundation-model access. | In force from Jun 7, 2023 |
| BCBS Third-Party Risk Principles | Basel Committee | Twelve principles covering board accountability, due diligence, contracts, monitoring, continuity and exit, including nth-party chains and concentration. | Published Dec 10, 2025 |
| FSB AI monitoring report | FSB | Third-party dependencies and provider concentration named as vulnerabilities for authorities to track. | Published Oct 10, 2025 |
| FSB third-party risk toolkit | FSB | Toolkit for managing third-party and outsourcing risk, including critical service providers. | Published Dec 4, 2023 |
When must a person be able to explain or override an AI decision?
Whenever the decision touches a consumer's credit: US adverse-action law requires the specific principal reasons for a denial regardless of how complex the model is, the EU AI Act requires human oversight and a fundamental-rights impact assessment for high-risk credit scoring, and Colorado's Automated Decision-Making Technology Act adds notice, a plain-language explanation after an adverse outcome and human review from January 1, 2027, with a lender's ECOA notice satisfying the disclosure duty for the same decision.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| ECOA / Regulation B adverse action | CFPB | Specific principal reasons for adverse credit action; model opacity is not a defence. | In force |
| FCRA adverse action and key factors | CFPB | Key factors that adversely affected a credit score must be disclosed. | In force |
| EU AI Act, Articles 14 and 26–27 | EU AI Act | Human oversight, deployer duties and a fundamental-rights impact assessment for high-risk credit scoring. | Stand-alone Annex III systems from Dec 2, 2027 |
| Colorado SB 26-189 (ADMT Act) | Colorado AI Act | Consumer notice, a plain-language explanation within 30 days of an adverse outcome, data access and correction, human review. | Effective Jan 1, 2027 |
| CPPA ADMT regulations (California) | California CPPA | Notice, opt-out and access rights for automated decision-making technology in significant decisions, plus risk assessments. | In force |
What do banks use to govern generative and agentic AI where the rules stop?
The NIST AI Risk Management Framework and its generative-AI profile, Treasury's financial-services adaptation of it, and, for cyber, the New York and ECB letters on AI-enabled threats. None is binding on banks, but together they are what most US institutions cite for the systems that model-risk guidance now leaves out, and what examiners ask about when a bank's AI policy is on the table.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| NIST AI RMF 1.0 | NIST | Govern, Map, Measure, Manage and seven trustworthiness characteristics. | Voluntary |
| NIST AI 600-1 (Generative AI Profile) | NIST | Twelve generative-AI risks and more than 200 suggested actions mapped to the framework. | Voluntary |
| Treasury FS AI RMF and AI Lexicon | U.S. Treasury | The NIST framework adapted to financial services' operational, regulatory and consumer-protection specifics, with a shared vocabulary. | Published Feb 19, 2026, non-binding |
| DFS AI cybersecurity letter | NY DFS | AI-enabled social engineering, AI-enhanced attacks, data exposure and vendor dependency mapped to 23 NYCRR Part 500 obligations. | In force |
| ECB 'Dear CEO' letter SSM-2026-0301 | ECB | Every significant institution to assess AI-enabled cyber threats and submit an action plan to its supervisory team. | Plans due Oct 31, 2026 |
How do large banks practise responsible AI while innovating?
The largest US banks govern AI mostly through the structures they already run for model, technology and operational risk, and say so in their filings: Goldman Sachs has a Firmwide Artificial Intelligence Risk and Controls Committee reporting to its technology risk committee; Citigroup's board Technology Committee reviews management's approach to generative AI; Truist bases its AI program on the NIST AI Risk Management Framework with board oversight; BNY folds model risk management into a cross-functional AI risk framework. A few have published principles (PNC's six Responsible AI Principles, run by a working group under model risk management) or testing tools (JPMorgan Chase's Fence guardrails for hallucination, topic drift and prompt injection). The rest disclose AI mainly as a risk factor, and none has published a separate responsible-AI policy in its 10-K.
| Bank | What it has disclosed about governing AI | Where |
|---|---|---|
| Goldman Sachs | A Firmwide Artificial Intelligence Risk and Controls Committee oversees the risks of using AI and reports to the Firmwide Technology Risk Committee. | 2025 Form 10-K (Feb 2026) |
| Citigroup | The board's Technology Committee oversees and reviews management's approach to generative AI; Citi says it has policies governing emerging technologies, including in model risk management. | 2025 Form 10-K (Feb 2026) |
| Truist | Its AI program is 'foundationally based' on the NIST AI Risk Management Framework Core, and oversight of the program is a regular focus of the board and its risk and technology committees. | 2025 Form 10-K (Feb 2026) |
| BNY | Model risk management covers AI use cases, including large language models, and is integrated into a cross-functional AI risk management framework with an active model inventory. | 2025 annual report, Form 10-K Exhibit 13.1 (Feb 2026) |
| Bank of America | 'To address AI-related risks, we have implemented internal processes and governance frameworks', with compliance and operational-risk teams assessing them independently. | 2025 Form 10-K (Feb 2026) |
| PNC | Six Responsible AI Principles (accountability; transparency, explainability and accuracy; inclusion; fairness; reliability and security; privacy) and a Responsible AI Working Group, managed by Model Risk Management, that reports to the Operational Risk Committee. | PNC corporate-responsibility page (undated) |
| JPMorgan Chase | The Fence guardrail framework tests each large-language-model use case for hallucination, topic drift and prompt injection using synthetic data. | JPMorganChase technology blog (Apr 2026) |
| Capital One | Names the policies governing how data, models and AI are acquired, validated, stored and analysed as a dependency in its 10-K, and co-founded the USC–Capital One Center for Responsible AI and Decision Making in Finance (CREDIF) in April 2024. | 2025 Form 10-K; Capital One tech blog (Apr 2024) |
| Wells Fargo | Discloses AI as a risk: data may be inaccurate or biased and some models have 'limited transparency'; 'even though we may have controls', AI could lead to poor decisions. | 2025 Form 10-K (Feb 2026) |
| American Express | Discloses the risk of failing to 'safely deploy AI systems and implement appropriate governance and controls'. | 2025 Form 10-K (Feb 2026) |
SOURCES: Goldman Sachs 2025 Form 10-K ↗ · Citigroup 2025 Form 10-K ↗ · Truist 2025 Form 10-K ↗ · BNY 2025 annual report (Form 10-K Exhibit 13.1) ↗ · Bank of America 2025 Form 10-K ↗ · PNC, Protecting Customer Privacy and Security ↗ · JPMorganChase, Strengthening LLM guardrails with synthetic data generation ↗ · Capital One 2025 Form 10-K ↗ · Capital One and USC partner to drive responsible AI (CREDIF) ↗ · Wells Fargo 2025 Form 10-K ↗ · American Express 2025 Form 10-K ↗
Which governance documents has each authority published?
| Date | Event | Document |
|---|---|---|
| Jul 24, 2026 | Digital Omnibus defers EU high-risk duties to Dec 2027 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) |
| Jun 10, 2026 | FSB consults on twelve sound practices | FSB AI sound practices consultation (June 2026) |
| May 14, 2026 | Colorado re-enacts its AI law as the ADMT Act | SB 26-189 |
| Apr 17, 2026 | SR 26-2 replaces SR 11-7; generative and agentic AI carved out | SR 26-2 |
| Feb 19, 2026 | Treasury FS AI RMF and lexicon | Treasury FS AI RMF and AI Lexicon (Feb 2026) |
| Dec 10, 2025 | Basel third-party risk principles reach AI supply chains | BCBS Third-Party Risk Principles (Dec 2025) |
| Jul 26, 2024 | NIST generative-AI profile | NIST AI 600-1 (Generative AI Profile) |
| Jul 12, 2024 | EU AI Act published; credit scoring is high-risk | Regulation (EU) 2024/1689 |
| Jun 7, 2023 | SR 23-4 third-party guidance covers vendor AI | SR 23-4 |
| May 17, 2023 | PRA SS1/23 keeps AI inside model risk management | PRA SS1/23 |
| Jan 26, 2023 | NIST AI RMF 1.0 published | NIST AI RMF 1.0 |
| Jan 9, 2013 | BCBS 239 sets the data-governance standard | BCBS 239 |
| Apr 4, 2011 | SR 11-7 makes model governance an examinable discipline | SR 11-7 |
Which of the 120 largest US banks have disclosed AI governance arrangements?
93 of the 120 bank pages on this site record a governance-related AI activity, from AI committees and chief AI officers to training programmes and model-data controls. Each links to the bank's page, where the claim is sourced.
| Bank | What the record shows | Status |
|---|---|---|
| JPMorgan | Firm-wide AI use-case portfolio: Almost 1,000 use cases, about 50 of them 'really important' across risk, fraud, marketing, hedging, prospecting, note-taking, idea generation and document reading; AI solutions in production doubled in 2025. | In production |
| BofA | The Academy simulators: AI conversation simulators for employee coaching. | In production |
| Goldman | Trade and transaction accounting agents: Automating accounting for trades and transactions. | Pilot |
| Morgan Stanley | Compliance task automation: Bots handling routine non-financial-risk work. LeadIQ: AI that introduces advisors to clients interested in advice and matches individuals with advisors. | In production |
| U.S. Bank | AI Essentials Channel: Skills Academy training on using company-approved AI tools in daily work. | In production |
| PNC | Model-data nutrition labels: Adopting the FSSCC concept for documenting training and input data. | Rolling out |
| Truist | Client Pulse: Patent-pending AI aggregating client feedback across millions of conversations. | Pilot |
| Schwab | Schwab Advisor AI in Action: Education, peer networking and resources for RIAs adopting AI. Advisor Services AI tooling: AI to move data across advisers' systems, automate tasks and answer questions on Schwab policies and procedures. | In production |
| BNY | Anomaly detection in daily calculations: Flags areas for review in minutes instead of hours. Community-bank AI training: Free AI and cyber training for 1,000 community-bank executives, led by senior BNY leaders. | In production |
| TD | Agent observability and guardrails: US CIO describes chain-of-thought monitoring of agent reasoning plus guardrails and human oversight at design and operational stages, to contain agents that find unpredictable routes to a goal. | In production |
| Fifth Third | Merger-conversion monitoring: AI tools tracking the Comerica integration. | In production |
| Huntington | Enterprise-wide AI program: Five areas: software delivery, agentic process transformation, customer-facing use cases, colleague productivity and training, and data platforms. | In production |
| BMO | Responsible AI framework: Accountability, reliability, security, explainability, transparency, fairness, privacy, sustainability. Approved-tools rule and Microsoft Copilot: Only BMO-approved AI tools may be used for business; Copilot and Copilot Chat under acceptable-use guidance. | In production |
| First Citizens | Responsible-AI framework: A framework for responsible AI adoption and governance, established before the bank set out to scale AI use cases; benefits are tracked for every AI use case. | In production |
| Citizens | Business Pulse survey research on client AI adoption: Quarterly small-business survey tracking AI spending and adoption among Citizens' commercial clients. | In production |
| Amex | Third-generation data and analytics platform: Public-cloud platform for personalisation, servicing, fraud and GenAI and agentic use cases; 90% faster key marketing and fraud processes. | Rolling out |
| M&T | Data lineage, Edison and the Data Academy: The data foundation under the AI program; ~2,000 employees trained. | In production |
| Ally | Four-layer AI governance: Working group, steering council, enterprise committee and board; mandatory training; Responsible AI Institute membership. | In production |
| Northern Trust | Shared semantic data layer for AI agents (OSI): Open-source data definitions so agents across firms ground on the same meanings. | Announced |
| Pinnacle | Firm AI policy: An ethics-and-effectiveness policy for AI deployment across the business. Generative-AI restriction in the code of conduct: Team members may not use gen-AI applications or put proprietary data into unauthorised applications without approval through internal governance channels. | In production |
| UBS | UBS Claves platform and AI risk committee: One platform with model routing and evaluation; AI Operating & Risk Committee under a group AI policy. RiskLab model development and validation (Domino): An auditable AI model-development platform built on Domino Data Lab, being rolled out across the bank. | Rolling out |
| City National | Post-remediation risk management: Controls rebuilt after the 2024 OCC order; the frame for any AI deployment at the bank. | In production |
| Flagstar | Integrated AI governance workflow: Business case, compliance review and multi-level approvals in one auditable system. AI strategy committee and tiered model routing: The CIOO chairs an AI strategy committee attended by the CEO that prioritises a revenue and expense-reduction backlog; StarIQ routes work to three model tiers by complexity to manage cost. | In production |
| Webster | Category IV data and risk infrastructure: Data collection, storage and governance roles; regulatory-reporting capability. | In production |
| First Horizon | Enterprise Data Hub and data marketplace: Unified data with permission-based discovery of approved data products. | Pilot |
| Old National | AI for first-line risk management: The CEO's next target: 'checkers of checkers' work needed to embed risk into the first line as the bank grows. | Announced |
| UMB | Post-acquisition systems conversion: Product mapping, customer migration and platform consolidation after Heartland. Machine learning across the organisation: The CEO's description on the Q1 2026 call; no specific use cases, platform or figures disclosed. | In production |
| SouthState | AI enablement programme: Office hours, AI Central hub, crowdsourced prompt library; adoption run as change management. | In production |
| Columbia | Post-merger systems conversion: Pacific Premier converted in Q1 2026 after the Umpqua integration. | In production |
| CIBC | 'Agentic AI with humans in control': Human judgment, governance and culture at the centre of agent design. | In production |
| Valley | Five-tier AI access and monthly spend tracking: Specialised tiers for engineering, QA and model risk; ~80 open-access power users. Valley Foundry: A dedicated capability to identify, test and advance emerging technologies — initially AI, cybersecurity, and data and analytics — through startup, fintech and vendor partnerships. | In production, Announced |
| BOK Financial | Data-first model for responsible AI scaling: Enterprise data treated as a shared asset under the chief data and analytics officer. | Rolling out |
| FNB | Ethical and compliant AI strategy: Explicit remit of the director of AI and innovation. | Rolling out |
| SoFi | Planner-evaluated Coach with human escalation: Financial planners evaluate Coach's answers; rule sets escalate out-of-scope conversations; actions require member authorisation. | In production |
| EverBank | Omnichannel and customer-platform transformation: Digital, voice, contact-centre and branch context sharing under the head of digital and customer platforms. | Rolling out |
| Raymond James | AI Academy for advisors and associates: A four-course programme; nearly 20,000 completions by July 2026. Chief AI officer and AI strategy office: Cross-business identification of analytics, ML and gen-AI opportunities. | In production |
| Associated | Line-of-business AI accountability and board oversight: Senior director of AI stewards risk and data; board technology committee. | In production |
| Prosperity | Real-time core platform: New processing system as the stated base for future innovation; no AI use disclosed. | In production |
| Bank OZK | No disclosed internal AI use: Transcripts and releases contain no operational AI, automation or model references. | Announced |
| Atlantic Union | Exploratory AI programme: 'Exploring exciting opportunities with Artificial Intelligence'; agentic and third-party model risks flagged. | Pilot |
| Commerce | AI pillar in the enterprise data strategy: AI roadmap plus data-platform modernisation for speed to insight. | Rolling out |
| Hancock Whitney | AI Working Group: Legal, compliance, risk and IT; approves AI use cases and reports to the IT Risk Governance Committee; board oversight of AI. | In production |
| BankUnited | OpportunitiAI use-case programme: Per AWS's case study, an initiative rolled out to identify further generative-AI use cases and align business divisions. AI use 'not material' in filings: The 10-K calls current AI use 'not material to our operations'; no AI vendor or budget named in filings. | Rolling out, Announced |
| United Bank | No disclosed AI deployment: No AI programme, vendor or leader named in releases or investor materials. | Announced |
| Texas Capital | AI enablement under the CDIO: Data platforms, AI enablement and security in one technology organisation. | Rolling out |
| Fulton | Customer education on AI tools: AI in investing (private bank) and AI budgeting apps (education centre). | In production |
| Glacier | No disclosed AI deployment: Annual report and earnings materials describe no AI use; AI appears only as a risk factor. | Announced |
| Eastern Bank | Innovation-through-experimentation culture: CDO-led programme; AI framed as a workplace efficiency tool. | In production |
| Axos Bank | AI governance framework and enterprise AI assistant: Governance framework and infrastructure to educate, train and deploy AI tools to all team members; more than 500 on an enterprise AI assistant. | In production |
| United Community | Capacity-building through AI productivity: Clearing postponed product and process improvement projects. | Announced |
| Arvest | Innovation culture programme: Product and innovation office under Amy Morbeck; Fortune recognition. | In production |
| WaFd Bank | Build 2030 digital focus: Data used to anticipate client needs; NPS tracked as the outcome metric. | In production |
| WesBanco | Board Technology Committee and AI expertise criterion: A board Technology Committee (chaired by Zahid Afzal) and AI listed among desired director expertise in the 2026 proxy. | In production |
| Renasant | Security review for AI-involving products and processes: New products, delivery methods or back-office processes, 'each of which may involve the incorporation of AI technologies', must be assessed for information-security implications; the board Technology Committee oversees IT strategy and receives the CISO's report. | In production |
| First Interstate | 'One clean data source' consolidation: Data foundation for AI and other technology initiatives. | Rolling out |
| Customers Bank | Standardised AI risk framework and AI Innovation Lab: Enterprise governance for scaled deployment. AI charter, acceptable-use policy and use-case scoring: Monthly executive AI charter meetings on compliance, risk and policy; uses scored on value, cost, time to develop and risk. | In production |
| Rockland Trust | Office of Digital Innovation and AI governance framework: Gate for AI investments, favouring use cases with meaningful payback within a moderate risk approach; the governance model itself was still 'in process' in the September 2026 deck. | Rolling out |
| Simmons Bank | Enterprise Data Office: Data governance, data literacy and data-driven decision-making established under the first CDO. | In production |
| First Hawaiian | AI programme strategy and governance: Owned by the Digital Banking and Services Division under Jason Dang. Generative-AI usage policies: Written policies and technical safeguards for employees' and contractors' use of generative-AI tools; enterprise tools only for confidential inputs (merger-agreement representations). | In production |
| Cathay Bank | No disclosed AI deployment: Annual and responsibility reports silent on AI. Board oversight with AI expertise: Audit committee chair credited with insight into data analytics, automation and AI; a second director brings IT and information-security experience. | Announced, In production |
| Bank of Hawaii | Responsible-AI governance framework: Policies, oversight committees and ethical review protocols established in 2025. AI listed as an enterprise risk: Technology, AI and cybersecurity risk factors in the 10-K. | In production |
| Centennial Bank | No disclosed AI deployment: Earnings materials silent on AI. | Announced |
| First Financial Bank | No disclosed AI deployment: No AI reference in investor materials. AI strategy under construction; open AI sites blocked: The CISO's team is building the AI strategy by asking for each proposal the business case, the use case, who manages it and where the data goes, with organisational device access to open AI sites blocked meanwhile. | Announced |
| Mechanics Bank | No disclosed AI deployment: No named AI tool, vendor or budget; the Q1 2026 investor presentation says the technology roadmap is increasingly focused on AI tools for productivity. (Corrected 2026-09-24: previously said earnings materials were silent on AI.) | Announced |
| Seacoast Bank | Board technology and information-security expertise: March 2026 board refresh adds a sitting financial-services CIO whose remit includes AI, data and analytics. | In production |
| Optum Bank | Agentic-AI lending perspective from the chief credit officer: Public commentary on AI in lending and cross-unit data sharing. | Announced |
| Merchants Bank of Indiana | No disclosed AI deployment: Earnings materials silent on AI. | Announced |
| Stifel Bank | AI thought leadership for clients: Research outlook on AI's economic effects. | In production |
| Trustmark | Post-conversion efficiency programme: Management attention shifting to efficiency gains and possible M&A. | Announced |
| Bank of Hope | Acquisition integration (Territorial, SMBC MANUBANK): Hawaii and Japanese-corporate banking added to the Korean-American core. | Rolling out |
| ServisFirst Bank | AI in the technology-change risk factor: 10-K: rivals with greater resources may out-invest the bank in technology, including AI-driven products. | In production |
| Busey Bank | Enterprise AI and data-science function: Strategy, communication and execution of responsible AI/ML models across business units. | Rolling out |
| Community Bank N.A. | Dedicated AI team: More than a dozen staff, a handful fully dedicated; efficiency focus. Enterprise automation programme: More than 200,000 hours saved over three years, which management says helped keep headcount roughly flat while the business grew. | In production |
| Enterprise Bank & Trust | Client AI education (Enterprise University): AI strategy and Copilot courses for business owners. Fall 2026 Enterprise University: evaluating AI tools: More than 30 no-cost courses, with trending topics including evaluating AI tools and aligning AI adoption with business strategy. | In production |
| FirstBank | No disclosed AI deployment: Earnings materials mention AI only in the forward-looking-statement risk list; the 10-K discloses limited, non-critical internal use (see below). | Announced |
| First United Bank | Technology as enterprise capability: Strategy, operating model, data, risk and digital experience connected under one programme. AI program strategy and execution function: A named SVP-level director of AI program strategy and execution and an analytics team; no AI use case, model or vendor disclosed. | In production, Announced |
| Banner Bank | Generative AI policy and Fintech Council vetting: Board-approved policy since 2023; every proposed Gen AI application is vetted by the Fintech Council against strategic priorities, values, risk appetite and data-security policies. | In production |
| Synchrony | Responsible AI Working Group and generative-AI risk oversight: A working group anchors responsible use; risks related to generative AI are among the areas overseen by management subcommittees that report to the Board; the chief AI officer owns AI governance. | In production |
| USAA | Use-case intake, governance review and AI Aware training: Each use case is evaluated for value before funding, governance analysis precedes training, and the AI Aware course reaches all employees. | In production |
| Popular | Board oversight of AI and emerging-technology risk: The risk management committee oversees risk management for emerging technologies including AI; a Technology Committee oversees technology strategy and vendor risk. | In production |
| Wintrust | AI governance framework (early stage): The CEO says governance came first; the 10-K says the bank has policies governing AI applications and websites on its network, and cannot ensure they will be effective. | Rolling out |
| OceanFirst | Automation Transformation Office, AI governance framework and board oversight: A centralised ATO governs AI investment with ROI-based prioritisation; an AI governance framework and a model risk management policy are in place per the roadmap; the Board's Information Technology Committee oversees AI initiatives and directors received AI training. | In production |
| Citizens Business Bank | AI Policy, Policy Framework and AI Governance Council: The Council, chaired by the COO with the CIO, CISO, Human Resource Director, Deputy Chief Credit Officer and an Associate General Counsel, reviews and approves AI solutions of the bank or its vendors, defines acceptable use and provides for monitoring and reporting. | In production |
| NBT | Responsible-use approach: AI paired with training and oversight to streamline recurring work, improve data quality and reinforce governance and controls. | Announced |
| FirstSun | AI as competitive risk: The 10-K says failing to keep pace with AI-enabled analytics and customer offerings could weaken its competitive position. | Announced |
| First Financial Bankshares | AI adoption risk (10-K): The 10-K flags the risk of adopting, or failing to adopt, technology such as AI; no AI system in use is named. | Announced |
| ConnectOne | Ban on non-approved generative AI: Policies and governance structures prohibit employees from using non-approved generative AI applications or websites on the bank's network or devices. | In production |
| Bread Financial | AI review of all customer calls: Andretta said AI lets Bread review all customer calls for complaint trends, which it can show regulators, and feed those trends into rep training. | In production |
| BancFirst | AI expected to grow, not yet material: The 10-K says AI use is not material at this time and is expected to grow; it names the risk categories BancFirst expects to manage but no tool or process. | Announced |
| Hilltop | AI deployed 'where practical': Management says AI deployment, technology and data-platform investment are a key focus and sit inside 2026 expense guidance; no use case is named. | Announced |
| Park National | AI as a tool under human judgment: The chairman's shareholder letter frames AI as a tool whose value depends on the person wielding it; it sets out no policy or governance structure. | Announced |
| National Bank Holdings | AI as an investment and competitive factor: Filings list the ability to invest in or leverage new technologies such as AI, and the success of the digital growth strategy, among factors that affect results. | Announced |
| The Bancorp | Automation and AI in the Apex 2030 operating model: The September 2026 restructuring says the bank is refining workflows and expanding automation and AI while cutting costs. | Rolling out |
Is there a single AI governance rule for banks?
No. In the US, AI governance is assembled from model-risk guidance (SR 26-2 and its OCC and FDIC twins), third-party guidance (SR 23-4), consumer law on automated decisions (ECOA, FCRA), state laws (Colorado, California, New York) and voluntary frameworks (NIST, Treasury). The EU AI Act is the closest thing to a single rule, and it applies to banks mainly through high-risk credit scoring from December 2, 2027.
Does model risk management cover generative AI?
Not in the US since April 17, 2026. SR 26-2 states that generative and agentic AI models are outside its scope and directs banks to broader risk-management and governance practices; the agencies have promised a request for information. In the UK the PRA's SS1/23 keeps AI and machine learning inside model risk management.
What does an examiner ask to see?
An inventory of AI systems with owners and risk tiers, the approval and validation record for each material one, the data lineage behind it, the vendor due diligence where it is bought, the monitoring and the route to a human, and evidence that the board has been told what is running and why. The pillars above map each of those to the document that asks for it.
How many of the largest US banks have disclosed AI governance arrangements?
The bank pages on this site record governance-related AI activity at most of the 100 largest US banks, from named AI committees and chief AI officers to model-data 'nutrition labels'; the section below lists them with the source for each.
When a regulator changes what governance means, you'll read it the next morning.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning