AI governance in a bank is not one rule but eight obligations assembled from different places: an AI council that approves use cases, an inventory of what is running, risk tiers, independent validation for models in scope, monitoring in production, a person who can explain and override any decision that touches a customer, governance of the vendors and frontier labs behind the models, and a route from an incident to the board. The US model framework (SR 26-2, in force since April 2026) requires the model elements and carves generative and agentic AI out to broader governance; the UK's SS1/23 keeps AI inside model risk; SR 23-4 and the Basel principles own the vendors; ECOA, the EU AI Act and Colorado own human oversight; NIST, Treasury and the FSB fill the gaps. On the record of this site, 130 of 141 banks disclose a governance arrangement: Goldman Sachs's Firmwide AI Risk Committee co-chaired by the CIO and the chief risk officer, Bank of America's review of every AI project against 16 risk pillars, BNP Paribas's Group AI Committee and AI Risk Committee, ING's AI Risk Committee that vetted 140 use cases, DBS's PURE test and model registry, KeyBank's AI Policy approved by its ERM Committee with an inventory across three lines of defence. 81 named leaders hold a chief AI, head of AI or data-and-AI role. The tables below map each element to the documents that require it and the banks that disclose it; every row links to its source.
DATA AS OF NOV 3, 2026 · 141 banks · 267 documents · 67 vendors · 5,020 sources
What is AI governance in banking?
The structures a bank uses to decide which AI it runs, under what controls and with whom accountable: a committee that approves use cases, an inventory with risk tiers, validation and monitoring for models, data and prompt controls, vendor governance, human oversight and board reporting. It is assembled from model-risk guidance, third-party guidance, consumer law and voluntary frameworks rather than from one AI rule. 130 of the 141 banks profiled here disclose a governance arrangement for AI; 111 of the 120 US banks do.
The phrase covers two things that banks and regulators both run together. The first is the governance of models, which is twenty years old: a model is inventoried, validated by people who did not build it, monitored, and owned by someone the examiner can name. The second is the governance of everything AI that is not a model under that definition, which is three years old and became a distinct discipline in April 2026 when SR 26-2 replaced SR 11-7 and said in terms that generative and agentic AI fall outside formal model risk management and under “broader risk-management and governance practices”. What those practices are is the question this page answers: the NIST AI RMF is the framework most US banks cite, Treasury's financial-services profile adapts it, the PRA's SS1/23 is the UK's answer (keep AI inside model risk, with AI-specific tiering factors), and the FSB's 2026 consultation is the attempt to make the sector's answer consistent.
Two pages on this site take single elements further: model risk management for the validation discipline, and the agentic-banking control plane for what governance has to add when the AI acts rather than advises (identity for agents, limits, kill switches, audit trails). The risks of AI in banking page is the same material seen from the risk side: ten risks, the documents that name each and the controls banks disclose.
What does an AI governance framework for a bank contain?
Eight elements. An AI council or committee (55 banks disclose one), an inventory and use-case register (13), risk tiering (18), independent validation (19), ongoing monitoring (35), human oversight and explainability (9), third-party governance (80) and incident and board reporting (75). Each maps to the documents that require it: SR 26-2 and SS1/23 for the model elements, SR 23-4 and the Basel principles for vendors, ECOA, the EU AI Act and Colorado's ADMT Act for oversight, DORA and NY DFS for incidents, NIST and Treasury for the rest.
Eight elements, in the order an examiner would walk through them. The document column lists the texts that require or describe each; the bank column is computed from the profiles and counts the banks whose records describe the element in place or rolling out, naming the five largest. A bank absent from a row has not disclosed the element, which is not the same as not having it; disclosure runs with size, and the 10-K risk-factor sections of the largest banks are the fullest accounts.
| Element | What it is | Documents requiring it | Banks disclosing it |
|---|---|---|---|
| AI council or committee | A named body that approves AI use cases against a risk assessment and reports to the board. | SR 26-2 · PRA SS1/23 · FSB AI sound practices (final report, Oct 2026) · Machado speech: 'Technology is neutral, governance is not' (Feb 2026) | 55: KeyBank, Ally, Northern Trust, Synchrony, Flagstar and 50 more |
| AI inventory and use-case register | A live list of every AI system and use case, with an owner, a purpose and a status. | SR 26-2 · OCC Bulletin 2026-13 · MAS Guidelines on Artificial Intelligence Risk Management · NIST AI RMF 1.0 | 13: JPMorgan, Schwab, BNY, KeyBank, Old National and 8 more |
| Risk tiering and materiality | Each system rated by what is riding on it, so that validation, monitoring and approval scale with risk. | SR 26-2 · PRA SS1/23 · Regulation (EU) 2024/1689 · MAS Guidelines on Artificial Intelligence Risk Management | 18: BofA, State Street, Huntington, Ally, Northern Trust and 13 more |
| Independent validation | Models in scope tested by people who did not build them before use and after material change. | SR 26-2 · OCC Bulletin 2026-13 · PRA SS1/23 · ECB Guide to internal models (July 2025, ML section) | 19: Schwab, BNY, BMO, M&T, Amex and 14 more |
| Ongoing monitoring and evaluation | Performance, drift, fairness and output quality watched in production, with thresholds that trigger review. See continuous compliance monitoring: what compliance officers say. | SR 26-2 · NIST AI 600-1 (Generative AI Profile) · Treasury FS AI RMF and AI Lexicon (Feb 2026) · Regulation (EU) 2024/1689 | 35: U.S. Bank, Truist, TD, Fifth Third, BMO and 30 more |
| Human oversight and explainability | A person who can explain and override any decision that touches a customer, and reasons that can be given. | ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) · Regulation (EU) 2024/1689 · SB 26-189 · CFPB Chatbots in Consumer Finance (issue spotlight, 2023) | 9: TD, BMO, CIBC, SoFi, First Financial Bank and 4 more |
| Third-party and model-provider governance | Due diligence, contracts, monitoring and exit plans for bought models, platforms and cloud, including the frontier labs. | SR 23-4 · OCC Bulletin 2023-17 · BCBS Third-Party Risk Principles (Dec 2025) · DORA (Regulation (EU) 2022/2554) | 80: Goldman, U.S. Bank, Truist, BNY, Morgan Stanley and 75 more |
| Incident reporting and board reporting | A route from an AI failure to the risk function and the board, and regular reporting on what is running. | DORA (Regulation (EU) 2022/2554) · 23 NYCRR Part 500 · ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) · FSB AI sound practices (final report, Oct 2026) | 75: Morgan Stanley, Citizens, M&T, Ally, Northern Trust and 70 more |
The committee is the element banks disclose most and the inventory the one examiners ask for first, because the inventory is what makes the rest auditable. The records that describe one in detail are worth reading: KeyBank (AI systems inventoried, risk-assessed and monitored across three lines of defence under an AI Policy the ERM Committee approves), Old National (an AI Center of Excellence that keeps a live inventory and sets acceptable use), DBS (a risk-based model governance process and registry behind more than 2,000 models across more than 430 use cases), Columbia (ServiceNow's AI Control Tower as the register), JPMorgan (a firm-wide portfolio of almost 1,000 use cases, about 50 of them “really important”). Tiering is where the large banks differ most: Bank of America scores every project against 16 pillars including privacy, bias, workforce impact and intellectual property; Customers Bank scores uses on value, cost, time to develop and risk; Valley runs five access tiers with monthly spend tracking.
Which documents require each element?
14 documents between them: SR 26-2 and OCC 2026-13 (the US model framework since April 2026, with SR 11-7 as the superseded original), PRA SS1/23 (the UK equivalent, which keeps AI inside model risk), SR 23-4 (vendors), the EU AI Act and the Digital Omnibus that deferred its high-risk duties to December 2027, NIST AI RMF 1.0 and its generative-AI profile, Treasury's financial-services adaptation, the FSB's 2026 sound-practices consultation, MAS's 2026 guidelines that cover AI agents, BCBS 239 for data and DORA for resilience and incidents.
The six pillars below group the same documents by the obligation they create, with the requirement in a sentence and the date it binds. Each row is a tracked document; the 267-document tracker holds the rest, and the governance use-case page lists every document tagged to governance across 45 authorities.
Board accountability and the inventory: Who has to own AI in a bank?
Every supervisor that has spoken puts AI under the board and senior management, through the same governance architecture that already covers models and technology: named accountability, an inventory of what is running, policies for how it is approved, and effective challenge from risk, compliance and internal audit. US model-risk guidance revised in April 2026 keeps that structure for predictive models and leaves generative and agentic AI to broader enterprise governance; the UK's SS1/23 names a senior manager; the ECB's supervisors have said accountability for AI decisions must be clear and oversight must match AI's strategic weight.
| Rule | What it requires | When |
|---|---|---|
| SR 26-2 / OCC Bulletin 2026-13 / FDIC FIL-15-2026 | Board and senior-management governance, a model inventory and independent validation for models in scope; generative and agentic AI are outside scope and left to broader risk-management and governance practices. | In force from Apr 17, 2026 |
| PRA SS1/23 | Five model-risk principles for all models informing business decisions regardless of technology, AI-relevant tiering factors (unstructured data, explainability, bias), and a named Senior Management Function holder accountable for the framework. | In force from May 17, 2024 |
| ECB: 'Technology is neutral, governance is not' | Clear accountability for AI decisions, senior-management oversight matching AI's strategic importance, and effective challenge from risk, compliance and internal audit. | Stated Feb 24, 2026 |
| FSB sound practices 1–4 (final report) | Strategic direction and oversight, governance and accountability, AI inside the risk-management framework, organisational adaptability. | Finalised Oct 15, 2026 |
| NCUA Letter 26-CU-01 | Credit-union supervisory expectations for AI governance, risk assessment and vendor oversight. | In force |
Model risk and validation: Which AI systems count as models, and what validation do they need?
In the US, a machine-learning system that processes input data into quantitative estimates is a model and needs documented development, independent validation, ongoing monitoring and outcomes analysis scaled to its materiality. The 2026 revision narrowed the definition so that simple arithmetic and deterministic rules fall out, and it explicitly excludes generative and agentic AI from model risk management while promising an interagency request for information. Outside the US the perimeter is wider: the PRA keeps AI and machine learning inside model risk management, and the ECB's internal-models guide tests machine-learning capital models for explainability and justified complexity.
| Rule | What it requires | When |
|---|---|---|
| SR 26-2 (Fed) | Risk-based, materiality-driven validation and monitoring; 'complex quantitative method' definition; generative and agentic AI out of scope. | In force from Apr 17, 2026 |
| SR 11-7 (the 2011 framework) | The validation disciplines that carry over: conceptual soundness, ongoing monitoring, outcomes analysis, effective challenge. | Superseded Apr 17, 2026 |
| ECB Guide to internal models, ML section | Machine-learning capital models must be adequately explainable and their complexity justified by performance. | In force from Jul 28, 2025 |
| EBA follow-up report on ML for IRB models | Principle-based recommendations on understanding, documentation, validation and stability of machine-learning capital models. | Published Aug 4, 2023 |
| OCC Bulletin 2023-17 / SR 23-4 (third-party models) | Vendor models are the bank's to understand and validate, with due diligence and monitoring through the relationship's life. | In force |
Data governance: What do regulators expect of the data behind AI models?
Owned, traceable, complete and current: the BCBS 239 vocabulary that examiners use for risk data applies to training sets, feature stores and retrieval corpora, and the Basel Committee's January 2026 newsletter said AI makes robust data management more important, not less. The EU AI Act turns data governance into a legal duty for high-risk systems such as consumer credit scoring, with provenance, preparation, bias examination and gap analysis to be documented, from December 2, 2027 after the Digital Omnibus deferral.
| Rule | What it requires | When |
|---|---|---|
| BCBS 239 | Fourteen principles for risk-data governance, aggregation and reporting: ownership, architecture, accuracy and lineage, completeness, timeliness, adaptability. | G-SIBs from 2016 |
| BCBS 239 implementation newsletter | AI and advanced automation depend on high-quality data; lineage and ad hoc reporting still 'a work in progress'. | Published Jan 6, 2026 |
| EU AI Act, Article 10 | Documented data governance for training, validation and testing data of high-risk systems, including credit scoring of natural persons. | Stand-alone Annex III systems from Dec 2, 2027 |
| Treasury AI cybersecurity report | Identified a 'fraud data divide' and proposed data 'nutrition labels' for vendor AI; became the AIEOG workplan. | Published Mar 27, 2024 |
Third-party and concentration risk: How is a bank's reliance on external AI models and cloud providers supervised?
Through third-party risk management rather than a separate AI rule. The 2023 US interagency guidance covers the full lifecycle from due diligence to termination and expects validation of purchased models; the Basel Committee's December 2025 principles reach nth-party supply chains and concentration; and the FSB has singled out generative AI's dependence on a small number of hardware, cloud and model suppliers as a financial-stability vulnerability to monitor.
| Rule | What it requires | When |
|---|---|---|
| SR 23-4 / OCC 2023-17 / FDIC FIL-29-2023 | Planning, due diligence, contracting, ongoing monitoring and termination for every third-party relationship, including AI tools and foundation-model access. | In force from Jun 7, 2023 |
| BCBS Third-Party Risk Principles | Twelve principles covering board accountability, due diligence, contracts, monitoring, continuity and exit, including nth-party chains and concentration. | Published Dec 10, 2025 |
| FSB AI monitoring report | Third-party dependencies and provider concentration named as vulnerabilities for authorities to track. | Published Oct 10, 2025 |
| FSB third-party risk toolkit | Toolkit for managing third-party and outsourcing risk, including critical service providers. | Published Dec 4, 2023 |
Human oversight and the customer's rights: When must a person be able to explain or override an AI decision?
Whenever the decision touches a consumer's credit: US adverse-action law requires the specific principal reasons for a denial regardless of how complex the model is, the EU AI Act requires human oversight and a fundamental-rights impact assessment for high-risk credit scoring, and Colorado's Automated Decision-Making Technology Act adds notice, a plain-language explanation after an adverse outcome and human review from January 1, 2027, with a lender's ECOA notice satisfying the disclosure duty for the same decision.
| Rule | What it requires | When |
|---|---|---|
| ECOA / Regulation B adverse action | Specific principal reasons for adverse credit action; model opacity is not a defence. | In force |
| FCRA adverse action and key factors | Key factors that adversely affected a credit score must be disclosed. | In force |
| EU AI Act, Articles 14 and 26–27 | Human oversight, deployer duties and a fundamental-rights impact assessment for high-risk credit scoring. | Stand-alone Annex III systems from Dec 2, 2027 |
| Colorado SB 26-189 (ADMT Act) | Consumer notice, a plain-language explanation within 30 days of an adverse outcome, data access and correction, human review. | Effective Jan 1, 2027 |
| CPPA ADMT regulations (California) | Notice, opt-out and access rights for automated decision-making technology in significant decisions, plus risk assessments. | In force |
Voluntary frameworks that fill the gaps: What do banks use to govern generative and agentic AI where the rules stop?
The NIST AI Risk Management Framework and its generative-AI profile, Treasury's financial-services adaptation of it, and, for cyber, the New York and ECB letters on AI-enabled threats. None is binding on banks, but together they are what most US institutions cite for the systems that model-risk guidance now leaves out, and what examiners ask about when a bank's AI policy is on the table.
| Rule | What it requires | When |
|---|---|---|
| NIST AI RMF 1.0 | Govern, Map, Measure, Manage and seven trustworthiness characteristics. | Voluntary |
| NIST AI 600-1 (Generative AI Profile) | Twelve generative-AI risks and more than 200 suggested actions mapped to the framework. | Voluntary |
| Treasury FS AI RMF and AI Lexicon | The NIST framework adapted to financial services' operational, regulatory and consumer-protection specifics, with a shared vocabulary. | Published Feb 19, 2026, non-binding |
| DFS AI cybersecurity letter | AI-enabled social engineering, AI-enhanced attacks, data exposure and vendor dependency mapped to 23 NYCRR Part 500 obligations. | In force |
| ECB 'Dear CEO' letter SSM-2026-0301 | Every significant institution to assess AI-enabled cyber threats and submit an action plan to its supervisory team. | Plans due Oct 31, 2026 |
The fourteen documents a bank's AI governance programme is most often examined against, with the obligation in one line. The guides explain the main ones at length: SR 11-7 and what SR 26-2 changed, PRA SS1/23, the NIST AI RMF, DORA and BCBS 239.
| Document | Authority | Region | Date | Status | What it asks of a bank |
|---|---|---|---|---|---|
| SR 26-2 | Federal Reserve | US | Apr 17, 2026 | In force | Board and senior-management governance, a model inventory, independent validation and monitoring under a risk-based, materiality-driven framework; generative and agentic AI are outside scope and fall under broader risk governance. |
| OCC Bulletin 2026-13 | OCC | US | Apr 17, 2026 | In force | On April 17, 2026 the OCC, Federal Reserve, and FDIC issued revised interagency Model Risk Management guidance (OCC Bulletin 2026-13; Fed SR 26-2; FDIC FIL-15-2026), replacing the 2011 framework that had governed bank models for 15 years. |
| SR 11-7 | Federal Reserve | US | Apr 4, 2011 | Superseded | The 2011 framework that made model governance an examinable discipline: conceptual soundness, ongoing monitoring, outcomes analysis and effective challenge. Superseded in April 2026 but still the vocabulary examiners use. |
| PRA SS1/23 | UK (BoE / PRA / FCA) | UK | May 17, 2023 | In force | Five principles (identification and tiering, governance, development and use, independent validation, mitigants) for every model including AI and vendor models, with a named senior manager accountable. |
| SR 23-4 | Federal Reserve | US | Jun 7, 2023 | In force | SR 23-4, issued June 7, 2023 by the Federal Reserve, OCC, and FDIC, is the interagency guidance on managing risk from third-party relationships and is the framework examiners use when a bank buys AI tools, cloud-hosted models, or foundation-model access from vendors. |
| Regulation (EU) 2024/1689 | EU AI Act | EU | Jul 12, 2024 | In force | Risk management, data governance, human oversight, logging and conformity assessment for high-risk systems, which in banking means credit scoring of natural persons. |
| Regulation (EU) 2026/1744 (Digital Omnibus on AI) | EU AI Act | EU | Jul 24, 2026 | In force | Defers the stand-alone Annex III high-risk obligations to 2 December 2027, which is the date an EU bank's consumer credit-scoring AI must be fully compliant. |
| NIST AI RMF 1.0 | NIST | US | Jan 26, 2023 | In force | Govern, Map, Measure, Manage: the voluntary framework most US banks cite for the AI that model-risk guidance now leaves out. |
| NIST AI 600-1 (Generative AI Profile) | NIST | US | Jul 26, 2024 | In force | NIST AI 600-1, the Generative AI Profile of the AI RMF, was published on July 26, 2024 as a companion to AI RMF 1.0. |
| Treasury FS AI RMF and AI Lexicon (Feb 2026) | U.S. Treasury | US | Feb 19, 2026 | Final | The NIST framework adapted to financial services, with a shared lexicon; non-binding, built with the sector. |
| FSB AI sound practices (final report, Oct 2026) | FSB | Global | Oct 15, 2026 | Final | On 15 October 2026 the FSB published its final report finalising 12 sound practices for responsible AI adoption by financial institutions, closing out the June 2026 consultation. |
| MAS Guidelines on Artificial Intelligence Risk Management | MAS | APAC | Oct 7, 2026 | Final | MAS issued final Guidelines on Artificial Intelligence Risk Management on October 7, 2026, closing the loop on Consultation Paper P017-2025 of November 13, 2025. |
| BCBS 239 | Basel Committee | Global | Jan 9, 2013 | In force | BCBS 239, published by the Basel Committee on 9 January 2013, sets 14 principles for how banks govern, aggregate, and report risk data, covering governance and IT infrastructure, data accuracy, completeness, timeliness and adaptability, and supervisory review. |
| DORA (Regulation (EU) 2022/2554) | European Union | EU | Dec 27, 2022 | In force | Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), was adopted on 14 December 2022, published in the Official Journal on 27 December 2022 and has applied since 17 January 2025 (Article 64). |
Who owns AI governance at banks?
81 named AI leaders across 48 banks on this site hold a chief AI officer, head of AI or combined data-and-AI role. The pattern: a chief AI officer or head of AI in the first line (U.S. Bank, Synchrony, Raymond James, HSBC, UBS, BMO, Citi, Wells Fargo, Goldman Sachs), a chief data and AI officer where the two are combined (JPMorgan, Truist, BNY, State Street, CIBC, Santander), an AI risk head in the second line (M&T) and a board risk or technology committee above both.
The table lists every named leader on this site whose role is chief AI officer, head of AI, or a combined data-and-AI or analytics-and-AI role, with the bank and the source. The titles tell the structure: a chief AI officer reporting to the COO or CEO means AI is run as a business programme (U.S. Bank, Synchrony, UBS, where the chief AI office sits under the group COO); a chief data and AI officer means the bank has fused the two (JPMorgan, where the CTO is taking on the chief data and analytics role; Truist; BNY); a head of AI risk in independent risk management (M&T) is the second-line counterpart that the three-lines model requires and that few banks name.
| Bank | Name | Role | Source |
|---|---|---|---|
| JPMorgan | Sumitra Ganesh | Head of AI Research (since February 2026) | Business Insider (Yahoo Finance), Jul 27, 2026 ↗ |
| Citi | David Griffiths | Group Head of AI (previously Chief Technology Officer) | Citigroup, Sep 22, 2026 ↗ +1 |
| Citi | Niamh O'Sullivan | Head of AI Strategy, in Griffiths' groupwide AI organization (previously led technology strategy in the chief technology office) | American Banker, Oct 19, 2026 ↗ |
| Citi | Naveed Anwar | Global Head of AI, Digital and Data Platforms, Citi Services | Banking Dive, Oct 23, 2026 ↗ |
| Citi | Shobhit Varshney | Former Global Head of AI (joined from IBM September 2025; left April 2026) | CIO Dive, Sep 11, 2025 ↗ +2 |
| Wells Fargo | Saul Van Beurden | Head of AI (to focus exclusively on AI across the bank, announced 22 October 2026; was also co-CEO, Consumer Banking and Lending) | Wells Fargo via FT Markets, Nov 20, 2025 ↗ +2 |
| Wells Fargo | Cayetano Gea-Carrasco | Head of AI and Data, Consumer Banking and Lending (announced 15 October 2026; from BBVA, where he led enterprise AI transformation and the global data and analytics organization); reports to Van Beurden | Wells Fargo (Business Wire via Yahoo Finance), Oct 15, 2026 ↗ |
| Wells Fargo | Faraz Shafiq | Head of AI Products and Solutions (from AWS); reports to Van Beurden | Wells Fargo (Business Wire via Yahoo Finance), Jan 26, 2026 ↗ +2 |
| Wells Fargo | Andre Mansour | Head of AI, Wealth & Investment Management (from Google); reports to Evelyn Varner | WealthManagement.com, May 27, 2026 ↗ +1 |
| Goldman | Daniel Marcu | Partner; Global Head of AI Engineering and Science (joined March 2025 from Amazon's AGI organisation) | Goldman Sachs, Mar 17, 2025 ↗ +1 |
| Goldman | Archana Vemulapalli | Partner; Global Head of AI Product Management and Strategic Relations (leads engagement with frontier AI labs) | Goldman Sachs, Apr 6, 2026 ↗ |
| Morgan Stanley | Shailesh Gavankar | Head of AI Strategy and Execution (promoted to managing director, 2026) | eFinancialCareers, Jan 11, 2026 ↗ |
| U.S. Bank | Prashant Mehrotra | EVP and Chief AI Officer | American Banker, Sep 2, 2026 ↗ +2 |
| Capital One | Milind Naphade | SVP, Technology, and Head of AI Foundations | VentureBeat, Jul 2, 2025 ↗ +1 |
| Truist | Pascal Belaud | Chief AI & Data Officer | Truist, Nov 19, 2025 ↗ +1 |
| Truist | Tom Mazzaferro | EVP, Chief Data, AI and Analytics Officer (from October 2023; title as of June 2025, before the chief AI and data officer role was created) | American Banker, Apr 15, 2025 ↗ +1 |
| Schwab | Alison Dooher | Head of AI, Schwab Advisor Services | Charles Schwab, Sep 14, 2026 ↗ +1 |
| BNY | Sarthak Pattanaik | Chief Data and AI Officer; led the 2023 consolidation of AI work into the AI Hub and the Eliza platform | Banking Dive, Dec 9, 2025 ↗ +4 |
| State Street | Manoj Bohra | EVP, Chief Data and AI Officer | State Street, Sep 24, 2026 ↗ +1 |
| TD | Maksims Volkovs | SVP and Chief AI Scientist, Layer 6 | American Banker, Jun 1, 2026 ↗ +1 |
| TD | Luke Gee | Chief Analytics & AI Officer, TD Bank Group (as of October 2025) | TD Bank Group, Oct 28, 2025 ↗ |
| BMO | Kristin Milchanowski | Chief AI & Quantum Officer; Founding Director, BMO Institute for Applied AI & Quantum | BMO, Apr 9, 2026 ↗ +1 |
| First Citizens | Ash Kaduskar | Head of AI and Advanced Analytics | First Citizens Bank, Sep 3, 2026 ↗ +1 |
| M&T | Rhea Rajwani | Head of AI Risk Oversight, Independent Risk Management (styled head of AI and emerging banking solutions risk in October 2026) | American Banker, Jul 23, 2026 ↗ +1 |
| M&T | Kalyana Bedhu | Head of AI Engineering (from August 2026) | PYMNTS, Aug 12, 2026 ↗ |
| HSBC | David Rice | Group Chief AI Officer (from 1 April 2026) | Banking Dive, Mar 25, 2026 ↗ |
| Pinnacle | Kevin Johnson | Head of AI | American Banker, Apr 21, 2026 ↗ |
| UBS | Daniele Magazzeni | Group Chief AI Officer (from 1 January 2026, ex-JPMorgan) | UBS, Oct 16, 2025 ↗ +1 |
| UBS | Richard James | Head of AI Product (describes advisor agents) | Reuters via Investing.com, Jul 13, 2026 ↗ |
| UBS | Beatriz Martin | Group Chief Operating Officer from 1 January 2026; Group Technology and the Chief AI Office sit under her | UBS, Dec 15, 2025 ↗ |
| UBS | Lila Tretikov | Board director since April 2025; Partner and head of AI strategy at New Enterprise Associates, formerly Deputy CTO of Microsoft | UBS Group (SEC filings), Mar 9, 2026 ↗ |
| UBS | Jonas Isliker | Head of AI, Data & Analytics, Global Wealth Management (as quoted in Microsoft's customer story; role to be rechecked) | Microsoft Customer Stories, Dec 31, 2024 ↗ |
| Santander | Iñaki Bernal | Chief AI Officer, Grupo Santander (a group role; Santander US has no named chief AI officer of its own) | Banco Santander, Jun 30, 2026 ↗ |
| Santander | Ricardo Martín Manjón | Chief Data & AI Officer, Banco Santander (group) | Banco Santander, Jun 3, 2026 ↗ +2 |
| City National | Bobby Grubert | Head of AI and Digital Innovation, RBC Capital Markets (Aiden platform) | FinAi News via ABA, May 4, 2026 ↗ +1 |
| Flagstar | Robert Martin | SVP, Distinguished Engineer, Head of AI and Engineering (from March 2026; formerly Director of Technology Strategy and Incubation at MUFG, where he established AI risk governance frameworks); leads incubation in the Chief Technology Office, identity and access management, and cloud, SRE and platform accountabilities | Flagstar Bank, Mar 16, 2026 ↗ |
| Webster | Ricardo Martín Manjón | Chief Data & AI Officer, Banco Santander (as of August 2025); owns the group AI strategy that now applies to Webster | Banco Santander, Aug 12, 2025 ↗ |
| First Horizon | Tyler Craft | SVP, Head of Investor Relations; member of the AI working group; earlier head of AI, when he rolled out ChatFHN, per the CFO (earlier SVP and Director of Transformation, Fintech & Emerging Tech) | First Horizon, May 11, 2026 ↗ +2 |
| CIBC | Prasanna Gopalakrishnan | Director from 1 September 2026; former Global Chief Product and AI Officer at ADP and retail-bank CIO at Bank of America | CIBC via PR Newswire (Yahoo Finance), Aug 20, 2026 ↗ |
| Valley | Nickolaus Lachman | SVP, Head of AI and Data Science | American Banker, Apr 15, 2026 ↗ |
| Barclays US | Gaurav Mittal | Head of AI/ML Engineering, Barclays markets division (as of May 2025) | eFinancialCareers, May 19, 2025 ↗ |
| Raymond James | Stuart Feld | Chief AI Officer | GlobeNewswire via FT Markets, Sep 8, 2025 ↗ +3 |
| Raymond James | David Solganik | Head of AI Strategy | GlobeNewswire via FT Markets, Sep 8, 2025 ↗ |
| Deutsche Bank | Dara Sosulski | Head of AI for Corporate Bank and Investment Bank operations and controls (hired from HSBC, July 2026) | Finextra, Jul 23, 2026 ↗ |
| Eastern Bank | Joseph Chung | Director (innovation and technology expertise; CTO and Head of AI at Rippl Care until November 2025) | Eastern Bankshares (SEC filings), Mar 26, 2026 ↗ |
| Synchrony | Nimrod Barak | Chief AI Officer (effective 30 June 2026; previously Managing Director, Head of AI Center of Excellence and Emerging Technologies at Citi) | Synchrony, Aug 13, 2026 ↗ |
| USAA | Ramnik Bajaj | Senior Vice President, Chief Data, Analytics and AI Officer (leads USAA's AI council; joined 2021 from Wells Fargo) | SiliconANGLE, May 27, 2025 ↗ +5 |
| HSBC | David Rice | Group Chief AI Officer (from 1 April 2026; previously Chief Operating Officer, Corporate and Institutional Banking); board member of Promenaut; with HSBC for nearly two decades across the US, Canada, Singapore, Hong Kong and the UK | HSBC Holdings plc, Mar 23, 2026 ↗ +2 |
| HSBC | Dara Sosulski | Head of AI and Model Management | Computer Weekly, Oct 5, 2026 ↗ |
| Barclays | Anita Tanna | Chief AI Officer (new role, reported 23 October 2026; she says on LinkedIn she is Barclays' first; previously head of equity sales and high touch sales and, from January 2024, chief of staff to the Group Chief Executive) | eFinancialCareers, Oct 23, 2026 ↗ +1 |
| Barclays | Gaurav Mittal | Head of AI/ML Engineering for the markets division (as reported in May 2025) | eFinancialCareers, May 19, 2025 ↗ |
| BNP Paribas | Charles Holive | Chief AI Officer, Corporate & Institutional Banking (named January 2026; formerly managing director at JPMorgan Chase and SVP of AI solutions and platforms at PepsiCo) | Banking Dive, Jan 28, 2026 ↗ +1 |
| Santander | Ricardo Martín Manjón | Group Chief Data & AI Officer (the board appointed the role in 2025, reporting to the Executive Chair) | Banco Santander, Aug 12, 2025 ↗ +2 |
| Santander | Iñaki Bernal | Chief AI Officer, Grupo Santander | Banco Santander, Jun 30, 2026 ↗ |
| UBS | Richard James | Head of AI Product | Reuters via Investing.com, Jul 13, 2026 ↗ |
| UBS | Michel Neuhaus | Head of AI, Data & Analytics, Personal & Corporate Banking (as quoted in Microsoft's customer story, December 2024; current role to be rechecked) | Microsoft Customer Stories, Dec 31, 2024 ↗ |
| UBS | Jonas Isliker | Head of AI, Data & Analytics, Global Wealth Management (as quoted in Microsoft's customer story, December 2024; current role to be rechecked) | Microsoft Customer Stories, Dec 31, 2024 ↗ |
| Deutsche Bank | Dara Sosulski | Head of AI, Corporate Bank and Investment Bank operations and controls division | Finextra, Jul 23, 2026 ↗ |
| DBS | Sameer Gupta | Former Managing Director and Chief Analytics Officer (left 2026 to join Lloyds Banking Group as chief data and AI officer) | Banking Dive, Apr 20, 2026 ↗ |
| RBC | Bobby Grubert | Head of AI and Digital Innovation, RBC Capital Markets (since May 2025; team of over 20, reports to Lindsay Patrick) | American Banker, Mar 19, 2026 ↗ +3 |
| TD Bank Group | Luke Gee | Chief Analytics and AI Officer (title in TD releases to May 2026; Head of AI and Analytics in May 2024) | TD Bank Group, May 21, 2026 ↗ +2 |
| TD Bank Group | Maksims Volkovs | SVP and Chief AI Scientist; co-founder, Layer 6 | American Banker, Jun 1, 2026 ↗ +1 |
| TD Bank Group | Sumee Seetharaman | Head of AI and ML Practice; quoted on the Responsible AI Principles (July 2026); full title Head of Artificial Intelligence and Machine Learning Practice | TD Bank Group, Jul 30, 2026 ↗ |
| Commonwealth Bank | Ranil Boteju | Chief AI Officer (previously Group Chief Data and Analytics Officer, Lloyds Banking Group) | Commonwealth Bank of Australia, Nov 26, 2025 ↗ +3 |
| Commonwealth Bank | Mary-Anne Williams | Chief AI Scientist (first in the role; started 15 June 2026) | Commonwealth Bank of Australia, May 18, 2026 ↗ |
| Lloyds | Ron van Kemenade | Group Chief Operating Officer (Chief Data and AI Officer reports to him) | Lloyds Banking Group, Apr 16, 2026 ↗ +2 |
| Lloyds | Sameer Gupta | Chief Data and AI Officer (joined June 2026 from DBS, where he was Chief Analytics Officer) | Lloyds Banking Group, Apr 16, 2026 ↗ |
| Lloyds | Rohit Dhawan | Director and Group Head of AI & Advanced Analytics; AI Champion for financial services at HM Treasury | HM Treasury (GOV.UK), Jan 20, 2026 ↗ +1 |
| Lloyds | Ranil Boteju | Former Group Chief Data and Analytics Officer (joined 2021, led a team of more than 2,000; announced 26 November 2025 as Commonwealth Bank of Australia chief AI officer from early 2026) | Commonwealth Bank of Australia, Nov 26, 2025 ↗ +1 |
| NatWest | Dr Maja Pantic | Chief AI Research Officer (first holder, appointed June 2025); formerly Professor at Imperial College London, Samsung AI Research Centre Cambridge and Meta London | NatWest Group, Jun 11, 2025 ↗ +1 |
| BBVA | Antonio Bravo | Global Head of AI Transformation (from 28 May 2026); Global Head of Data from 29 January 2025 | BBVA, May 28, 2026 ↗ +3 |
| BBVA | Elena Alfaro | Global Head of AI Adoption | BBVA, May 12, 2025 ↗ +1 |
| Standard Chartered | Mohamed Keraine | Global Head of Digital-WRB and Enterprise Co-Head of AI | Standard Chartered PLC, Oct 5, 2026 ↗ |
| Standard Chartered | Geoff Kot | Global Head of CIB Business Platforms & Partnerships and Enterprise Co-Head of AI | Standard Chartered PLC, Oct 5, 2026 ↗ |
| Standard Chartered | David Hardoon | Former Global Head of AI Enablement (appointed April 2025, left earlier in 2026; joined Accenture) | Standard Chartered PLC, Apr 7, 2025 ↗ +2 |
| Scotiabank | Luke Gee | Executive Vice-President and Chief Data and AI Officer | Financial Post (via Yahoo Finance), Oct 21, 2026 ↗ |
| Scotiabank | Jasmine de Gaia | Senior Vice-President and Chief AI Officer (newly created role, hired from Wells Fargo, effective Jan. 4) | Financial Post (via Yahoo Finance), Oct 21, 2026 ↗ |
| BMO Financial Group | Kristin Milchanowski | Chief AI & Quantum Officer; Founding Director, BMO Institute for Applied AI & Quantum | BMO Financial Group, Apr 9, 2026 ↗ +2 |
| BMO Financial Group | Lovell Hodge | Head of AI, BMO Wealth (describes purpose-built, continuously learning digital workers for wealth advice) | BMO AI Hub, Sep 29, 2026 ↗ |
| Société Générale | Agnès Lévy-Soussan | Chief Data and AI Officer for the SG French Retail Banking Network | Societe Generale, Jul 28, 2025 ↗ |
| Société Générale | Noémie Ellezam | Group Head of AI (as named on Société Générale's October 2024 page) | Societe Generale, Oct 10, 2024 ↗ |
Which banks have disclosed AI governance arrangements?
130 banks, 107 with arrangements in place: from Goldman Sachs's Firmwide AI Risk Committee, Bank of America's 16-pillar project review and Citi's board Technology Committee review to BNP Paribas's Group AI Committee, ING's AI Risk Committee vetting 140 use cases, DBS's PURE framework and model registry, HSBC's AI Review Committee, NatWest's AIDE triage, and the AI councils, acceptable-use policies and board committees at dozens of regional US banks. The table lists every record with its source.
One row per bank at its strongest status, from AI committees and chief AI officers to acceptable-use policies, training programmes and board oversight; each links to the bank's page where the claim is sourced. The US banks in the table are the population of the AI disclosure index, which scores the whole record. “Governance” is the use case most banks disclose, because after the 2026 guidance moved generative AI out of formal model risk, almost every large bank said what it had put in its place.
| Bank | What the record shows | Status | Date | Source |
|---|---|---|---|---|
| JPMorgan | Firm-wide AI use-case portfolio. Almost 1,000 use cases, about 50 of them 'really important' across risk, fraud, marketing, hedging, prospecting, note-taking, idea generation and document reading; AI solutions in production doubled in 2025. | In production | Feb 23, 2026 | The Motley Fool (Yahoo Finance), Jul 22, 2026 ↗ +1 |
| BofA | Sixteen-pillar AI project review. Every AI project is reviewed against 16 risk pillars including privacy, bias, workforce impact and intellectual property; the CTIO says the bank often decides against AI where rules or an app are enough. | In production | Oct 1, 2026 | Fortune, Oct 1, 2026 ↗ |
| Citi | Mandatory AI training and accelerator network. 175,000 staff in 80 locations had 60 days to complete 'Prompting like a Pro'; about 4,000 AI accelerators across the five businesses support adoption. | In production | Sep 30, 2025 | American Banker, Sep 30, 2025 ↗ +1 |
| U.S. Bank | Persona-based AI training and use-case governance. Role-specific training for 70,000 employees; a governance body reviews every use case through a common lens and ideas are sorted into growth, cost-saving and unmeasured productivity buckets. | In production | Jul 1, 2025 | American Banker, Sep 2, 2026 ↗ +1 |
| PNC | Patented data migration factory. Built for the BBVA conversion, improved and used for FirstBank; granted US patent 12,321,323 with a family of continuations. | In production | Jul 15, 2026 | Yahoo Finance, Jul 15, 2026 ↗ +1 |
| Schwab | Advisor Services AI tooling. AI to move data across advisers' systems, automate tasks and answer questions on Schwab policies and procedures. | In production | May 29, 2026 | American Banker, May 29, 2026 ↗ |
| BNY | Community-bank AI training. Free AI and cyber training for 1,000 community-bank executives, led by senior BNY leaders. | In production | Feb 3, 2026 | Banking Dive, Feb 3, 2026 ↗ |
| Morgan Stanley | LeadIQ. AI that introduces advisors to clients interested in advice and matches individuals with advisors. | In production | Jan 15, 2026 | The Motley Fool (Yahoo Finance), Jan 15, 2026 ↗ +1 |
| State Street | Responsible AI Framework and employee training. The 2025 annual report says generative and agentic AI implementations are governed by a Responsible AI Framework with dedicated employee education and training modules; the proxy lists an AI strategy among the COO's 2025 deliverables. | In production | Apr 8, 2026 | State Street, Apr 8, 2026 ↗ +1 |
| TD | Agent observability and guardrails. US CIO describes chain-of-thought monitoring of agent reasoning plus guardrails and human oversight at design and operational stages, to contain agents that find unpredictable routes to a goal. | In production | Sep 22, 2026 | American Banker, Sep 22, 2026 ↗ |
| Fifth Third | Policy on external AI agents. Per CFO Bryan Preston on the Q3 2026 call, Fifth Third does not currently allow AI agents to initiate transactions in customer accounts, pending resolution of accountability questions; it plans to build agent-style services (subscriptions, savings, budgeting) into its own apps. | In production | Oct 19, 2026 | Banking Dive, Oct 19, 2026 ↗ |
| Huntington | Enterprise-wide AI program. Five areas: software delivery, agentic process transformation, customer-facing use cases, colleague productivity and training, and data platforms. | In production | Apr 23, 2026 | MarketBeat (Yahoo Finance), Apr 23, 2026 ↗ |
| BMO | Responsible AI framework. Accountability, reliability, security, explainability, transparency, fairness, privacy, sustainability. | In production | Aug 6, 2026 | BMO AI Hub, Aug 6, 2026 ↗ |
| First Citizens | Cross-functional AI leadership group. A group spanning business units, technology, cyber security, data, privacy, resilience, legal, compliance and risk reviews AI implementations; benefits are tracked in revenue, cost, speed and risk categories. | In production | Sep 3, 2026 | First Citizens Bank, Sep 3, 2026 ↗ |
| Citizens | Business Pulse survey research on client AI adoption. Quarterly small-business survey tracking AI spending and adoption among Citizens' commercial clients. | In production | Sep 29, 2026 | Citizens (Business Wire via Yahoo Finance), Sep 29, 2026 ↗ |
| M&T | Data lineage, Edison and the Data Academy. The data foundation under the AI program; ~2,000 employees trained. | In production | Jan 1, 2018 | Fast Company, Sep 2, 2026 ↗ +1 |
| KeyBank | Enterprise AI governance and inventory. ERM Committee approves the AI Policy; AI systems are inventoried, risk-assessed and monitored across three lines of defence; framework aligned to NIST AI RMF; AIEOG lexicon adopted; an AI observability and evaluation platform standardises generative-AI testing. | In production | Aug 10, 2026 | KeyCorp, Aug 10, 2026 ↗ |
| Ally | Four-layer AI governance. Working group, steering council, enterprise committee and board; mandatory training; Responsible AI Institute membership. | In production | Sep 18, 2024 | Banking Dive, Sep 17, 2025 ↗ +1 |
| Northern Trust | Board oversight and AI briefings. The board oversees AI inside its strategy, technology and risk work through existing committees, including the Technology and Operations Committee, and receives periodic briefings for directors. | In production | Mar 11, 2026 | Northern Trust (SEC filings), Mar 11, 2026 ↗ |
| Regions | Generative-AI risk framework and responsible use policy. Added after ChatGPT: a risk framework, a responsible use policy and a standard for unstructured data, on top of model-risk management across three lines of defence; sensitive data must not train external models. | In production | Nov 19, 2025 | Investing.com, Nov 19, 2025 ↗ |
| Pinnacle | Generative-AI restriction in the code of conduct. Team members may not use gen-AI applications or put proprietary data into unauthorised applications without approval through internal governance channels. | In production | May 6, 2026 | Pinnacle Financial Partners (SEC filing), May 6, 2026 ↗ |
| UBS | AI framework with risk appetite metrics. The 20-F says UBS set up an AI framework and policy with risk appetite metrics and enhanced controls for fairness, data ethics, privacy, security and records management. | In production | Apr 10, 2025 | UBS Group (SEC filings), Mar 9, 2026 ↗ |
| Synchrony | Responsible AI Working Group and generative-AI risk oversight. A working group anchors responsible use; risks related to generative AI are among the areas overseen by management subcommittees that report to the Board; the chief AI officer owns AI governance. | In production | Oct 22, 2025 | Synchrony, Oct 22, 2025 ↗ +2 |
| USAA | Use-case intake, governance review and AI Aware training. Each use case is evaluated for value before funding, governance analysis precedes training, and the AI Aware course reaches all employees. | In production | Aug 14, 2024 | SiliconANGLE, May 27, 2025 ↗ +2 |
| City National | Post-remediation risk management. Controls rebuilt after the 2024 OCC order; the frame for any AI deployment at the bank. | In production | Aug 27, 2025 | American Banker, Aug 27, 2025 ↗ |
| Western Alliance | Board and CISO oversight of technology and AI risk. An AI-company CISO joined the board in December 2025 and an ex-Wells Fargo CISO started in January 2026, ahead of the $100 billion Large Financial Institution threshold. | In production | Dec 11, 2025 | Business Wire, Dec 11, 2025 ↗ +1 |
| Flagstar | AI strategy committee and tiered model routing. The CIOO chairs an AI strategy committee attended by the CEO that prioritises a revenue and expense-reduction backlog; StarIQ routes work to three model tiers by complexity to manage cost. | In production | Jul 30, 2026 | American Banker, Jul 30, 2026 ↗ |
| Webster | Category IV data and risk infrastructure. Data collection, storage and governance roles; regulatory-reporting capability. | In production | Mar 14, 2025 | Banking Dive, Mar 14, 2025 ↗ |
| East West | Board oversight of technology and AI. The Risk Oversight Committee (chair Mark Hutchins, member Archana Deskus, former PayPal CTO) covers technology risk and receives quarterly information-security briefings; directors attended programmes on AI oversight. | In production | Apr 8, 2026 | East West Bancorp (SEC filings), Apr 8, 2026 ↗ |
| Popular | AI governance framework. Sets requirements and governance over the permitted uses of AI in Popular's environment, including defensive use, and is listed among the controls of the information security and privacy programme; the board Technology Committee oversees AI plans. | In production | Mar 24, 2026 | Popular, Inc., Jun 11, 2026 ↗ +1 |
| Wintrust | Board-level technology and AI oversight. The IT/IS Committee reviews and approves the technology strategic plan and the data management strategy and met four times in 2025; its members include Laura Kohl, credited in the 2026 proxy with guidance on AI objectives. The Chief Risk Officer administers enterprise risk management and reports to the Board, Audit and Risk Management Committees. | In production | Apr 9, 2026 | Wintrust Financial Corporation (SEC filings), Apr 9, 2026 ↗ +1 |
| Old National | AI Center of Excellence: acceptable use and AI inventory. A cross-functional body that sets acceptable-use policies, keeps a live inventory of AI across the organisation and takes employee ideas through to production. | In production | May 19, 2026 | Old National Bank, May 19, 2026 ↗ |
| UMB | Machine learning across the organisation. The CEO's description on the Q1 2026 call; no specific use cases, platform or figures disclosed. | In production | Apr 29, 2026 | The Motley Fool (Yahoo Finance), Apr 29, 2026 ↗ |
| SouthState | AI enablement programme. Office hours, AI Central hub, crowdsourced prompt library; adoption run as change management. | In production | Aug 3, 2026 | SouthState Correspondent Division, Aug 3, 2026 ↗ |
| CIBC | 'Agentic AI with humans in control'. Human judgment, governance and culture at the centre of agent design. | In production | Jul 20, 2026 | CIBC, Jul 20, 2026 ↗ |
| Valley | Five-tier AI access and monthly spend tracking. Specialised tiers for engineering, QA and model risk; ~80 open-access power users. | In production | Apr 23, 2026 | Banking Dive, Jul 10, 2026 ↗ |
| Columbia | Responsible AI Working Group and ServiceNow AI Control Tower. A cross-functional group of technology, risk, compliance, legal and cybersecurity leaders sets frameworks for procuring, assessing and deploying AI, backed by an internal AI Policy. The ServiceNow AI Control Tower centralises oversight of AI assets, models and prompts, aligned to the NIST AI Risk Management Framework. | In production | Sep 19, 2026 | Columbia Banking System, Sep 19, 2026 ↗ |
| SoFi | Planner-evaluated Coach with human escalation. Financial planners evaluate Coach's answers; rule sets escalate out-of-scope conversations; actions require member authorisation. | In production | Aug 14, 2026 | The Financial Brand, Aug 21, 2026 ↗ +1 |
| Frost | Limited AI tools in the investment adviser. Frost Investment Services restricts AI-based tools to internal research, operational and administrative work under supervisory controls, and says they do not make investment decisions or trades. | In production | Mar 25, 2026 | Frost Bank, Mar 25, 2026 ↗ |
| Associated | Line-of-business AI accountability and board oversight. Senior director of AI stewards risk and data; board technology committee. | In production | Apr 28, 2026 | Associated Banc-Corp, Jun 30, 2026 ↗ +1 |
| FNB | AI-assisted metric tracking across operations and risk. Delie says FNB tracks thousands of metrics internally using AI in its data science and has process-mapped the operations area to find efficiencies. | In production | Oct 17, 2025 | earnings call transcript (The Motley Fool), Oct 17, 2025 ↗ |
| Raymond James | AI Academy for advisors and associates. A four-course programme; nearly 20,000 completions by July 2026. | In production | Jun 15, 2026 | MarketBeat (Yahoo Finance), Jul 22, 2026 ↗ |
| Prosperity | Technology budget as scale argument. Management cites $75 million to $90 million of annual technology spend and higher technology and staffing costs as reasons for acquisitions; the spend is described as platform and equipment, not AI. | In production | Oct 29, 2025 | Earnings call transcript (The Motley Fool), Apr 29, 2026 ↗ +1 |
| Deutsche Bank | Agentic resilience platform for regulatory tabletop exercises. Builds scenarios from architecture, logs and incident history using LangGraph for traceable, deterministic runs and Google's Agent Development Kit for adaptive investigation; produces evidence-ready records for DORA exercises. | In production | Aug 18, 2026 | Google Cloud, Aug 18, 2026 ↗ |
| Hancock Whitney | Board Risk Committee oversight of AI risk. Operational risk under the committee includes cybersecurity, technology and AI risks; four meetings in 2025; the Chief Risk Officer reports to it each quarter. | In production | Mar 17, 2026 | Hancock Whitney (SEC filings), Mar 17, 2026 ↗ |
| Commerce | Information Security Strategy Board. The ISSB, chaired by the chief information security officer with the CIO, chief risk officer and Commerce Trust COO among its members, directs the cybersecurity programme and reports to the Audit and Risk Committee; no separate AI committee is disclosed. | In production | Feb 24, 2026 | Commerce Bancshares (SEC filings), Feb 24, 2026 ↗ +1 |
| Banc of California | Board and executive oversight of technology and AI risk. Board Risk Committee reviews the information security and technology management programme; the CIO and CISO report quarterly to the Enterprise Risk Committee. | In production | Feb 27, 2026 | SEC EDGAR, Mar 26, 2026 ↗ +1 |
| BankUnited | Board AI education. Directors received AI-focused training in 2025; the 2025 proxy already listed AI among regular board education topics, and shareholder feedback led the 2026 proxy to add disclosure on board oversight of AI. | In production | Apr 11, 2025 | SEC EDGAR, Apr 11, 2025 ↗ +1 |
| United Bank | Board and executive oversight of technology risk. The Board Risk Committee oversees information security, vendor management and business continuity and appoints the Chief Risk and Information Officer, who reports directly to the CEO. No AI-specific policy or committee is disclosed. | In production | Feb 27, 2026 | SEC EDGAR, Feb 27, 2026 ↗ +1 |
| Texas Capital | AI governance programme and working group. The 2026 proxy says the bank implemented a comprehensive AI governance programme with a dedicated working group; the board Technology Committee oversees AI alongside cybersecurity. | In production | Jan 22, 2025 | SEC EDGAR, Mar 12, 2026 ↗ |
| Fulton | Customer education on AI tools. AI in investing (private bank) and AI budgeting apps (education centre). | In production | Sep 24, 2026 | Fulton Private Bank, Sep 24, 2026 ↗ +1 |
| Glacier | Committee oversight of technology and cyber risk. Cyber risk is reviewed by a Strategic Technology Committee, an Enterprise Risk Management Committee and the board Risk Oversight Committee, which receives quarterly reports from the Chief Risk Officer and Chief Information Security Officer. No AI-specific committee is named. | In production | Feb 25, 2026 | Glacier Bancorp (SEC filings), Feb 25, 2026 ↗ +1 |
| Eastern Bank | Board and risk-function structure for technology and models. The Bank Board has an Innovation and Technology committee and the holding-company board a Risk Management Committee; a Financial and Model Risk Management group inside Enterprise Risk Management provides independent model oversight. No AI-specific inventory or validation regime is disclosed. | In production | Mar 2, 2026 | Eastern Bankshares (SEC filings), Mar 26, 2026 ↗ +2 |
| Axos Bank | Central AI test team and approved-tool gate. Five to seven people test and refine agents; tools are defined centrally, sensitive data is kept out and agents have no access to the outside world. | In production | May 5, 2026 | AI Business, May 5, 2026 ↗ |
| United Community | AI terms in the Navitas sale agreement. The equipment-finance company represents that it has policies for the ethical and safe deployment of AI technologies; the reinsurance company represents that it does not use AI technologies. | In production | Jun 12, 2026 | United Community Banks (SEC filings), Jun 12, 2026 ↗ |
| Sallie Mae | AI review of collection and recovery calls. CEO says all relevant collection and recovery calls were reviewed with AI to measure borrower mentions of third-party debt-resolution practices (Q3 2026 call); no vendor named. | In production | Oct 22, 2026 | The Motley Fool (Yahoo Finance), Oct 22, 2026 ↗ |
| Arvest | Innovation culture programme. Product and innovation office under Amy Morbeck; Fortune recognition. | In production | Mar 25, 2026 | Arvest Bank, Mar 25, 2026 ↗ |
| WesBanco | Board Technology Committee and AI expertise criterion. A board Technology Committee (chaired by Zahid Afzal) and AI listed among desired director expertise in the 2026 proxy. | In production | Feb 19, 2025 | WesBanco (SEC filings), Mar 13, 2026 ↗ |
| WaFd Bank | Build 2030 digital focus. Data used to anticipate client needs; NPS tracked as the outcome metric. | In production | Jun 30, 2026 | WaFd, Inc., Jul 27, 2026 ↗ |
| Renasant | Board technology committee given an AI remit. The 2026 proxy says the Bank's technology committee oversees IT strategy and operations 'including the implementation of artificial intelligence capabilities into the Bank's client-facing and back-office operations, and related risks'; the 2025 proxy wording had no AI reference. The committee chair sits on the enterprise risk management committee. | In production | Mar 12, 2025 | Renasant Corporation (SEC filings), Mar 18, 2026 ↗ +1 |
| Customers Bank | Standardised AI risk framework and AI Innovation Lab. Enterprise governance for scaled deployment. | In production | Jan 22, 2026 | Customers Bancorp, Jan 22, 2026 ↗ |
| First Interstate | Board Technology, Innovation and Operations Committee. One of five standing committees; chaired by Joyce Phillips, met four times in 2025 and reviews technology and innovation investment, while the proxy risk map lists model and third-party risk. | In production | Apr 16, 2026 | First Interstate BancSystem (SEC filings), Apr 16, 2026 ↗ |
| Simmons Bank | Enterprise Data Office. Data governance, data literacy and data-driven decision-making established under the first CDO. | In production | Aug 20, 2026 | Simmons Bank, Aug 20, 2026 ↗ |
| Cathay Bank | Board oversight with AI expertise. Audit committee chair credited with insight into data analytics, automation and AI; a second director brings IT and information-security experience. | In production | Apr 16, 2026 | Cathay General Bancorp (SEC filings), Apr 16, 2026 ↗ |
| Centennial Bank | AI risk-factor wording held constant since FY2023. The generative-AI sentence is identical in the 10-Ks for FY2023, FY2024 and FY2025, and the Q1 and Q2 2026 10-Qs add only a forward-looking reference. | In production | Feb 26, 2024 | Home BancShares (SEC filings), Feb 26, 2024 ↗ +4 |
| Bank of Hawaii | Board and committee oversight of AI risk. The board and its Risk Management Committee receive regular reporting; the 2026 proxy says the board devotes significant time to AI, cybersecurity and information security oversight. | In production | Mar 13, 2026 | Bank of Hawaii Corporation (SEC filings), Mar 13, 2026 ↗ |
| First Hawaiian | Generative-AI usage policies. Written policies and technical safeguards for employees' and contractors' use of generative-AI tools; enterprise tools only for confidential inputs (merger-agreement representations). | In production | Jul 15, 2026 | First Hawaiian, Inc. (SEC filings), Jul 15, 2026 ↗ |
| OceanFirst | Automation Transformation Office, AI governance framework and board oversight. A centralised ATO governs AI investment with ROI-based prioritisation; an AI governance framework and a model risk management policy are in place per the roadmap; the Board's Information Technology Committee oversees AI initiatives and directors received AI training. | In production | Apr 27, 2026 | OceanFirst Financial Corp. (SEC filings), Jul 30, 2026 ↗ +2 |
| TowneBank | Board-level risk oversight covering cyber and technology risk. The Enterprise Risk Management Committee oversees the enterprise risk programme, which lists cyber and security risk, operational risk and Bank Secrecy Act/anti-money-laundering compliance, and receives reports on actual or potential security breaches; chief risk officer Ernest Piccioli is its non-voting secretary. No AI-specific committee or policy is disclosed. | In production | Apr 1, 2025 | TowneBank (FDIC filings), Apr 10, 2026 ↗ +1 |
| First Financial Bank | Board-level AI governance framework. The 2026 proxy says the company has implemented an AI governance framework for ethical, transparent and responsible use, managing data governance, model risk alignment and human oversight controls; the board's Enterprise Risk and Compliance Committee oversees it. The 2025 proxy had described frameworks as being explored and implemented. | In production | Apr 17, 2025 | First Financial Bancorp (SEC filings), Apr 16, 2026 ↗ +1 |
| Beacon Bank | Technology owned by the operating chief, no separate AI owner. The proxy says Sean Gray oversaw technology and business-line analytics at Berkshire Bank and lists no technology, data or AI executive officer among seven. | In production | Apr 2, 2026 | Beacon Financial (SEC filings), Apr 2, 2026 ↗ |
| Optum Bank | United AI Studio and Responsible AI Board. Group platform where engineers build AI models under governance; every model is reviewed by a Responsible AI Board of clinicians, ethicists and legal experts. Applies to Optum Bank only through the parent. | In production | Jul 16, 2025 | Forbes, Jul 16, 2025 ↗ |
| Seacoast Bank | Board Information Technology Committee oversight of AI risk. Chaired by Alvaro Monserrat, the committee assesses technology risks including artificial intelligence, data privacy and cybersecurity and reviews technology strategy; the CISO attends and reports through the chief risk officer. | In production | Feb 27, 2026 | Seacoast Banking Corporation of Florida (SEC filings), Apr 10, 2026 ↗ +1 |
| First Merchants | Board risk reporting that includes the CIO. The president, chief risk officer, chief audit executive, CIO, chief credit officer and head of Private Wealth Advisors give the Risk and Credit Policy Committee periodic risk assessments, and the committee receives an Enterprise Risk Management dashboard quarterly; no AI-specific committee or owner is named. | In production | Apr 3, 2026 | First Merchants Corporation (SEC filings), Apr 3, 2026 ↗ |
| Citizens Business Bank | AI Policy, Policy Framework and AI Governance Council. The Council, chaired by the COO with the CIO, CISO, Human Resource Director, Deputy Chief Credit Officer and an Associate General Counsel, reviews and approves AI solutions of the bank or its vendors, defines acceptable use and provides for monitoring and reporting. | In production | Dec 15, 2025 | CVB Financial Corp. (SEC filings), Apr 7, 2026 ↗ +1 |
| Merchants Bank of Indiana | Regulatory memorandum of understanding, 2025 to 2026. A confidential agreement with the FDIC and Indiana regulator from 30 June 2025 covered capital thresholds, asset concentrations and risk-mitigation plans; it ended in the first quarter of 2026. It does not mention AI. | In production | Jun 30, 2025 | Merchants Bancorp (SEC filings), Nov 7, 2025 ↗ +1 |
| Central Bank | Technology Management Committee and IT Risk Committee. The IT Risk Committee meets weekly; the Technology Management Committee, chaired by the CIO and reporting to the Risk Committee, meets quarterly, defines technology and data risk appetite and tracks major IT projects. | In production | Dec 31, 2025 | Central Bancompany (SEC filings), Mar 25, 2026 ↗ |
| Stifel Bank | Board and committee oversight of technology, cyber and AI risk. The Risk Management Committee oversees technology and cyber risk, gets cybersecurity reports at least four times a year and annually approves the Written Information Security Program, which incorporates AI governance; the Operational Risk Committee oversees information-security risk day to day. | In production | Feb 24, 2026 | Stifel Financial (SEC filings), Feb 24, 2026 ↗ |
| Bank of Hope | Board AI acceptable-use policy. Limits use of AI technology until management and information security have vetted and approved it; disclosed as 'recently adopted' in the 2025 proxy and repeated in 2026. | In production | Apr 11, 2025 | Hope Bancorp (SEC filings), Apr 11, 2025 ↗ +1 |
| ServisFirst Bank | Information Technology Steering Committee oversight. Chaired by the chief information and operations officer with the Information Security Officer and Chief Risk Officer; meets monthly and with the Board approves information-security and technology budgets and strategies annually. | In production | Feb 27, 2026 | ServisFirst Bancshares (SEC filings), Feb 27, 2026 ↗ |
| Community Bank N.A. | Dedicated AI team. A handful of staff fully dedicated to AI, the rest augmented by it; efficiency focus. Published transcripts differ on the total headcount. | In production | Jul 28, 2026 | Investing.com, Jul 28, 2026 ↗ |
| Enterprise Bank & Trust | Fall 2026 Enterprise University: evaluating AI tools. More than 30 no-cost courses, with trending topics including evaluating AI tools and aligning AI adoption with business strategy. | In production | Sep 24, 2026 | Enterprise Bank & Trust, Sep 24, 2026 ↗ |
| FirstBank | AI-based monitoring tools (2024). The 2024 10-K lists their implementation among that year's technology upgrades, with network improvements and compliance tracking, 'designed to support greater operational efficiency and risk management'. It does not say what they monitor or name a vendor, and the 2025 10-K does not repeat the phrase. | In production | Feb 25, 2025 | FB Financial (SEC filings), Feb 25, 2025 ↗ |
| First United Bank | Technology as enterprise capability. Strategy, operating model, data, risk and digital experience connected under one programme. | In production | Aug 11, 2026 | Interface / FinTech Strategy (B2E Media), Aug 11, 2026 ↗ |
| Banner Bank | Generative AI policy and Fintech Council vetting. Board-approved policy since 2023; every proposed Gen AI application is vetted by the Fintech Council against strategic priorities, values, risk appetite and data-security policies. | In production | Dec 31, 2024 | Banner Bank, Jun 24, 2025 ↗ +2 |
| Nicolet | Board and committee oversight of technology risk. The Board's Risk Committee approves the information security programme annually and gets quarterly updates, the Audit Committee receives IT audit and incident reports, and a monthly management Info Sec Steering Committee spans security, risk, compliance, audit, legal, operations, banking and wealth. The 10-K gives AI no separate governance body. | In production | Feb 24, 2026 | Nicolet Bankshares (SEC filing), Feb 27, 2026 ↗ +1 |
| ConnectOne | Ban on non-approved generative AI. Policies and governance structures prohibit employees from using non-approved generative AI applications or websites on the bank's network or devices. | In production | Feb 24, 2026 | ConnectOne Bancorp (SEC filing), Feb 24, 2026 ↗ |
| Bread Financial | AI Governance Council and board oversight. Bread established an AI Governance Council in 2024. The board's Risk & Technology Committee has primary responsibility for AI risk and receives regular updates on AI initiatives and potential use cases; Bread also scans 100% of calls for risk controls instead of sampling. | In production | Apr 2, 2025 | Bread Financial Holdings (SEC filing), Apr 2, 2025 ↗ +2 |
| BancFirst | AI expertise on the Information Security Committee. The 2026 proxy lists director Robin Roberson, president and co-founder of Agentech AI, Inc. and a provider of AI and digital strategy consulting, on the quarterly Information Security Committee with Harlow, Schmidt, Carroll, Copeland and Hannah. No AI-specific committee or officer is disclosed. | In production | Apr 3, 2026 | BancFirst Corporation (SEC filing), Apr 3, 2026 ↗ |
| National Bank Holdings | Board oversight of AI and emerging technology. The Audit & Risk Committee is updated quarterly on information security, cybersecurity trends and AI, and a four-director Emerging Technologies Sub-Committee chaired by Art Zeile oversees the risks and strategic fit of new technologies the bank implements or considers. | In production | Apr 3, 2026 | National Bank Holdings Corporation (SEC filing), Apr 3, 2026 ↗ |
| First Commonwealth | Enterprise data analytics and strategy function. In December 2025 the bank created its first enterprise-wide data analytics and strategy position and hired Mike Clark from PNC; the role is to enable data-driven decisions and operational efficiency. No AI mandate is stated. | In production | Dec 15, 2025 | Pittsburgh Business Times (bizjournals.com), Dec 15, 2025 ↗ |
| RBC | Block on third-party personal AI agents in digital banking. Since 27 October 2026 RBC blocks third-party personal AI agents from direct access to authenticated digital properties including online banking; clients keep the app, website, RBC's own digital tools and customer service. Framed by RBC as following its responsible-AI guidelines after a security review (Bloomberg, citing an employee memo). | In production | Oct 27, 2026 | Royal Bank of Canada, Oct 27, 2026 ↗ +1 |
| UOB | FEAT-aligned Gen AI governance and MindForge participation. UOB says its Gen AI enablement follows MAS FEAT principles and Project MindForge, with reference grounding, human-in-the-loop review and feedback loops; it is one of 24 MindForge toolkit participants. | In production | Mar 20, 2026 | United Overseas Bank, Oct 24, 2026 ↗ +1 |
| Standard Chartered | SC Ventures AI Lab. The innovation engine within SC Ventures that evaluates AI use cases across the bank and its venture portfolio with 'ROI before AI' validation, deciding whether to build, buy, partner or pivot; portfolio examples include Qatalyst (AI analysis of sustainability reports), Project Themis (machine learning for compliance) and Lexarius (generative AI role-play training, built with INSEAD). | In production | Oct 24, 2026 | SC Ventures (Standard Chartered), Oct 24, 2026 ↗ +1 |
| OCBC | FEAT-based AI governance and MAS toolkit participation. Regular model reviews for accuracy and bias, tested against fairness, ethics, accountability and transparency (FEAT) principles; OCBC took part in MAS's MindForge toolkit and the SAFR agent-safeguards paper. | In production | Mar 25, 2025 | Oversea-Chinese Banking Corporation, Oct 5, 2026 ↗ +3 |
| ING | AI Risk Committee and Centre of Excellence. A central AI Risk Committee for new domains such as voicebots and agentic AI, a Centre of Excellence, and vetting of 140 specific GenAI risks. | In production | Feb 26, 2026 | ING Groep N.V. (SEC filing), Feb 26, 2026 ↗ +1 |
| Deutsche Bank | AI & Data Ethics Principles and AI training. Eight principles including accountability, fairness and bias, transparency and human oversight; more than 11,000 colleagues have completed AI Foundations. | In production | Oct 5, 2026 | Deutsche Bank, Oct 5, 2026 ↗ |
| UBS | AI Citizen and AI Enabler learning journeys. Mandatory annual training in responsible AI plus tiered programmes: about 1,300 senior leaders, including the Group Executive Board, have completed the AI Senior Leadership Journey, and an AI Builder pathway is being set up for certified engineers. | In production | Oct 5, 2026 | UBS Group AG, Oct 5, 2026 ↗ |
| HSBC | AI Review Committee and hub-and-spoke governance. Novel AI use cases go through a governance review before pilot and are approved by a committee of senior executives; AI Review Councils were embedded across the bank in the first half of 2025. | In production | Oct 5, 2026 | HSBC Holdings plc, Oct 5, 2026 ↗ +1 |
| BBVA | Responsible-AI framework and AI transition indicator. Eight principles implemented through technology, governance and training; the AI transition indicator reviews every client's vulnerability to AI disruption. | In production | Jul 8, 2026 | BBVA, Jul 8, 2026 ↗ +1 |
| TD Bank Group | Responsible AI Principles and Trustworthy AI team. Seven commitments, model risk and privacy impact assessments, independent oversight reviews and post-deployment monitoring of fairness, performance and explainability; controls such as retrieval grounding and human oversight apply to colleague-facing assistants. | In production | May 21, 2026 | TD Bank Group, Jul 30, 2026 ↗ +1 |
| NatWest | AI and Data Ethics Code of Conduct, AIDE triage and AI oversight. Every AI use case is triaged through the AIDE process; an AI Steering Committee reviews ambition and progress; the Board Risk Committee agreed that AI risks would be reported in a consolidated AI dashboard in 2026; the Group Technology, Innovation and Simplification Committee received briefings on AI adoption; and the annual report lists AI as a top risk scenario covering model risk and fraud. | In production | Aug 4, 2025 | NatWest Group plc, Feb 13, 2026 ↗ +1 |
| BNP Paribas | Group AI Committee, AI Risk Committee and responsible-AI principles. The Group AI Committee approves the AI strategy and evaluates use cases against risk assessments; the AI Risk Committee monitors AI Act compliance, defines model attestation and analyses AI risk; five responsible-AI principles apply across the AI lifecycle; research runs through the FinAI-LAB joint laboratory with Télécom Paris and a collaboration with Mila. | In production | Mar 19, 2026 | BNP Paribas, Mar 19, 2026 ↗ +3 |
| DBS | PURE framework, Responsible AI Committee and model registry. Every use case is tested against Purposeful, Unsurprising, Respectful and Explainable data use; a risk-based model governance process with materiality assessment, an AI registry and senior-management accountability; a control plane for agents with an agent registry. | In production | Oct 29, 2025 | DBS Group Holdings, Oct 6, 2025 ↗ +3 |
| Scotiabank | Data ethics and AI governance. A dedicated Data Ethics team, a public Data Ethics Statement, review of AI use cases for fairness, transparency and accountability before launch, mandatory training and annual attestations; a board technology committee oversees AI and data-ethics frameworks. | In production | Apr 13, 2026 | Scotiabank (CNW via Yahoo Finance), Apr 13, 2026 ↗ +1 |
| BMO Financial Group | Board oversight and approved-tools rule. The board oversees AI strategy; committees receive reporting on AI-related technology risk; employees may use only BMO-approved AI tools. | In production | Mar 11, 2026 | Bank of Montreal (SEC filing), Mar 11, 2026 ↗ +1 |
| Société Générale | Legal Assistant for contract review. An NLP assistant first built for loan agreements and extended to non-disclosure, master and collateral agreements in wholesale banking. | In production | Feb 1, 2025 | Societe Generale, Feb 1, 2025 ↗ |
| Amex | Third-generation data and analytics platform. Public-cloud platform for personalisation, servicing, fraud and GenAI and agentic use cases; 90% faster key marketing and fraud processes. | Rolling out | Jan 30, 2026 | Motley Fool (Yahoo Finance), Jan 30, 2026 ↗ |
| Santander | Responsible-AI testing of conversational systems (group). Santander tests customer-facing conversational AI for over-refusal and unreliable answers; the group also publishes an evaluation approach for AI products. | Rolling out | Jul 23, 2026 | Banco Santander, Jul 23, 2026 ↗ |
| BOK Financial | Data-first model for responsible AI scaling. Enterprise data treated as a shared asset under the chief data and analytics officer. | Rolling out | Mar 24, 2026 | American Banker, Mar 24, 2026 ↗ |
| EverBank | Omnichannel and customer-platform transformation. Digital, voice, contact-centre and branch context sharing under the head of digital and customer platforms. | Rolling out | Apr 24, 2026 | American Banker, Apr 24, 2026 ↗ |
| Bank OZK | Data, analytics, modeling and AI hiring. Management comments of January and April 2026 say headcount in data, analytics, modeling and artificial intelligence has increased over two years; no headcount figure is given for those teams. | Rolling out | Jan 20, 2026 | Bank OZK, Jan 20, 2026 ↗ +1 |
| Rockland Trust | Office of Digital Innovation and AI governance framework. Gate for AI investments, favouring use cases with meaningful payback within a moderate risk approach; the governance model itself was still 'in process' in the September 2026 deck. | Rolling out | Apr 17, 2026 | MarketBeat via Yahoo Finance, Apr 17, 2026 ↗ +2 |
| Busey Bank | Enterprise AI and data-science function. Strategy, communication and execution of responsible AI/ML models across business units. | Rolling out | Apr 6, 2026 | Busey Bank, Apr 6, 2026 ↗ |
| Hilltop | Prudent automation and AI to drive efficiency. The 2026 proxy statement counts implementing automation and AI 'in a prudent manner to drive efficiency' among 2025 achievements, next to lower headcount and shared services; no tool or budget is named. | Rolling out | Jan 29, 2026 | Hilltop Holdings (SEC filing), Apr 30, 2026 ↗ +1 |
| The Bancorp | Automation and AI in the Apex 2030 operating model. The September 2026 restructuring says the bank is refining workflows and expanding automation and AI while cutting costs. | Rolling out | Sep 4, 2026 | The Bancorp (Business Wire via Yahoo Finance), Sep 4, 2026 ↗ |
| Commonwealth Bank | Central AI platform, guardrails and token-cost control. The Chief AI Officer is accountable for a single enterprise platform for engineers and data scientists, standard guardrails, evaluation and observability, and tracking of token usage and forecast costs, including use of small language models and open-source models; customer-facing capabilities are tested with staff, then small customer groups. | Rolling out | Sep 18, 2026 | Retail Banker International (via Yahoo Finance), Sep 18, 2026 ↗ |
| Goldman | Trade and transaction accounting agents. Automating accounting for trades and transactions. | Pilot | Feb 6, 2026 | CNBC, Feb 6, 2026 ↗ |
| Truist | Client Pulse. Patent-pending AI aggregating client feedback across millions of conversations. | Pilot | Aug 20, 2025 | Truist, Aug 20, 2025 ↗ |
| First Horizon | Enterprise Data Hub and data marketplace. Unified data with permission-based discovery of approved data products. | Pilot | Jun 1, 2026 | American Banker, Jun 1, 2026 ↗ |
| Atlantic Union | Exploratory AI programme. 'Exploring exciting opportunities with Artificial Intelligence'; agentic and third-party model risks flagged. | Pilot | Mar 25, 2026 | Atlantic Union Bankshares, Mar 25, 2026 ↗ |
| Barclays | FCA AI Live Testing and CommonAI High Assurance programme. Live regulatory testing of AI applications and membership of a programme for AI that makes autonomous decisions in high-risk settings. | Pilot | Apr 21, 2026 | Financial Conduct Authority, Apr 21, 2026 ↗ +1 |
| Lloyds | FCA AI Live Testing and neurosymbolic proof of concept. Scottish Widows is in the FCA's second AI Live Testing cohort; UnlikelyAI's neurosymbolic technology was tested in the Innovation Sandbox. | Pilot | Jul 2, 2025 | Financial Conduct Authority, Apr 21, 2026 ↗ +1 |
| Mechanics Bank | No disclosed AI deployment. No named AI tool, vendor or budget; the Q1 2026 investor presentation says the technology roadmap is increasingly focused on AI tools for productivity. (Corrected 2026-09-24: previously said earnings materials were silent on AI.) | Announced | Apr 30, 2026 | Mechanics Bancorp (Business Wire via Yahoo Finance), Jul 29, 2026 ↗ +1 |
| Trustmark | Post-conversion efficiency programme. Management attention shifting to efficiency gains and possible M&A. | Announced | Jul 28, 2026 | StockStory (Yahoo Finance), Jul 30, 2026 ↗ |
| NBT | AI for risk management and data quality (stated aim). The letter lists strengthening risk management and improving data quality among the aims of NBT's AI use, building on years of investment in controls. | Announced | Jan 26, 2026 | NBT Bancorp (SEC filing, ARS), Apr 6, 2026 ↗ |
| FirstSun | AI risk in quarterly forward-looking statements. The Q1 and Q2 2026 10-Qs list risks related to the development and use of artificial intelligence among the factors that could change results; the Q3 2025 10-Q did not. | Announced | May 8, 2026 | FirstSun Capital Bancorp (SEC filing), May 8, 2026 ↗ +1 |
| First Financial Bankshares | AI adoption risk (10-K). The 10-K flags the risk of adopting, or failing to adopt, technology such as AI; no AI system in use is named. | Announced | Feb 25, 2026 | First Financial Bankshares (SEC filing), Feb 25, 2026 ↗ |
| Dime | Risk-led oversight of technology and AI. The 10-K commits to 'ensuring responsible AI governance'. Cybersecurity sits under the CISO and the Chief Risk Officer, with an Enterprise Risk Management Committee that includes the CTO and a three-director board risk committee; no AI committee or AI policy is described. | Announced | Feb 20, 2026 | Dime Community Bancshares (SEC filing), Feb 20, 2026 ↗ +1 |
| Park National | AI as a tool under human judgment. The chairman's shareholder letter frames AI as a tool whose value depends on the person wielding it; it sets out no policy or governance structure. | Announced | Mar 9, 2026 | Park National Corporation (SEC filing, ARS), Mar 9, 2026 ↗ |
How do the largest banks practise responsible AI while innovating?
The largest US banks govern AI mostly through the structures they already run for model, technology and operational risk, and say so in their filings: Goldman Sachs has a Firmwide Artificial Intelligence Risk and Controls Committee reporting to its technology risk committee; Citigroup's board Technology Committee reviews management's approach to generative AI; Truist bases its AI program on the NIST AI Risk Management Framework with board oversight; BNY folds model risk management into a cross-functional AI risk framework. A few have published principles (PNC's six Responsible AI Principles, run by a working group under model risk management) or testing tools (JPMorgan Chase's Fence guardrails for hallucination, topic drift and prompt injection). The rest disclose AI mainly as a risk factor, and none has published a separate responsible-AI policy in its 10-K.
What the largest US banks say in their own filings about governing AI, in their words, with the document it comes from. These are the statements a smaller bank's board is most often asked to compare itself against.
| Bank | What it has disclosed about governing AI | Where |
|---|---|---|
| Goldman Sachs | A Firmwide Artificial Intelligence Risk and Controls Committee oversees the risks of using AI and reports to the Firmwide Technology Risk Committee. | 2025 Form 10-K (Feb 2026) |
| Citigroup | The board's Technology Committee oversees and reviews management's approach to generative AI; Citi says it has policies governing emerging technologies, including in model risk management. | 2025 Form 10-K (Feb 2026) |
| Truist | Its AI program is 'foundationally based' on the NIST AI Risk Management Framework Core, and oversight of the program is a regular focus of the board and its risk and technology committees. | 2025 Form 10-K (Feb 2026) |
| BNY | Model risk management covers AI use cases, including large language models, and is integrated into a cross-functional AI risk management framework with an active model inventory. | 2025 annual report, Form 10-K Exhibit 13.1 (Feb 2026) |
| Bank of America | 'To address AI-related risks, we have implemented internal processes and governance frameworks', with compliance and operational-risk teams assessing them independently. | 2025 Form 10-K (Feb 2026) |
| PNC | Six Responsible AI Principles (accountability; transparency, explainability and accuracy; inclusion; fairness; reliability and security; privacy) and a Responsible AI Working Group, managed by Model Risk Management, that reports to the Operational Risk Committee. | PNC corporate-responsibility page (undated) |
| JPMorgan Chase | The Fence guardrail framework tests each large-language-model use case for hallucination, topic drift and prompt injection using synthetic data. | JPMorganChase technology blog (Apr 2026) |
| Capital One | Names the policies governing how data, models and AI are acquired, validated, stored and analysed as a dependency in its 10-K, and co-founded the USC–Capital One Center for Responsible AI and Decision Making in Finance (CREDIF) in April 2024. | 2025 Form 10-K; Capital One tech blog (Apr 2024) |
| Wells Fargo | Discloses AI as a risk: data may be inaccurate or biased and some models have 'limited transparency'; 'even though we may have controls', AI could lead to poor decisions. | 2025 Form 10-K (Feb 2026) |
| American Express | Discloses the risk of failing to 'safely deploy AI systems and implement appropriate governance and controls'. | 2025 Form 10-K (Feb 2026) |
Sources: Goldman Sachs 2025 Form 10-K · Citigroup 2025 Form 10-K · Truist 2025 Form 10-K · BNY 2025 annual report (Form 10-K Exhibit 13.1) · Bank of America 2025 Form 10-K · PNC, Protecting Customer Privacy and Security · JPMorganChase, Strengthening LLM guardrails with synthetic data generation · Capital One 2025 Form 10-K · Capital One and USC partner to drive responsible AI (CREDIF) · Wells Fargo 2025 Form 10-K · American Express 2025 Form 10-K
| Bank | Who | Quote | Date | Source |
|---|---|---|---|---|
| Huntington | Vijay Konduru, Head of Innovation and AI Products | “One of the critical things we're ensuring is that the humans are going to be in the loop at all times.” | Oct 27, 2026 | TheStreet (Yahoo Finance), Oct 27, 2026 ↗ |
| TD | Ted Paris, Head of Analytics, Intelligence & AI, TD Bank U.S. | “The future of AI in banking is human-led and AI-enhanced.” | Oct 22, 2026 | TD Bank U.S. (Business Wire via Yahoo Finance), Oct 22, 2026 ↗ |
| Beacon Bank | Sean A. Gray, Chief Executive Officer | “We also see meaningful opportunity to use artificial intelligence responsibly for operational efficiency and workforce enablement.” | Oct 22, 2026 | The Motley Fool (Yahoo Finance), Oct 22, 2026 ↗ +1 |
| Wintrust | David Normandin, President and CEO, Wintrust Specialty Finance | “I wanted people to feel like they could embrace and trust leadership in what we’re doing.” | Oct 15, 2026 | Equipment Finance News, Oct 15, 2026 ↗ |
| Goldman | David Solomon, Chairman and CEO | “The choice is not between halting progress and moving forward without guardrails.” | Oct 13, 2026 | American Banker, Oct 13, 2026 ↗ +1 |
| UOB | Wee Ee Cheong, Deputy Chairman and Chief Executive Officer | “So, do we stop hiring? No. We will continue to hire because you still need humans to sell, to make decisions.” | Oct 8, 2026 | The Straits Times, Oct 8, 2026 ↗ |
How has AI governance in banking changed since 2011?
From one document to a layered system. SR 11-7 (2011) made model governance examinable; BCBS 239 (2013) set the data standard; NIST's AI RMF (2023) and the PRA's SS1/23 (2023) brought AI in explicitly; SR 23-4 (2023) covered vendor AI; the EU AI Act (2024) made consumer credit scoring high-risk; the NIST generative-AI profile (2024), the Basel third-party principles (2025) and Treasury's lexicon (2026) filled the generative gaps; SR 26-2 (April 2026) replaced SR 11-7 and carved generative and agentic AI out; Colorado re-enacted its AI law (May 2026); the FSB consulted on twelve sound practices (June 2026); the Digital Omnibus deferred EU high-risk duties to December 2027 (July 2026); the FSB finalised the twelve sound practices (October 2026).
| Date | What changed |
|---|---|
| Apr 4, 2011 | SR 11-7 makes model governance an examinable discipline |
| Jan 9, 2013 | BCBS 239 sets the data-governance standard |
| Jan 26, 2023 | NIST AI RMF 1.0 published |
| May 17, 2023 | PRA SS1/23 keeps AI inside model risk management |
| Jun 7, 2023 | SR 23-4 third-party guidance covers vendor AI |
| Jul 12, 2024 | EU AI Act published; credit scoring is high-risk |
| Jul 26, 2024 | NIST generative-AI profile |
| Dec 10, 2025 | Basel third-party risk principles reach AI supply chains |
| Feb 19, 2026 | Treasury FS AI RMF and lexicon |
| Apr 17, 2026 | SR 26-2 replaces SR 11-7; generative and agentic AI carved out |
| May 14, 2026 | Colorado re-enacts its AI law as the ADMT Act |
| Jun 10, 2026 | FSB consults on twelve sound practices |
| Jul 24, 2026 | Digital Omnibus defers EU high-risk duties to Dec 2027 |
| Oct 15, 2026 | FSB finalises the twelve sound practices |
The vendors that sell the inventory, tiering, validation-workflow and monitoring tooling behind the framework are a small category with no bank customer yet named on this site's record: Credo AI, Monitaur, SAS Model Risk, ValidMind and Yields. The model risk and AI governance guide explains what they do and which documents they map to.
| Vendor | What it does | Banks naming it | In production |
|---|---|---|---|
| Credo AI | AI governance SaaS: registry of AI use cases, agents and vendors, policy packs (EU AI Act, NIST AI RMF, ISO 42001), agent controls. | 0 | 0 |
| Monitaur | AI governance SaaS: inventory, common controls, vendor governance, drift and bias monitoring, and FlightSim black-box AI testing. | 0 | 0 |
| SAS Model Risk | SAS module for model inventory, validation workflow, findings, monitoring and model-risk reporting, on the SAS Viya platform. | 0 | 0 |
| ValidMind | Model inventory, validation and documentation automation, monitoring and AI governance for banks; agent controls in early access. | 0 | 0 |
| Yields | Model risk management and AI governance platform: model inventory, tiering, workflow engine, documentation, validation and monitoring. | 0 | 0 |
What is AI governance in banking?
The set of structures a bank uses to decide which AI it runs, under what controls, with whom accountable: a committee that approves use cases, an inventory of systems with risk tiers, validation and monitoring for models, data and prompt controls, vendor due diligence, human oversight with a route to a person, and reporting to the board. It is assembled from model-risk guidance, third-party guidance, consumer law and voluntary frameworks rather than from one AI rule, and on the record of this site most large banks run it through the committees they already had for model, technology and operational risk.
Is there a single AI governance rule for banks?
No. In the US, AI governance is assembled from model-risk guidance (SR 26-2 and its OCC and FDIC twins), third-party guidance (SR 23-4), consumer law on automated decisions (ECOA, FCRA, the 2026 Regulation B rule), state laws (Colorado's ADMT Act, California's ADMT regulations, New York's cybersecurity regulation) and voluntary frameworks (NIST, Treasury). The EU AI Act is the closest thing to a single rule and it applies to banks only where they run a high-risk system, mainly consumer credit scoring. The UK's PRA SS1/23 is the closest in a prudential regime.
What is an AI governance framework for a bank?
Eight elements, each of which an examiner will ask to see: an AI council or committee, an inventory and use-case register, risk tiering, independent validation, ongoing monitoring, human oversight and explainability, third-party governance, and incident and board reporting. The table on this page maps each element to the documents that require it and the banks that disclose it. The large banks name theirs: Goldman Sachs's Firmwide AI Risk Committee, BNP Paribas's Group AI Committee and AI Risk Committee, ING's AI Risk Committee and Centre of Excellence, DBS's PURE framework and model registry, Ally's four-layer governance, KeyBank's AI Policy approved by its ERM Committee.
Does model risk management cover generative AI?
Not in the US since April 17, 2026. SR 26-2 states that generative and agentic AI models are outside its scope and directs banks to broader risk-management and governance practices; the agencies have promised a request for information. In the UK the PRA's SS1/23 keeps AI and machine learning inside model risk management. In practice US banks govern generative AI through use-case approval, grounding, human review and evaluation, and cite the NIST AI RMF and its generative-AI profile as the framework.
Who owns AI governance in a bank?
On the record of this site, a chief AI officer or an equivalent role at the largest banks (U.S. Bank, Synchrony, Raymond James, HSBC, UBS and BMO have a named chief AI officer; JPMorgan, Capital One, Truist, BNY, State Street, CIBC and Santander combine it with data), reporting into the CIO, the COO or the CEO, with a risk counterpart in the second line (M&T's head of AI risk oversight, Goldman's committee co-chaired by the CIO and the chief risk officer) and the board's risk or technology committee above both. The leaders table on this page lists every named role.
What does an examiner ask to see?
An inventory of AI systems with owners and risk tiers, the approval and validation record for each material one, the data lineage behind it, the vendor due diligence where it is bought, the monitoring and the route to a human, and evidence that the board has been told what is running and why. The framework table maps each of those to the document that asks for it.
What is the difference between AI governance and model risk management?
Model risk management is one element of AI governance: the validation and monitoring discipline for models in scope, defined by SR 26-2 in the US and SS1/23 in the UK. AI governance is the whole structure around every AI system including the ones that are not models under the 2026 definition: the committee, the inventory, the data and prompt controls, the vendor governance, the human oversight and the board reporting. The model risk management page on this site covers the discipline; this page covers the structure.
How is AI governance changing in 2026?
Four moves. SR 26-2 replaced SR 11-7 in April, narrowed the definition of a model and carved generative and agentic AI out of formal model risk. The EU's Digital Omnibus deferred the AI Act's stand-alone high-risk duties to December 2027. The FSB finalised its twelve sound practices for AI governance across the sector on 15 October 2026, after a June consultation. And the supervisors turned to agents: MAS's 2026 guidelines cover AI agents explicitly, the Bank of England and FCA's 2026 survey asked about agentic AI for the first time, and the ECB's 2026 letter demands an AI-cyber action plan from every significant institution by 31 October 2026.
When a regulator changes what governance means, or a bank names a chief AI officer, you'll read it the next morning.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning