How does American Express govern AI and manage AI risk?
American Express governs AI through its board Risk Committee and a written policy. The 2026 proxy, filed March 25, 2026, says the Risk Committee 'is primarily responsible for oversight of risks and opportunities related to our use of AI and GenAI' and that the company has adopted an Artificial Intelligence Risk Management Policy that 'addresses the use of all AI systems and applies to all colleagues, products and lines of business', follows the three lines of defense and also governs third-party use of AI. In management, CIO Ravi Radhakrishnan said in May 2025 that generative AI arrived with a governance framework including 'a cross-functional AI council', and CTO Hilary Packer described an 'AI firewall' around the model layer and 'an extensive model risk management and validation process'. Every 10-K since the 2023 edition says Amex performs 'extensive reviews and testing' of AI/ML models; the 2025 10-K warns of 'biased or inaccurate results' and 'hallucinatory' outputs. For AI agents, Amex published its Intent Intelligence Framework on October 13, 2026, and Stephen Squeri said on October 23, 2026 that Amex is 'not going to let assistants run rogue through our systems'. The backdrop is a compliance one: on October 8, 2026 the Federal Reserve and the OCC took enforcement actions over anti-money-laundering failures, with a $350 million OCC penalty; neither announcement mentions AI. No standalone set of AI principles was found in the sources reviewed.[1][2][3][4][5][6][7][8][9]
Data as of Oct 31, 2026 · Amex profile updated Oct 26, 2026 · 25 sources cited on this page · 141 banks profiled on this site · Markdown
Who oversees AI at American Express, from the board down?
'Disclosed' means it is in an SEC filing; 'Stated' means a named executive said it on the record.
| Body or policy | What it does for AI | Status | Source date |
|---|---|---|---|
| Risk Committee (board) | Primary oversight of AI and GenAI risks and opportunities; 'focused on overseeing and monitoring our AI governance structure, including appropriate guardrails, training and consideration of risks and benefits'; receives regular reports on emerging technology risks, including AI | Disclosed | March 25, 2026[1] |
| Full board | Receives regular updates on AI and GenAI use 'in strategic business presentations with Management and through risk reporting' | Disclosed | March 25, 2026[1] |
| Artificial Intelligence Risk Management Policy | Covers 'all AI systems' across colleagues, products and lines of business; follows the three lines of defense; sets enterprise-level escalation to Management or the Board; governs third-party use of AI | Disclosed | March 25, 2026[1] |
| Enterprise Risk Management Committee (ERMC) | Highest-level management risk committee, co-chaired by the CEO and the Chief Risk Officer; runs the Risk Governance Framework the AI policy aligns with | Disclosed | March 25, 2026[1] |
| Cross-functional AI council | Part of the governance framework set up for generative AI; Radhakrishnan: 'It was important that we think about responsible use even during early experimentation'. A council first identified 500 potential use cases and cut them to 70 | Stated | April 2, 2025; May 9, 2025[2][3] |
| Enterprise AI Platforms | Berta Rodriguez-Hervas, SVP since January: 'trust by design', with explainability, audit trails and data lineage built into systems, and repeatable model validation, monitoring and observability | Stated | July 20, 2026[10] |
| Chief Risk Officer | Jodi Richard, U.S. Bank's chief risk officer, named CRO of American Express and its national bank effective January 25, 2027, reporting to Squeri; Doug Tabish moves to enterprise shared services | Announced | October 30, 2026[11] |
What has American Express disclosed about AI risk, and when?
From 10-K and 10-Q filings, the proxy, the Q3 2026 call and the agentic-commerce framework. Quotes are verbatim.
| Date | Item | What it says |
|---|---|---|
| February 9, 2024 | 2023 Form 10-K, model risk | Amex uses 'artificial intelligence and machine learning (AI/ML) models for a variety of business use cases' and performs 'extensive reviews and testing to reduce the risk that these AI/ML techniques result in adverse consequences'[4] |
| April 19, 2024 | Q1 2024 Form 10-Q | Laws on automated decision making, AI and machine learning 'are still evolving' and may restrict 'our ability to use artificial intelligence and machine learning'[12] |
| February 7, 2025 | 2024 Form 10-K, model risk | The same review-and-testing statement, now covering AI/ML models 'including Generative AI tools'[13] |
| April 2, 2025 | CTO interview | Packer: open and closed-source models, an orchestration layer that swaps models by use case, and an 'AI firewall' enveloping it all[3] |
| April 18, 2025 | Q1 2025 Form 10-Q | New AI laws are 'reshaping how we develop, deploy and manage artificial intelligence systems', with obligations on data use, recordkeeping, transparency and human oversight[14] |
| February 6, 2026 | 2025 Form 10-K, risk factors | Names the EU AI Act and AI laws in California, Colorado and Utah; warns of 'flaws in models or datasets that may result in biased or inaccurate results' and 'hallucinatory' outputs, and that model complexity can make it hard to 'understand and explain their outputs'[5] |
| March 25, 2026 | 2026 proxy statement | A section on board oversight of AI describes the Risk Committee's role and the Artificial Intelligence Risk Management Policy[1] |
| October 13, 2026 | Intent Intelligence Framework | A Create Intent API captures the customer's instructions; the customer authenticates and signs off; an Intent ID and a Proof of Intent Token tie the agent's payment credential to what was authorized[6] |
| October 23, 2026 | Q3 2026 call | Squeri: 'we're going to take a risk-based approach'; agents get access only if 'approved through API or MCP channels'[7] |
| October 23, 2026 | Q3 2026 Form 10-Q | Lists AI-assisted deepfake attacks and 'exploitation of vulnerabilities (including by AI models)' among cyber threats; repeats that AI rules impose obligations on data use, recordkeeping, transparency and human oversight[15] |
What regulatory actions frame American Express's AI governance?
On October 8, 2026 the Federal Reserve announced an enforcement action against American Express Company over its failure to sufficiently detect and report suspicious activity related to money laundering, and the OCC issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. The OCC cited inadequate resources, systemic internal control gaps, weak independent testing and weak BSA/AML training, and a failure to timely report approximately $13 billion of suspected trade-based money laundering over the past decade.[8][9]
Neither regulator's announcement mentions AI. On the October 23, 2026 call Squeri said the orders do not impose an asset cap and that 'the deficiencies cited in the consent order should not have occurred, and we are accountable for addressing them thoroughly'; the Q3 10-Q says Amex is working to remediate deficiencies, 'including to satisfy the requirements of regulatory orders'.[7][15]
The risk leadership changed a week later: Payments Dive reported on October 30, 2026 that Jodi Richard, a former OCC examiner, will join as chief risk officer and head of global risk and compliance. The proxy says the chief risk officer co-chairs the ERMC, the management committee that runs the Risk Governance Framework the AI policy follows.[11][1]
What does the Amex profile record on this topic?
The rows below are the entries of the American Express AI strategy profile that bear on this page, as of Oct 26, 2026; the profile holds the full record of 43 dated moves, 24 use cases and 73 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Agent Purchase Protection | Network backing for purchases by registered AI agents. | In production | [16] |
| AI risk-factor disclosure | 10-K covers agentic-commerce disintermediation, flawed or biased models, hallucinations and the EU AI Act and US state AI laws. | In production | [5] |
| Enablement layer, AI firewall and model validation | A control plane gives teams governed access to open and closed models, with an AI firewall and a model-risk validation process that tests accuracy using retrieval-augmented generation. | In production | [3][17] |
| Intent Intelligence framework | Create Intent API, Intent ID and Proof of Intent Token that scope an agent's payment credential to the customer's approved purchase. | Announced | [18][6] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Oct 13, 2026 | Intent Intelligence framework published | Amex releases its framework and Create Intent API for capturing and authenticating purchase intent before an agent transacts; Gebb and VP Hannah Bozian describe it as a way to reduce disputes. | [18][6] |
| Oct 8, 2026 | Agentic commerce playbook and merchant advisory council | Reported October 8 (released earlier that week): Amex releases a Teneo survey in which about two-thirds of US consumers use AI tools to compare prices and only 15% would let an agent make expensive purchases, and says it is convening a merchant advisory council. | [19] |
| Jul 24, 2026 | Q2 call: closed loop and intent as the answer to agentic fraud | Squeri says agentic commerce is fraught with fraud and hallucinations and that knowing what the cardholder wanted and what the merchant delivered gives Amex an advantage; agentic initiatives were not in the year's original spending plan. | [20] |
| Jul 24, 2026 | Q2 10-Q lists agentic commerce among strategic dependencies | The filing ties results partly to the ACE kit, Agent Purchase Protection, making Membership assets discoverable on AI platforms and embedding AI into internal processes; it also cites AI usage costs. | [21] |
| May 19, 2026 | Decentralised-network LLM patent granted | US 12,632,648 B2 covers verifying answers from several LLM providers over a decentralised network to cut hallucinated responses; two further LLM security patents were granted on March 17 and April 7, 2026. | [22] |
| Apr 23, 2026 | Q1 call: 'data is king' in the agentic world | Squeri reports a 30% benefit for programmers, says the ACE kit requires an agent to declare intent so it can be matched with the purchase, and flags coming announcements with leading AI companies. | [23] |
| Apr 14, 2026 | ACE developer kit and Agent Purchase Protection | Integrate Amex payments in agentic experiences; protection for purchases by registered AI agents. | [16][24] |
| Feb 6, 2026 | 10-K: agentic commerce as a competitive and model risk | Autonomous AI agents transacting for users could disintermediate customer relationships; AI flaws, bias and hallucinations listed among the risks. | [5] |
| Jan 20, 2026 | LLM risk-mitigation patent granted | US 12,530,174 B2, filed October 2023 by American Express Travel Related Services Company, covers generating risk-mitigation code for applications that call a network LLM service. | [25] |
| Jul 10, 2025 | Packer: agents need a control plane | At VB Transform, Packer describes internal agents such as one that reviews software pull requests, and modular 'brains' for brand, privacy, security and legal rules that agents must consult before acting. | [17] |
| May 9, 2025 | CIO describes the AI governance model | Ravi Radhakrishnan says Amex has used AI for credit and fraud for over 15 years, built a cross-functional AI council and an enablement layer over multiple models, and brought data governance and the Chief Data Office under technology. | [2] |
| Apr 2, 2025 | Packer on Amex's enterprise generative AI | CTO Hilary Packer says a council identified 500 use cases and 70 were in implementation; 9,000 engineers use GitHub Copilot, the IT chatbot (live since October 2023) resolves 40% more queries without escalation, and a travel counselor assistant serves 5,000 counselors in 19 markets. | [3] |
Does American Express have an AI policy?
Yes. Its 2026 proxy statement says it has adopted an Artificial Intelligence Risk Management Policy that covers the use of all AI systems, applies to all colleagues, products and lines of business, follows the three lines of defense, sets enterprise-level escalation to management or the board and governs third parties' use of AI. The policy text itself is not published, and no standalone set of AI principles was found.
Who oversees AI risk at American Express?
The board's Risk Committee has primary oversight of AI and GenAI risks and opportunities, including the AI governance structure, guardrails and training, per the March 2026 proxy. In management, the Enterprise Risk Management Committee, co-chaired by the CEO and chief risk officer, runs the Risk Governance Framework; a cross-functional AI council was set up for generative AI, and Jodi Richard becomes chief risk officer on January 25, 2027.
How does American Express control AI agents that shop for customers?
Two ways so far. Its Intent Intelligence Framework, published October 13, 2026, captures and authenticates what the customer told the agent to buy before the purchase, and binds the payment credential to it. On the October 23, 2026 call Stephen Squeri said Amex will take a risk-based approach and admit only agents approved through API or MCP channels.
Were the 2026 Fed and OCC actions against Amex about AI?
No. The October 8, 2026 actions concern anti-money-laundering compliance: the OCC fined American Express National Bank $350 million and cited inadequate resources, control gaps, weak testing and training, and about $13 billion of suspected trade-based money laundering reported late. Neither announcement mentions AI.
What AI risks does American Express disclose in its 10-K?
The 2025 10-K, filed February 6, 2026, warns of flawed models or datasets producing biased or inaccurate results, generative AI's hallucinatory outputs, outputs that are hard to explain, AI-enabled fraud such as synthetic voice, unsettled intellectual property rules for AI, and new AI laws including the EU AI Act and state laws in California, Colorado and Utah.
- American Express 2026 Proxy Statement (Schedule 14A)
- Ravi Radhakrishnan On Driving AI Innovation At American Express
- How Amex uses AI to increase efficiency: 40% fewer IT escalations, 85% travel assistance boost
- American Express Company Annual Report on Form 10-K for 2023
- American Express Company Annual Report on Form 10-K for 2025
- Amex introduces a framework to prevent AI agents from making unauthorized purchases
- Amex (AXP) Q3 2026 earnings call transcript (The Motley Fool)
- Federal Reserve Board announces enforcement action against American Express Company
- OCC Assesses $350 Million Civil Money Penalty Against American Express (News Release 2026-87)
- Building the Future of AI at American Express: Meet Berta Rodriguez-Hervas, SVP of Enterprise AI Platforms
- Amex nabs new risk chief
- American Express Company Quarterly Report on Form 10-Q for the quarter ended March 31, 2024
- American Express Company Annual Report on Form 10-K for 2024
- American Express Company Quarterly Report on Form 10-Q for the quarter ended March 31, 2025
- American Express Company Quarterly Report on Form 10-Q for the quarter ended September 30, 2026
- American Express Debuts Agentic Commerce Experiences (ACE)™ Developer Kit and Announces Industry-First Protection for Registered Agent Purchases
- Skip the AI 'bake-off' and build autonomous agents: Lessons from Intuit and Amex
- American Express Publishes Intent Intelligence Framework for Trusted Agentic Commerce
- Amex advises businesses on AI
- Earnings call transcript: American Express beats Q2 2026 EPS, shares fall
- American Express Company Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Generative large language model (LLM) decentralized network (US 12,632,648 B2)
- American Express (AXP) Q1 2026 earnings call transcript (The Motley Fool)
- Amex tries to 'grease the skids' for agentic commerce
- Large language model (LLM) risk mitigation (US 12,530,174 B2)
When Amex moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning