How does Bank of America govern responsible AI?
Bank of America governs AI project by project. CTIO Hari Gopalkrishnan said at Fortune's AIQ Summit on October 1, 2026 that every implementation is evaluated across 16 risk dimensions, including privacy, bias, workforce implications and intellectual property, with continuous guardrails and monitoring; he cited a fraud model that disadvantages demographic groups, or a chatbot that fails customers with particular accents, as the risks in view. The bank's stated posture since April 2025 is 'human oversight, transparency, and accountability for all outcomes', and Gopalkrishnan has said it has 'zero tolerance for things like hallucinations, bias'. The 2025 10-K, filed February 25, 2026, names autonomous AI agents and third-party AI services with limited visibility into training data as risks. On agents, Moynihan said on September 14, 2026 of agents 'just left to operate': 'We just don't do that'; in October he said the bank is working with the AI industry to argue for human authorization of agent payments; with five peer banks it published principles for trusted agentic commerce on September 22, 2026. The year's hardest test was security: 1,000 contractors were added to patch flaws exposed by Anthropic's Mythos.[1][2][3][4][5][6][7][8][9]
Data as of Oct 16, 2026 · BofA profile updated Oct 13, 2026 · 19 sources cited on this page · 140 banks profiled on this site · Markdown
What principles and review process does Bank of America apply to AI?
| Item | What it says | Who | Date |
|---|---|---|---|
| Oversight principle | 'Human oversight, transparency, and accountability for all outcomes' | Bank of America | April 1, 2025[3] |
| 16 risk dimensions | Every AI implementation evaluated on 16 dimensions including privacy, bias, workforce implications and intellectual property; guardrails, evaluation and monitoring continue after launch | Hari Gopalkrishnan, CTIO | October 1-2, 2026[1][2] |
| Use AI only where needed | 'One of the biggest mistakes we see is rushing to AI as a solution when deterministic models can do the job just as well' | Gopalkrishnan | October 2, 2026[1] |
| Accuracy bar | 'We have zero tolerance for things like hallucinations, bias' | Gopalkrishnan | June 1, 2026[4] |
| Data quality | 'The data has to be perfect'; accuracy over efficiency and cost savings | Brian Moynihan, CEO | June 8, 2026[10] |
| Governance as a driver | Governance is one of four AI strategy drivers: 'If you overdo it, you stall innovation. If you underdo it, you introduce a lot of risk' | Gopalkrishnan | April 15, 2026[11] |
| Cross-border governance | Governance needs constant investment to stay compliant with 'whatever is asked for in each of these jurisdictions' | Bernard Mensah, president of International | November 12, 2025[12] |
What has Bank of America disclosed or said about AI risks and agents?
| Item | What it says | Who | Date |
|---|---|---|---|
| 10-K risk factor | Expanded use of AI 'including emerging third-party AI services and autonomous AI agents' may bring data risk, unpredictable system interactions and AI failure; third-party models give limited visibility into training data | 2025 Form 10-K | February 25, 2026[5] |
| 10-Q forward-looking risk | Lists the ability to achieve expected benefits, such as productivity and cost savings, from AI | Q2 2026 Form 10-Q | July 31, 2026[13] |
| Agents left to operate | 'This weekend was a lot about the risk in AI, and that largely is around agents just left to operate. We just don't do that.' | Moynihan | September 14, 2026[6] |
| Assistive agents | 'So much juice to be squeezed right now with assistive agents that are actually working with humans in the loop' | Gopalkrishnan | October 1, 2026[2] |
| Agentic commerce principles | With ASB, Capital One, Commonwealth Bank, ING and NatWest: transparency, safety, privacy and data, choice, interoperability; disclosure when an agent is in a transaction | Bank of America and peers | September 22, 2026[8][14] |
| Human payment authorization | Working with the AI industry to argue for human payment authorization until agent capabilities develop further | Moynihan, reported by The Verge | October 15, 2026[7] |
| Frontier-model security | 'That risk is real risk'; 1,000 contractors added to 3,000 staff to patch flaws exposed by Mythos; remediation and AML costs 'a couple hundred million plus' in Q3 | Moynihan | October 14, 2026[9][15] |
| Mythos warning | 'It is a big change in the amount of work that will have to go on and the pace of which these tools will affect vulnerabilities in your systems' | Moynihan | July 16, 2026[16] |
What has Bank of America not disclosed about AI governance?
The bank has not published a standalone responsible-AI principles document or the list of its 16 risk dimensions beyond the examples Gopalkrishnan gave. The examples he named, fraud models that disadvantage demographic groups and chatbots that underserve accented speakers, are the bias cases it says the review looks for.[1]
No model inventory, bias-testing results or incident statistics are public; the 10-K refers to internal AI governance frameworks without detail. The October 2026 Treasury, FinCEN and OCC AML penalties of $1.21 billion concern Bank Secrecy Act controls; the releases do not mention AI.[5][17][18]
What does the BofA profile record on this topic?
The rows below are the entries of the Bank of America AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 45 dated moves, 18 use cases and 68 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Frontier-model testing | Part of Anthropic's Glasswing programme from the start; testing Mythos internally, per Reuters sources. | Pilot | [19] |
| AI risk factors and model governance | The 10-K covers autonomous AI agents, third-party AI models with limited visibility into training data, inaccurate outputs and bias, and says models may be ineffective if AI applications 'are not developed and trained properly or contain biases'. | In production | [5] |
| Sixteen-pillar AI project review | Every AI project is reviewed against 16 risk pillars including privacy, bias, workforce impact and intellectual property; the CTIO says the bank often decides against AI where rules or an app are enough. | In production | [2] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Oct 1, 2026 | CTIO at Fortune AIQ Summit: Orchestra routes work to open-weight or proprietary models | Gopalkrishnan says AI is often rejected in favour of deterministic rules, every project is reviewed against 16 risk pillars, simple classification runs on approved open-weight models on the bank's own GPUs, and agents stay assistive with humans in the loop. He gives Erica's total as 3.6 billion interactions. | [2] |
| Sep 22, 2026 | Principles for AI shopping agents | With NatWest, ING, Capital One, ASB and Commonwealth Bank, the bank warns AI shopping agents raise scam, fraud and data-privacy risks and proposes disclosure when an agent is in a transaction. | [14] |
| Sep 14, 2026 | Moynihan on agent risk: 'we just don't do that' | After a weekend of public alarm over autonomous AI agents, the CEO says the bank keeps agents under control rather than 'left to operate'. | [6] |
| Jul 31, 2026 | Q2 2026 10-Q: AI benefits listed as a forward-looking risk | The forward-looking-statements list cites 'the ability to achieve expected or potential benefits, such as increased productivity and cost savings' from artificial intelligence; the Q1 10-Q wording was 'potential benefits'. | [13] |
| Jul 16, 2026 | Moynihan on Mythos: 'a big change' | The CEO joins bank chiefs warning that frontier models such as Anthropic's Mythos change how fast system vulnerabilities must be fixed. | [16] |
| Feb 25, 2026 | 2025 10-K: autonomous AI agents and third-party models as risks | The annual report says expanded use of AI, 'including emerging third-party AI services and autonomous AI agents', may bring data risk, unpredictable system interactions and AI failure, and notes internal AI governance frameworks. | [5] |
How does Bank of America review AI projects for risk?
CTIO Hari Gopalkrishnan said in October 2026 that every AI implementation is evaluated across 16 risk dimensions, including privacy, bias, workforce implications and intellectual property, and that guardrails, evaluation and monitoring continue after deployment. He said the bank often chooses deterministic rules instead of AI.
What does Bank of America's 10-K say about AI?
The 2025 Form 10-K, filed February 25, 2026, says expanded use of AI, including emerging third-party AI services and autonomous AI agents, may bring data risk, unpredictable system interactions and AI failure, notes limited visibility into third-party models' training data, and refers to internal AI governance frameworks.
Will Bank of America let AI agents make payments?
Not without people. Of agents 'just left to operate', Moynihan said in September 2026 'We just don't do that', and in October said the bank is working with the AI industry to argue for human authorization of agent payments. With five peer banks it published agentic-commerce principles calling for disclosure when an agent is in a transaction.
How did Anthropic's Mythos affect Bank of America?
The bank was in Anthropic's Glasswing program from the start and tested Mythos internally, per Reuters. Moynihan said in October 2026 that it added 1,000 contractors to 3,000 staff in the second quarter to patch internal and vendor software flaws that frontier models exposed, and expects remediation costs to decline.
- Bank of America and S&P Global on why AI success starts with governance and data
- AI in regulated industries: BofA and S&P on the huge gains to be had, and the risks of rushing in
- AI Adoption by BofA's Global Workforce Improves Productivity, Client Service
- Bank of America's CTO champions a disciplined approach to AI
- Bank of America Corporation Annual Report on Form 10-K for the year ended December 31, 2025
- BofA and PNC respond to rising AI fears
- Bank of America wants a human in the loop.
- Global Banks Collaborate on Principles for Trusted Agentic Commerce
- Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos
- 'The data has to be perfect': BofA CEO Moynihan on AI
- Bank of America tech chief shares AI strategy focus
- Bank of America runs 270 AI models across operations
- Bank of America Corporation Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Banks warn AI shopping bots raise scam, fraud and data-privacy risks
- Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
- BofA's Moynihan Joins Bank CEOs Warning About Mythos AI Risks
- U.S. Treasury Announces Record Enforcement Actions Against Bank of America
- OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance
- Banking industry scrambles for Anthropic's Mythos as global regulators review risks
When BofA moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning