How does BNY govern AI responsibly?
BNY has published a Commitment to the Responsible, Ethical Use of Data and AI (first in 2024) that rests on five principles: accountability and responsibility; transparency and explainability; privacy and security; fairness and accuracy; and lawful and ethical use. It says the approach is informed by NIST's AI Risk Management Framework and its 'longstanding' membership of the Monetary Authority of Singapore's Veritas consortium. AI governance draws on Legal, Privacy, Responsible AI, Data Governance, Information Security, Resiliency, Risk and Compliance across the AI lifecycle. In practice an agent passes a 16-step path of review boards, compliance gates and model-risk evaluations, with a data use review board, an AI release board and an Enterprise AI Council, and BNY says all its AI tools pass this governance before going live. The 2025 10-K places AI use cases, including large language models, inside model risk management and a cross-functional AI risk framework; the Q2 2026 10-Q says AI has enhanced threat actors' ability to find unknown vulnerabilities. CEO Robin Vince, an OpenAI board member, said in September 2026 that alignment and chain-of-thought monitoring must keep pace with model capability.[1][2][3][4][5][6][7][8][9]
Data as of Oct 16, 2026 · BNY profile updated Oct 13, 2026 · 18 sources cited on this page · 140 banks profiled on this site · Markdown
What are BNY's responsible AI principles?
From BNY's Commitment to the Responsible, Ethical Use of Data and AI.
| Principle | What BNY commits to |
|---|---|
| Accountability and responsibility | Governance and accountability structures including approval processes, risk management and model review; a lifecycle approach from research through monitoring; employee training[1] |
| Transparency and explainability | Explain in plain language how information is used; operate AI with appropriate human oversight so decisions are 'explainable and justifiable'[1] |
| Privacy and security | 'Privacy and security by design'; process personal information only where authorized; avoid new vulnerabilities from untested AI security tools[1] |
| Fairness and accuracy | Identify and mitigate unfair biases across data and AI lifecycles; operate models accurate for their intended purpose[1] |
| Lawful and ethical | Comply with laws, regulations and the data ethics policy, taking account of reputational risk; align AI with BNY's strategy, principles and code of conduct[1] |
| External anchors | NIST AI Risk Management Framework; membership of MAS's Veritas consortium; the commitment sits at the top of BNY's wider Data Ethics framework[1] |
How does BNY review and supervise AI before and after it goes live?
| Mechanism | What it does | Source context |
|---|---|---|
| Multidisciplinary governance | Legal, Privacy, Responsible AI, Data Governance, Information Security, Resiliency, Risk and Compliance operate governance across the AI lifecycle | BNY AI page[3] |
| 16-step review path | Review boards, compliance gates and model-risk evaluations from idea to working agent | Microsoft WorkLab; PYMNTS[4][10] |
| Boards and councils | Data use review board, AI release board and Enterprise AI Council; the deputy general counsel calls governance 'an enabler' | OpenAI case study[5] |
| Pre-launch gate | 'All BNY AI tools pass through a rigorous governance process before going live' | BNY fund operations insight[6] |
| Human supervision of agents | Every digital employee has a human manager; drafts are reviewed before they go out | PYMNTS; Fortune[10][11] |
| Model risk management | Model inventory and independent validation extended to AI use cases including LLMs, within a cross-functional AI risk framework | 2025 10-K[7] |
| Sensitive data | Avoids training models on personal information; where it does, uses an encrypted 'walled garden' with red-team testing | Fortune[12] |
| Cyber risk disclosure | AI has enhanced threat actors' capability to identify and exploit previously unidentified vulnerabilities | Q2 2026 10-Q[8] |
What has BNY's leadership said publicly about AI safety?
Robin Vince told Northeastern University in September 2026 that model capability has advanced faster than alignment training and chain-of-thought monitoring: 'What we don't want is models being great, unaligned with our values, and not telling us what they're doing.' He also said the AI industry 'has done a very poor job' of advocating for the technology's benefits and how safety is addressed.[9]
Russell's stated rule for engineering is that 'Resiliency and cybersecurity are job one', and the CFO said in January 2026 that BNY still spends more on cyber resiliency than on AI. In April 2026 BNY gained early access to OpenAI's GPT-5.4-Cyber and Anthropic's Mythos for defensive testing.[13][14][15]
What is not public: an external audit of BNY's AI governance, the number of AI use cases rejected by its review boards, or a named chief responsible-AI officer.[3][1]
What does the BNY profile record on this topic?
The rows below are the entries of the BNY AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 38 dated moves, 14 use cases and 56 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Community-bank AI training | Free AI and cyber training for 1,000 community-bank executives, led by senior BNY leaders. | In production | [16] |
| Model risk management for AI and LLMs | An active model inventory and independent validation extended to AI use cases, including large language models, within a cross-functional AI risk framework. | In production | [7] |
| Frontier cyber-model testing | Early access to OpenAI GPT-5.4-Cyber and Anthropic Mythos for defensive testing; digital employees also find and fix code vulnerabilities. | Pilot | [15][17] |
| Walled-garden training for sensitive data | BNY avoids training models on personal information; where it does, it uses an encrypted 'walled garden' with red-team testing. | In production | [12] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Jul 31, 2026 | Q2 10-Q: AI enhances cyber threats | The quarterly report says recent advancements in artificial intelligence have enhanced threat actors' capability to identify and potentially exploit previously unidentified cybersecurity vulnerabilities, and lists AI among the forward-looking topics alongside the transition to a platforms operating model. | [8] |
| Apr 16, 2026 | Early access to OpenAI and Anthropic cyber models | Axios reports BNY is among the firms testing GPT-5.4-Cyber and Anthropic's Mythos after Treasury Secretary Bessent and Fed Chair Powell convened bank CEOs on AI-enabled attack risk; Vince says the labs want real-world feedback. | [15] |
| Feb 25, 2026 | 10-K: AI inside model risk management | Model risk management covers AI use cases including large language models and sits within a cross-functional AI risk framework; a dedicated risk factor covers the development and use of AI. | [7] |
| Jan 13, 2026 | FY2025 scorecard: 99% of staff on Eliza, 160 solutions, 134 digital employees | The fourth-quarter deck adds more than 60 AI-related patent applications; on the call the CFO says BNY still spends more on cyber resiliency than on AI. | [18][14] |
Does BNY have published AI principles?
Yes. BNY's Commitment to the Responsible, Ethical Use of Data and AI, first published in 2024, sets five principles: accountability and responsibility, transparency and explainability, privacy and security, fairness and accuracy, and lawful and ethical use. It cites NIST's AI Risk Management Framework and the MAS Veritas consortium as influences.
How does BNY approve an AI agent?
According to Microsoft's May 2026 profile, an agent passes 16 steps of review boards, compliance gates and model-risk evaluations before it works. OpenAI's case study names a data use review board, an AI release board and an Enterprise AI Council, and BNY says all AI tools pass its governance process before going live.
What does BNY's 10-K say about AI risk?
The 2025 Form 10-K says model risk management, including an active model inventory and independent validation, covers AI use cases including large language models within a cross-functional AI risk framework, and includes a risk factor on the development and use of AI. The Q2 2026 10-Q adds that AI has enhanced cyber threat actors' capabilities.
What is BNY's position on AI safety?
CEO Robin Vince, who sits on OpenAI's boards, said in September 2026 that model capability, alignment and chain-of-thought monitoring should advance roughly in lockstep, and that 'what we don't want is models being great, unaligned with our values, and not telling us what they're doing'.
- Our Commitment to the Responsible, Ethical Use of Data and AI
- Unlocking AI Growth in Financial Services
- Artificial Intelligence (BNY technology and innovation)
- The making of a Frontier Firm: How AI is redesigning work at BNY
- BNY builds 'AI for everyone, everywhere' with OpenAI
- AI in Fund Operations - The Next Chapter
- Annual Report on Form 10-K for 2025, Exhibit 13.1 (financial section and risk factors)
- Quarterly Report on Form 10-Q for the period ended June 30, 2026
- Another Hamilton is bringing BNY into the AI future
- Banks Put AI Agents Through Performance Reviews
- Your AI agent can be a teammate. But it still needs a boss
- Banking on AI: Firms such as BNY balance high risk with the potential for transformative tech
- Engineering The Backbone Of Global Markets At BNY
- BNY Mellon (BK) Q4 2025 Earnings Call Transcript
- BNY gets access to OpenAI, Anthropic advanced cyber models
- 'These players matter': BNY embraces role on small lenders' AI journey
- The Most Powerful Women in Banking Women to Watch, #18, Leigh-Ann Russell, BNY
- Exhibit 99.3: Quarterly Update Presentation, 4Q 2025 (Form 8-K)
When BNY moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning