How does Citizens Financial Group govern AI and manage AI risk?
Citizens governs AI through its Enterprise-wide Risk Management Governance Framework (ERMGF) and a management AI Council rather than a stand-alone AI charter. Its 2025 Sustainability & Impact Report, published in June 2026, says a Generative AI Risk Management Policy is in place and that the AI Council, a cross-functional group of senior leaders, evaluates every AI use case on feasibility, business value and risk; 'only approved use cases and tools may be used for business purposes or on company equipment'. On the board, the Risk Committee oversees AI-related risk under the ERMGF, the 2026 proxy gave the Audit Committee oversight of AI adoption in its areas, and the Compensation and HR Committee looks at technology's effect on the workforce. The board's stated aim, the same in the 2025 and 2026 proxies, is 'a measured approach to AI' with guardrails; directors were trained on generative AI in 2024 and on AI and generative AI in 2025. The bank started slowly: vice chair Beth Johnson said in October 2023 that it had turned off ChatGPT on its network and that the second-line model governance lead also runs its responsible AI practice, and CIO Michael Ruttledge said in July 2024 that a human stays in the loop and nothing had yet gone direct to consumers. About 90% of colleagues completed core GenAI training by year-end 2025. Citizens has not published separate AI principles or an inventory of its AI models.[1][2][3][4][5]
Data as of Oct 31, 2026 · Citizens profile updated Oct 13, 2026 · 11 sources cited on this page · 141 banks profiled on this site · Markdown
Who oversees AI at Citizens, from the board down?
'Disclosed' means it is in a proxy, 10-K or the sustainability report; 'Stated' means a named executive said it; 'Reported' means a publication described it.
| Body or role | What it does for AI | Status | Source date |
|---|---|---|---|
| Full board | Applies 'a measured approach to AI' within 'a foundational governance structure that provides appropriate guardrails'; takes AI education sessions from external and industry experts and gets regular updates through business presentations and risk reporting | Disclosed | March 10, 2025; March 9, 2026[2][3] |
| Risk Committee (board) | Oversees management of AI-related risk under the ERMGF, the Enterprise-wide Risk Management Governance Framework | Disclosed | March 10, 2025; March 9, 2026[2][3] |
| Audit Committee (board) | Oversees 'the adoption and usage of AI to support critical business areas under its purview'; the role first appears in the 2026 proxy | Disclosed | March 9, 2026[3] |
| Compensation and HR Committee | Considers 'how the latest technology trends impact the modern workforce' | Disclosed | March 10, 2025; March 9, 2026[2][3] |
| AI Council | Cross-functional working group of senior leaders: sets strategic direction for all AI initiatives, evaluates every use case on feasibility, business value and risk; 'only approved use cases and tools may be used for business purposes or on company equipment' | Disclosed | June 24, 2026[1] |
| Generative AI Risk Management Policy | Establishes 'a consistent framework to ensure effective and responsible AI adoption' | Disclosed | June 24, 2026[1] |
| Model governance lead (second line) | Leads model governance in the risk organization and also leads the responsible AI practice 'to act as a check and balance' against development teams, per vice chair Beth Johnson | Stated | October 2023[4] |
| Model Risk Management and Validation team | Independent model review and validation; 'challenges the assumptions used and quantitative techniques employed' | Disclosed | February 12, 2026[6] |
| Steering committee for generative AI | Set up so that employees are not 'going rogue and developing their own projects', in Fortune's description | Reported | May 29, 2024[7] |
What has Citizens said or disclosed about responsible AI, and when?
| Date | Where | What it says |
|---|---|---|
| October 2023 | American Banker podcast, Beth Johnson | Citizens turned off ChatGPT on its network and set up a task force of data scientists, technology, cybersecurity, model governance and HR staff that identified more than 90 use cases; bias testing is one reason it 'would not go straight to things like underwriting practices'[4] |
| May 29, 2024 | Fortune, Michael Ruttledge | More than 90 generative AI use cases explored, two in production; the customer-service tool stays internal while the bank tests answers and watches for hallucinations: 'we don't feel that we're ready to go out directly to a customer'[7] |
| June 2024 | Bernstein conference, Bruce Van Saun | 'You have to walk before you run'; Citizens is 'putting the policies and the governance in place to make sure that we're using the tool appropriately and we're protecting data appropriately'[8] |
| July 26, 2024 | Banking Dive, Michael Ruttledge | Guardrails, security and governance came first; 'we have the human in the loop', with someone validating code before production and answers before customers get them; 'We haven't done anything yet direct to consumer'[5] |
| February 13, 2025 | 2024 10-K | Names 'Generative Artificial Intelligence and Large Language Models' among evolving technologies that 'present a significant information security risk'; says the bank continues to experiment with and deploy ML and AI/Gen AI across customer-facing businesses[9] |
| March 10, 2025 | 2025 proxy statement | An 'Artificial Intelligence Oversight' section: the bank pursues 'the responsible and ethical use of artificial intelligence' through the ERMGF; 2024 director training covered generative AI; the 2024 scorecard cites risk framework and policies supporting 'the use of generative AI'[2] |
| June 16, 2025 | 2024 Sustainability & Impact Report | Repeats the board's AI oversight language; 2024 director training covered generative AI; the job application process was 'transformed' using AI[10] |
| March 9, 2026 | 2026 proxy statement | Adds the Audit Committee's oversight of AI adoption; 2025 director training covered 'artificial intelligence and generative artificial intelligence'[3] |
| June 24, 2026 | 2025 Sustainability & Impact Report | Describes the Generative AI Risk Management Policy and the AI Council; guardrails include 'human safeguards, protection of customer and colleague data, and upholding privacy commitments'; approximately 90% of colleagues completed core GenAI training as of 2025 year-end[1] |
| July 30, 2026 | American Banker panel, Krish Swamy | Some models are hosted inside Citizens' cloud VPC, 'so nothing goes out of the VPC, out of the firewall'; a public-private explainability work stream produced the 'data nutrition label' concept for what goes into an AI system[11] |
What has Citizens not disclosed about AI governance?
Citizens has not published a stand-alone set of AI principles: its disclosures place AI inside the ERMGF and the Generative AI Risk Management Policy, whose text is not public. It has not given a count of AI models or use cases in production since 2024, when Fortune reported more than 90 explored and two live, and it reports no AI-specific board metrics.[1][7]
The 10-K's AI risk language is brief. The 2024 and 2025 reports name generative AI and large language models as a security risk and say AI changes 'could have a transformative effect on the way banks offer products and services'; they do not discuss model bias or explainability, which the bank has addressed only in interviews.[9][6][4]
The board language has barely changed: the 2025 and 2026 proxies use the same 'measured approach to AI' wording, and the one addition in 2026 is the Audit Committee's role. Read in order, the record runs from a 2023 task force and ChatGPT block, to a 2024 steering committee with human review, to the policy and AI Council described in the June 2026 report.[2][3][4][7][1]
What does the Citizens profile record on this topic?
The rows below are the entries of the Citizens AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 35 dated moves, 20 use cases and 50 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI in the 10-K risk factors | Generative AI and LLMs as an information-security risk; AI as a potentially transformative competitive change. | In production | [6] |
| Models hosted inside the bank's VPC | For some use cases Citizens runs models in its own cloud network so nothing leaves its firewall, trading engineering effort for control. | In production | [11] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Jul 30, 2026 | CDAO Swamy: LLMs as a translator for customer intent; models inside the bank's VPC | On an American Banker panel Krish Swamy said LLMs map what callers say to a small set of intents, that some models run inside Citizens' own VPC, that chatbots answer questions but do not yet execute transactions, and that commercial underwriters share a Copilot prompt library. | [11] |
| Mar 9, 2026 | Proxy: Board oversees a 'measured approach to AI' | The DEF 14A says the Board ensures a measured approach to AI within a governance structure with guardrails, that AI-related risk is managed under the enterprise risk framework, and that directors received AI and generative AI training in 2025. | [3] |
| Feb 12, 2026 | 10-K flags generative AI and LLMs as a security risk | Risk factors name generative AI and large language models among evolving threats, and AI as a change that could transform how banks offer products. | [6] |
| Jun 4, 2024 | Van Saun: 'you have to walk before you run' with AI | At a Bernstein conference the CEO said Citizens was putting policies and governance in place first, called customer bots 'pretty advanced', and named code assistance and fraud detection as other targets. | [8] |
Does Citizens have responsible AI principles?
Not as a separate published document. Citizens says it pursues 'the responsible and ethical use of artificial intelligence' through its Enterprise-wide Risk Management Governance Framework, and its 2025 Sustainability & Impact Report says a Generative AI Risk Management Policy is in place. The policy's text has not been published.
Who oversees AI risk at Citizens?
The board's Risk Committee oversees AI-related risk under the ERMGF; since the 2026 proxy the Audit Committee also oversees AI adoption in the areas it covers, and the Compensation and HR Committee considers technology's effect on the workforce. In management, the AI Council approves use cases, and a second-line model governance lead runs the responsible AI practice.
What is the Citizens AI Council?
A cross-functional working group of senior leaders that sets direction for all AI initiatives, checks that AI is used ethically and securely, promotes education and evaluates every AI use case on feasibility, business value and risk. Only use cases and tools it approves may be used for business purposes or on company equipment, per the 2025 Sustainability & Impact Report.
Does Citizens keep a human in the loop on AI?
Yes, by its own account. CIO Michael Ruttledge said in July 2024 that someone validates AI-written code before production and checks AI answers before customers receive them, and the 2025 report lists 'human safeguards' among its AI guardrails. Its CiZi app assistant, launched in November 2024, answers customers directly.
How does Citizens protect customer data in AI tools?
The 2025 report lists protection of customer and colleague data and privacy commitments among its guardrails. Chief Data and Analytics Officer Krish Swamy said in July 2026 that, for some use cases, models are hosted inside the bank's cloud VPC so that nothing leaves its firewall; other use cases call frontier models.
- 2025 Sustainability & Impact Report (Artificial Intelligence Oversight; Building the Workforce of the Future)
- Citizens Financial Group, Inc. Definitive Proxy Statement (Schedule 14A) for 2025
- Citizens Financial Group, Inc. Definitive Proxy Statement (Schedule 14A) for 2026
- Citizens' plans for using generative AI ethically: Beth Johnson (American Banker Podcast)
- Citizens CIO: 'Human in the loop' still key for banks using genAI
- Citizens Financial Group, Inc. Annual Report on Form 10-K for 2025
- This bank tested 90 uses for AI before choosing the top 2—and they benefit customer service and productivity
- Citizens CEO: 'You have to walk before you can run' with AI
- Citizens Financial Group, Inc. Annual Report on Form 10-K for 2024
- 2024 Sustainability & Impact Report
- The AI-Enabled Bank: Reimagining Retail Banking from Branch to Mobile
When Citizens moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning