How does Fifth Third govern AI and manage AI risk?
Fifth Third governs AI through its second-line risk structure and a short set of published principles. Its 2025 Sustainability Report, published in August 2026, lists four: 'Do No Harm', 'Human Oversight' where AI influences critical decisions, 'Data Stewardship' and 'Bias and Impact Awareness'; it says the AI governance process is designed to ensure 'the responsible and effective implementation of emerging AI technologies', and that employees are trained on AI's limitations, bias recognition and responsible data management, with an Artificial Intelligence Policy Acknowledgement among required compliance modules. Model risk sits with a Model Risk Committee that reports, alongside the Technology and Information Security Governance Committee, to the Operational Risk Committee and on through the Enterprise Risk Management Committee to the board's Risk and Compliance Committee. CEO Tim Spence wrote in the 2024 annual report that the bank spent a year building its AI model risk management framework before enabling any use case. The 2025 10-K expanded the AI risk factor: AI models 'might be flawed due to improper design, implementation, or training', and 'manual oversight remains a critical component' of operational risk control. Fifth Third holds a February 2026 patent on detecting jailbreak attempts against AI systems and was invited into Anthropic's Project Glasswing in mid-2026. It has not named a board committee for AI or disclosed an AI model inventory.[1][2][3][4][5]
Data as of Oct 31, 2026 · Fifth Third profile updated Oct 19, 2026 · 17 sources cited on this page · 141 banks profiled on this site · Markdown
Who oversees AI risk at Fifth Third?
From the 10-K risk management sections, the 2024 annual report and the 2025 Sustainability Report. All are disclosures, not interviews.
| Body or role | What it does for AI | Status | Source date |
|---|---|---|---|
| Risk and Compliance Committee (board) | Top of the chain: the Operational Risk Committee reports to the Enterprise Risk Management Committee (ERMC), which reports to the board's RCC | Disclosed | February 24, 2026[2] |
| Model Risk Committee | With the Technology and Information Security Governance Committee, 'responsible for governance of information security and model risks'; reports to the Operational Risk Committee | Disclosed | February 27, 2024; February 24, 2026[6][2] |
| Model Risk Management (second line) | Part of Independent Risk Management, which develops 'enterprise frameworks and policies to govern risk-taking activities' | Disclosed | February 24, 2026[2] |
| Second line of defense | Oversees the added operational risk from emerging technologies 'such as generative models and artificial intelligence' | Disclosed | February 27, 2024; February 24, 2026[6][2] |
| AI model risk management framework | Built over a year before any AI use case was enabled, covering policies, governance and processes, per Tim Spence's 2024 letter | Disclosed | February 24, 2025[3] |
| AI governance process | 'Designed to ensure the responsible and effective implementation of emerging AI technologies throughout Fifth Third'; built on transparency, accountability, human oversight, data privacy and security | Disclosed | August 2026[1] |
| Required compliance training | 'Artificial Intelligence Policy Acknowledgement' is one of the required modules; 99.96% of employees completed all required compliance training in 2025 | Disclosed | August 2026[1] |
What has Fifth Third published or disclosed about responsible AI, and when?
| Date | Where | What it says |
|---|---|---|
| February 27, 2024 | 2023 10-K | Emerging technologies 'such as generative models and artificial intelligence may introduce additional operational risk considerations', managed with second-line oversight[6] |
| February 24, 2025 | 2024 annual report | AI work organized in five areas, the first being 'AI-enabling platforms and risk management'; AI platforms built in the bank's cloud tenant[3] |
| February 24, 2025 | 2024 10-K | AI in business processes 'may have unintended consequences due to its limitations or its failure to use them effectively'; threat actors could use AI 'for malicious purposes'[7] |
| February 17, 2026 | Patent US 12,556,388 B1 | Security framework for artificial intelligence systems, filed 2024-08-19 with Art Weston among the inventors: a bot holds a key it must never reveal, and a response judged likely to be a jailbreak attempt can end the conversation and ban the user[4] |
| February 24, 2026 | 2025 10-K | AI models 'might be flawed due to improper design, implementation, or training'; AI may come from 'third- or fourth-party service providers' and could affect internal controls; 'manual oversight remains a critical component' of risk mitigation[2] |
| April 9, 2026 | American Banker, Jay Plum | The consumer lending head: 'AI changes the nature of how you would manage risk'; AI could replace annual exam preparation with continuous 'mini reviews'[8] |
| June 10, 2026 | Morgan Stanley conference, Bryan Preston | Fifth Third was invited into Anthropic's Project Glasswing cybersecurity initiative; the CFO links it to the bank's role in the payments ecosystem[5] |
| August 2026 | 2025 Sustainability Report | Four principles: 'Do No Harm', 'Human Oversight' where AI influences critical decisions, 'Data Stewardship' and 'Bias and Impact Awareness'; employees trained on AI's 'limitations, bias recognition and responsible data management'[1] |
| August 2026 | 2025 Sustainability Report | 'Leading with Generative AI', a blended course 'designed to help managers build confidence in the responsible use of generative AI'; credit tools being developed with AI 'with human oversight'[1] |
What has Fifth Third not disclosed about AI governance?
The principles live in the sustainability report rather than a stand-alone AI policy, and the policy employees acknowledge in compliance training is not public. The 2026 proxy mentions AI once, crediting CIO Jude Schramm with 'pragmatic artificial intelligence delivery'; it names no board committee as the owner of AI risk.[1][9]
On fair lending, the 2025 report says the bank is using AI 'with human oversight' to develop tools for 'more accurate credit decisions' and to reach customers 'previously been excluded based on traditional credit scores'. It does not say which models are in production for credit, how they are validated, or how adverse-action reasons are produced.[1]
No AI-specific regulatory action against Fifth Third appears in its filings. The 2025 10-K says AI 'is under ongoing scrutiny by various governmental and regulatory bodies', and Plum told American Banker in April 2026 that AI could let banks test loans against OCC and CFPB exam manuals continuously.[2][8]
What does the Fifth Third profile record on this topic?
The rows below are the entries of the Fifth Third AI strategy profile that bear on this page, as of Oct 19, 2026; the profile holds the full record of 33 dated moves, 13 use cases and 50 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI risk-factor disclosure | 10-K: internally built and third- or fourth-party AI could significantly affect the effectiveness of internal controls; AI raises cyber-attack risk. | In production | [2] |
| Anthropic Project Glasswing access | Invited into Anthropic's cybersecurity programme in spring 2026; the CFO tied it to the bank's payments role. What the bank does with the access is not public. | Announced | [5] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Oct 1, 2026 | CMO: generative AI kept away from customers on purpose | Melissa Stevens tells The Financial Brand's podcast that Fifth Third deliberately kept generative AI away from its customers, choosing accuracy over personality, after growing Jeanie from barely 20% accuracy in its early days to the low 90s; she also discusses carrying 500,000 Comerica customers into the Fifth Third brand without breaking their trust. | [10] |
| Aug 4, 2026 | Q2 2026 10-Q: AI only in the forward-looking risk list | The filing lists 'inability to implement technology system enhancements, including the use of artificial intelligence' among factors that could change results; the Q1 10-Q (5 May) carries the same line. The detailed AI risk factors sit in the 2025 10-K. | [11][12] |
| Jun 10, 2026 | Invited into Anthropic's Project Glasswing | CFO Bryan Preston tells the Morgan Stanley U.S. Financials Conference the bank was invited in recent weeks, which he attributes to its role in payments infrastructure. | [5] |
| Apr 17, 2026 | Q1 2026 call: Plaid on Newline, tight limits on AI-infrastructure lending | Plaid launched a payment product on Newline alongside Stripe and Circle; Spence calls the tech conversion the largest transaction risk and plans three or four mock conversions; software loans are under 1% of the book and funded data-centre exposure under $100 million. | [13][14][15] |
| Apr 9, 2026 | 'AI will help banks out-code vendors' | Consumer lending head Jay Plum on eroding reliance on core providers and continuous 'mini reviews' for exams. | [8] |
| Feb 24, 2026 | 2025 10-K names AI as a technology and internal-control risk | AI may be developed internally or supplied by third- or fourth-party providers and could significantly affect internal controls; AI-enabled cyber-attacks may be harder to detect; generative AI training launched for leaders in 2025. | [2] |
| Feb 17, 2026 | Jailbreak-resistance patent granted | US 12,556,388 B1, Security framework for artificial intelligence systems: dynamically changing keys to resist attempts to bypass a model's built-in constraints; filed 19 August 2024 on a May 2024 provisional. | [4] |
| Jun 21, 2024 | Jeanie language-understanding overhaul and AI patent filings | Art Weston, director of AI transformation, says Jeanie's intent accuracy rose from about 25% to about 90% after the language-understanding algorithm (from chatbot provider LivePerson) was re-architected; Jeanie recognises 150 actions and about half were automated. He had applied for patents on the work and on gen-AI risks such as hallucination and jailbreaking. | [16] |
| Jan 19, 2016 | NICE Actimize customer due diligence selected | NICE Actimize said Fifth Third had selected its Customer Due Diligence anti-money-laundering software and Core Risk Rating Engine to automate and centrally manage customer onboarding risk assessment (vendor release; no later update found). | [17] |
Does Fifth Third have responsible AI principles?
Yes. Its 2025 Sustainability Report lists four: Do No Harm (govern AI use cases that affect customers' financial wellbeing), Human Oversight where AI influences critical decisions, Data Stewardship, and Bias and Impact Awareness. It also says the AI governance process rests on transparency, accountability, human oversight and data privacy and security. There is no separate public AI policy.
Who oversees AI risk at Fifth Third?
A Model Risk Committee and the Technology and Information Security Governance Committee report to the Operational Risk Committee, which reports through the Enterprise Risk Management Committee to the board's Risk and Compliance Committee, per the 2025 10-K. Model Risk Management sits in the second line, Independent Risk Management. No board committee is named specifically for AI.
How does Fifth Third train employees on responsible AI?
All employees must complete an Artificial Intelligence Policy Acknowledgement module in compliance training, and training covers AI's limitations, bias recognition and responsible data management. Managers can take Leading with Generative AI, a blended course on responsible use, and the 2025 10-K lists generative AI training among new development offerings.
What is Fifth Third's AI jailbreak patent?
US 12,556,388 B1, Security framework for artificial intelligence systems, published February 17, 2026 and assigned to Fifth Third Bank. It describes conversational bots that hold keys they must never reveal and an assessor that judges whether a prompt or reply is likely a jailbreak attempt, ending the conversation and banning the user if so.
What does Fifth Third say about AI risk in its 10-K?
The 2025 10-K says AI models used by Fifth Third or its providers 'might be flawed' through design, implementation or training, or produce biased outputs that are hard to spot; that AI from third- or fourth-party providers could affect internal controls; that AI faces evolving regulation; and that manual oversight remains critical to operational risk control.
- Fifth Third Bancorp 2025 Sustainability Report
- Fifth Third Bancorp Annual Report on Form 10-K for 2025
- Fifth Third Bancorp 2024 Annual Report (letter from the chairman, CEO and president; Form 10-K exhibit)
- US 12,556,388 B1: Security framework for artificial intelligence systems (assignee Fifth Third Bank NA; filed 2024-08-19)
- Fifth Third Joins Anthropic's Project Glasswing
- Fifth Third Bancorp Annual Report on Form 10-K for 2023
- Fifth Third Bancorp Annual Report on Form 10-K for 2024
- Fifth Third official: AI will help banks 'out-code' vendors
- Fifth Third Bancorp 2026 Proxy Statement (Schedule 14A)
- Fifth Third Succeeds Through Empowered Employees (undated page, retrieved 2026-10-01)
- Fifth Third Bancorp Quarterly Report on Form 10-Q for the quarter ended 30 June 2026
- Fifth Third Bancorp Quarterly Report on Form 10-Q for the quarter ended 31 March 2026
- Fifth Third (FITB) Q1 2026 Earnings Transcript
- Earnings call transcript: Fifth Third Bancorp beats EPS forecasts in Q1 2026
- Fifth Third CEO on Comerica integration: So far, so good
- Overhauling chatbots, harnessing gen AI: Art Weston, Fifth Third
- NICE Actimize CDD Solution Selected by Fifth Third Bancorp for its Customer Onboarding Risk Assessment and Powerful Risk Rating Engine
When Fifth Third moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning