How does Truist govern AI responsibly?
Truist says its AI programme is 'foundationally based on the National Institute of Standards and Technology AI Risk Management Framework Core', and that oversight of it is a regular focus of the board, the Risk Committee and the Technology Committee (2025 10-K, February 2026; 2026 proxy, March 2026). The proxy, which added an AI spotlight after shareholders raised AI in 2025 engagement meetings, says the board receives reports on AI policies and procedures, results and emerging opportunities, plus educational sessions on AI strategy and risk. The 10-K carries a dedicated AI risk factor on flawed, biased or degraded models and failing third-party AI services, and warns that AI makes fraud harder to detect and may widen the cyber-attack surface. In practice, the bank trains a challenger model alongside each production model and monitors outputs against thresholds in near real time, and every deployment needs a defined return. Chandra Kapireddy, then head of generative AI, ML and analytics, said in April 2025 that his group drives AI policy and that SR 11-7 model-risk principles still apply to generative AI. Agents are governed like staff: Hagerman's digital teammates get boundaries and corrective-action plans. Truist has no published AI principles document or named AI ethics board.[1][2][3][4][5]
Data as of Oct 16, 2026 · Truist profile updated Oct 13, 2026 · 10 sources cited on this page · 140 banks profiled on this site · Markdown
Which bodies and frameworks govern AI at Truist?
Each element as the cited document describes it.
| Element | What it says | Where | Date |
|---|---|---|---|
| NIST AI RMF Core | Truist's AI program is 'foundationally based' on the NIST AI Risk Management Framework Core, which 'enable[s] dialogue, understanding, and activities to manage AI risks and develop trustworthy AI systems' | 2025 10-K; 2026 proxy | February-March 2026[1][2] |
| Board, Risk Committee, Technology Committee | Oversight of the AI program is 'a regular focus' of the board and the joint Risk and Technology Committees of Truist Financial and Truist Bank | 2025 10-K; 2026 proxy | February-March 2026[1][2] |
| Board reporting and education | The board receives reports on AI policies and procedures, results and emerging opportunities, and educational sessions on trends, competitive impact, strategy and risk management | 2026 proxy | March 16, 2026[2] |
| Shareholder engagement | Investors raised AI in 2025 meetings; Truist added disclosure on the board's oversight of AI in response | 2026 proxy | March 16, 2026[2] |
| AI strategy and policy owner | Chandra Kapireddy's group sets AI strategy and AI policy and builds the platforms model risk management teams use | MIT Sloan Management Review | April 15, 2025[4] |
| Champion-challenger monitoring | A discovery model is trained alongside each production model; outputs are monitored against thresholds in near real time; each deployment needs a defined return on investment | American Banker | June 4, 2025[3] |
| Agent lifecycle | Digital teammates are hired, trained, promoted by success rate, put on corrective action when they exceed boundaries, and retired | American Banker | June 1, 2026[5] |
| Leader and board training | Hands-on AI training for the top 1,200 leaders plus the board; a board programme on AI ethics and governance in design | American Banker | June 1, 2026[5] |
Which AI risks does Truist name in its filings?
| Risk | What the filing says | Filing |
|---|---|---|
| Model quality and bias | AI models may be flawed, biased or degrade; outputs may be inaccurate | 2025 10-K[1] |
| Third-party AI | Third-party AI services may fail, degrade or return inaccurate outputs | 2025 10-K[1] |
| Fraud and cyber | AI makes fraud harder to detect and identity fraud likelier; AI-enabled technology may widen the attack surface through adversarial manipulation and data poisoning | 2025 10-K[1] |
| Workforce | Automation and AI 'may lead us to modify our workforce strategy', requiring more training and competition for technical talent | 2025 10-K[1] |
| AI-driven cyberattacks | Added to the forward-looking risk list in the second-quarter 2026 10-Q | Q2 2026 10-Q[6] |
What have Truist's AI leaders said about bias, hallucination and oversight?
Kapireddy: 'every GenAI model hallucinates'; the question is the degree of uncertainty. He told MIT Sloan Management Review that generative AI's flexibility makes validation harder than for a single-purpose credit model, that human oversight matters most in high-stakes decisions, and that SR 11-7 remains intact for model risk management alongside the NIST framework.[4]
Mazzaferro, then chief data, AI and analytics officer: 'I have never seen a model that has no bias, ever.' He preferred vendor fraud models trained across several banks to models trained only on Truist data.[3]
The bank's own agentic-AI patent application describes role-based access controls and selectable metadata 'for establishing guardrails for the agentic LLM'. Enterprise payments head Chris Ward said in June 2026: "It's not going to be a 'just let the agents rip' kind of thing."[7][8]
AI Call Summaries are described as 'one of Truist's earliest enterprise-scale generative AI applications approved for broad use', reflecting a commitment to 'scaling AI responsibly'. Not disclosed: a published set of AI principles, an AI ethics committee, or a count of models under review.[9]
What does the Truist profile record on this topic?
The rows below are the entries of the Truist AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 36 dated moves, 15 use cases and 41 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI risk management on the NIST AI RMF | 10-K AI risk factor on flawed, biased or degraded models and third-party AI services; the AI program is based on the NIST AI Risk Management Framework Core with board and committee oversight. | In production | [1] |
| Champion-challenger monitoring | Mazzaferro said Truist trains a discovery model alongside each production model, so that an alternative exists if the deployed one behaves badly, and monitors outputs against thresholds in near real time; every deployment needs a defined return on investment. | In production | [3] |
| AI for internal code and testing | The 2025 10-K lists using AI to increase productivity in internal code and software development and testing; open roles include an AI Agent Engineering & DevSecOps Automation Engineer. | In production | [1] |
| Qlik and Snowflake data pipeline for AI | Consumer-bank data sits in Snowflake with Qlik managing the pipelines, which the chief data officer for consumer banking said was chosen to reduce moving parts and total cost of ownership; the 10-K flags third-party AI services that may fail, degrade or return inaccurate outputs. | In production | [10][1] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Jul 31, 2026 | 10-Q adds 'AI-driven cyberattacks' to the risk list | The second-quarter 10-Q lists AI-driven cyberattacks among the forward-looking risks and keeps the ability to keep pace with AI-related products and intellectual property; the 10-K list had the AI product item but not the AI-driven cyberattack wording. | [6][1] |
| Feb 24, 2026 | 10-K: AI and the workforce, fraud and cyber risk | Beyond the AI risk factor, the 10-K says automation and AI may lead Truist to modify its workforce strategy, warns that AI makes fraud harder to detect and identity fraud likelier, and says AI-enabled technologies may widen the cyber-attack surface through adversarial manipulation and data poisoning. | [1] |
| Feb 24, 2026 | 10-K: a dedicated AI risk factor and a NIST-based AI program | The 2025 annual report lists AI use in marketing, service, code development and fraud identification, warns of flawed or biased models and failing third-party AI services, and says the AI program is based on the NIST AI Risk Management Framework under board oversight. | [1] |
Does Truist follow the NIST AI Risk Management Framework?
Yes. Both the 2025 10-K and the 2026 proxy say Truist's AI program is 'foundationally based on the National Institute of Standards and Technology AI Risk Management Framework Core'. Its cybersecurity framework separately builds on the Cyber Risk Institute profile of the NIST Cybersecurity Framework.
Who oversees AI at Truist's board?
The full board, the Risk Committee and the Technology Committee, which are joint committees of Truist Financial and Truist Bank. Per the 2026 proxy, the board receives reports on AI policies and procedures, results and opportunities, and attends educational sessions on AI trends, strategy and risk management.
What AI risks does Truist disclose?
The 2025 10-K names flawed, biased or degrading models, failing third-party AI services, AI-enabled fraud and identity fraud, a wider cyber-attack surface through adversarial manipulation and data poisoning, and possible changes to its workforce strategy. The Q2 2026 10-Q added 'AI-driven cyberattacks' to its forward-looking risks.
How does Truist control model risk in AI?
Truist trains a challenger model alongside each production model so that an alternative exists if the deployed one misbehaves, monitors outputs against thresholds in near real time and requires a defined return on investment for each deployment. Its head of generative AI said in April 2025 that SR 11-7 still governs model risk.
Does Truist have AI ethics principles?
Truist has not published a standalone set of AI principles or named an AI ethics board. It describes its approach through the NIST-based AI program in its filings, board oversight in the proxy, and, per CIO Steve Hagerman, a board programme on AI ethics and governance that was in design in June 2026.
- Annual Report on Form 10-K for the fiscal year ended December 31, 2025
- Truist Financial Corporation 2026 Proxy Statement (Schedule 14A)
- How Truist and Western Alliance deploy AI to fight fraud
- Overcoming AI Hallucinations: Truist's Chandra Kapireddy (Me, Myself, and AI podcast)
- Steve Hagerman's agentic vision for Truist's future
- Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- US 2026/0095461 A1: Role-based access control systems for controlling access to a customized knowledge domain for secure agentic AI model development (assignee Truist Bank)
- Banks aren't ready for AI agents moving money, experts warn
- Truist advances AI to create more meaningful client interactions
- Qlik and Truist Bank's relationship is a roadmap for modernizing finance
When Truist moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning