How does U.S. Bank govern AI and manage AI risk?
U.S. Bancorp governs AI through board committees and a central review process rather than a published AI policy. In 2024 the Cybersecurity and Technology Subcommittee of the board's Risk Management Committee added oversight of 'emerging technologies (including Artificial Intelligence and Machine Learning)', per the 2025 proxy, and from January 1, 2026 the board created a standalone Technology Committee, citing technologies 'such as artificial intelligence', while the Risk Management Committee keeps oversight of technology risk. In management, chief AI officer Prashant Mehrotra, in the role since mid-2025, says the bank must be 'responsible by design', bringing risk, cybersecurity and other functions into AI development so that 'compliance and responsibility' are built into products, and runs a governance body that reviews all use cases 'through a common lens'. The 10-K has flagged since its 2023 edition that AI algorithms and datasets may be 'flawed or insufficient or contain biased information' and are 'not always transparent'; the 2025 10-K adds algorithmic bias and 'the need for greater explainability'. CEO Gunjan Kedia said on October 15, 2026 that the bank is 'more measured' on client-facing AI because of privacy and customer-confidence concerns. Mehrotra says the bank balances proprietary and open-source models with OpenAI, Anthropic and Google so it is not 'stuck with one' and can protect confidential data. U.S. Bank has not published AI principles, a responsible-AI team or results of bias testing.[1][2][3][4][5][6][7]
Data as of Oct 31, 2026 · U.S. Bank profile updated Oct 16, 2026 · 14 sources cited on this page · 141 banks profiled on this site · Markdown
Who oversees AI at U.S. Bank, from the board down?
'Disclosed' is from an SEC filing; 'Stated' is a named executive.
| Body or role | What it does for AI | Status | Source date |
|---|---|---|---|
| Cybersecurity and Technology Subcommittee (Risk Management Committee) | Added oversight of emerging technologies, including AI and machine learning, that may affect technology strategy and operations, consistent with reporting it received in 2024 | Disclosed | March 5, 2025[1] |
| Technology Committee (board level) | Created effective January 1, 2026 'recognizing... the importance of technology, including... technologies such as artificial intelligence'; oversees technology strategy, modernization and transformation, with a focus on cybersecurity technology strategy; chaired by Yusuf Mehdi of Microsoft | Disclosed | March 10, 2026[2] |
| Risk Management Committee | Keeps 'holistic oversight' of financial, non-financial and emerging risks, including technology risk, cybersecurity and resiliency; now also oversees fair lending risk | Disclosed | March 10, 2026[2] |
| Chief AI officer | Prashant Mehrotra, EVP; his 'four E's' are evangelize, educate, enable and execute; education includes 'What's the right way of using it responsibly?' | Stated | May 2026; July 30, 2026[8][3] |
| Use-case governance body | Reviews all use cases 'through a common lens'; ideas are sorted into growth drivers, cost savings and unmeasurable productivity, with priority to the first two; a central team federating out, with reuse required | Stated | July 30, 2026[3] |
| Responsible by design | Risk, cybersecurity and other functions are brought into the process so 'compliance and responsibility' are built into AI products; agents need redesigned processes, permissions, security and audit trails | Stated | September 2, 2026[4] |
| Model risk management | AI and machine-learning models bring 'the potential for algorithmic bias, and the need for greater explainability in interpreting model decisions', per the 10-K's model risk discussion | Disclosed | February 23, 2026[6] |
What has U.S. Bank disclosed about AI risk, and when?
| Date | Item | What it says |
|---|---|---|
| February 20, 2024 | 2023 10-K | AI and machine learning 'subject to risks that algorithms and datasets are flawed or may be insufficient or contain biased information', and the models 'are not always transparent'; AI deepfakes could aid social engineering[5] |
| February 21, 2025 | 2024 10-K | AI is used for customer service, marketing, code development and testing, and to 'automate certain business decisions and risk management practices, such as fraud identification'; complying with 'existing and new AI and data usage laws' could raise costs[9] |
| February 23, 2026 | 2025 10-K | AI-driven attacks can 'automate large-scale attacks, identify system vulnerabilities faster' and create deepfakes; new technologies 'will continue to require' substantial expense[6] |
| July 30, 2026 | Chief AI officer interview | 'We have never been into token maxing'; models matched to the right data subset and expected outcome to limit 'work slop'; AI being applied in risk processes[3] |
| October 15, 2026 | Q3 2026 call | Kedia: capability built to 'swap out models for cheaper models'; 'more measured' on client-facing applications given privacy and customer-confidence concerns[7] |
What has U.S. Bank not disclosed about responsible AI?
There is no published set of AI principles, no named responsible-AI team and no bias or fairness testing results for AI models; the 10-K describes the risks of bias and opacity without describing the controls applied to them beyond the model risk framework.[6][4]
The bank's caution is stated for customers rather than employees: Kedia's 'more measured' comment covers client-facing applications, while internal tools such as coding agents (GitHub Copilot, Cognition and Claude Code) and an agentic software layer are already in use.[7][3][10]
What does the U.S. Bank profile record on this topic?
The rows below are the entries of the U.S. Bank AI strategy profile that bear on this page, as of Oct 16, 2026; the profile holds the full record of 34 dated moves, 18 use cases and 51 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI and machine-learning model risk (10-K) | Models built on AI or machine learning bring 'the potential for algorithmic bias, and the need for greater explainability'; flawed or biased datasets named as a risk. | In production | [6] |
| Mastercard Agent Pay | U.S. Bank cardholders were enabled for agent-initiated payments on Mastercard's agentic tokens in September 2025. | In production | [11] |
| Persona-based AI training and use-case governance | Role-specific training for 70,000 employees; a governance body reviews every use case through a common lens and ideas are sorted into growth, cost-saving and unmeasured productivity buckets. | In production | [4][3] |
| AI-enabled attack risk (10-K) | The 10-K says AI lets attackers automate large-scale attacks and find vulnerabilities faster, and that AI raises identity-theft and authentication-bypass fraud risk. | In production | [6] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Sep 2, 2026 | The six-action playbook | Pick the right work, define outcomes, productize and reuse, invest in skills, scale responsibly, prepare for agents. | [4] |
| Aug 6, 2026 | Q2 2026 Form 10-Q has no AI language | A search of the filing, like the Q1 10-Q filed on 4 May, finds no mention of AI, machine learning or generative AI; the AI risk language sits in the 10-K. | [12][13] |
| Jul 30, 2026 | 'Beyond token-maxing' | The AI chief on balancing innovation with a realistic rein on costs. | [3] |
| Feb 23, 2026 | 2025 10-K: AI and machine learning as a risk factor | Algorithmic bias, explainability and dataset flaws in AI models; an 'AI Essentials Channel' trains staff on company-approved AI tools. | [6][14] |
Does U.S. Bank have responsible AI principles?
Not as a published document. Chief AI officer Prashant Mehrotra says the bank aims to be 'responsible by design', bringing risk, cybersecurity and other functions into AI development so compliance is built into products, and every use case goes through a governance body that applies a common lens. The 10-K describes AI risks such as biased data and limited transparency but no stated principles.
Who oversees AI at U.S. Bank's board?
Since 2024 the Cybersecurity and Technology Subcommittee of the Risk Management Committee has overseen emerging technologies including AI and machine learning. Effective January 1, 2026 the board created a standalone Technology Committee for technology strategy, modernization and transformation, citing AI among its reasons, while the Risk Management Committee keeps oversight of technology risk.
What AI risks does U.S. Bancorp disclose?
Since the 2023 10-K: flawed, insufficient or biased algorithms and datasets, AI models that are not always transparent, and AI-generated deepfakes in social engineering. Later filings add the cost of complying with new AI and data-usage laws, AI-driven cyberattacks that find vulnerabilities faster, and, in the model risk discussion, algorithmic bias and the need for greater explainability.
Is U.S. Bank cautious about customer-facing AI?
Yes, by its CEO's account. On the October 15, 2026 call Gunjan Kedia said the bank is being 'more measured' on client-facing applications because of privacy and customer-confidence concerns, while it pursues internal productivity uses and has built the ability to swap in cheaper models as token costs rise.
Which AI models does U.S. Bank use?
A mix. Mehrotra said in July 2026 that the bank uses some proprietary and open-source models balanced with models from OpenAI, Anthropic and Google, so that it is 'not stuck with one' and can protect highly confidential data.
- U.S. Bancorp 2025 Proxy Statement (DEF 14A)
- U.S. Bancorp 2026 Proxy Statement (DEF 14A)
- Beyond token-maxing: How U.S. Bank AI chief navigates costs
- Benchmarking AI adoption: What U.S. Bank's playbook tells us
- U.S. Bancorp Form 10-K for 2023: financial review and risk factors (Exhibit 13)
- U.S. Bancorp Form 10-K for 2025: financial review and risk factors
- U.S. Bancorp (USB) Q3 2026 Earnings Call Transcript
- U.S. Bank Chief AI Officer on Transformation: 'If Not Now, When?'
- U.S. Bancorp Form 10-K for 2024: financial review and risk factors (Exhibit 13)
- Dilip Venkatachari's development of agentic AI and digital-asset infrastructures is driving use cases
- How Mastercard's agentic tokens are driving agentic AI commerce
- U.S. Bancorp Quarterly Report on Form 10-Q for June 30, 2026
- U.S. Bancorp Quarterly Report on Form 10-Q for March 31, 2026
- U.S. Bancorp Annual Report on Form 10-K for 2025
When U.S. Bank moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning