How does Western Alliance govern AI risk?
Western Alliance's AI governance is mostly board and disclosure structure built in 2025-2026 as it approached the $100 billion Large Financial Institution threshold. Its FY2024 10-K (February 2025) mentioned AI only as a source of new cyber entry points; the FY2025 10-K (February 23, 2026) added a dedicated risk factor on hallucinations, bias, data leakage, intellectual property and the opacity of generative and agentic models, including third-party ones. In December 2025 the board added Dr. Michael Papay, CISO of AI company Rohirrim, and in February 2026 it approved a charter for a standing Technology & Cybersecurity Committee because 'technology and AI are strategic considerations, not just operational risks'; the bank's governance page lists Papay as its chair. Stephen McMaster, ex-Wells Fargo, became CISO in January 2026. Management describes controls in general terms: AI 'deployed thoughtfully... with strong governance and controls' (2025 annual report), obfuscated production data for model training and risk, compliance and legal review of new fraud indicators (2025), and 'maturing emerging and specialized technology risk oversight' in the chief risk officer's 2026 priorities. There is no published AI principles document and no named AI ethics or model governance officer.[1][2][3][4][5][6][7][8][9]
Data as of Oct 16, 2026 · Western Alliance profile updated Oct 13, 2026 · 14 sources cited on this page · 140 banks profiled on this site · Markdown
Who oversees AI risk at Western Alliance?
Board and management bodies as the filings and governance pages describe them.
| Body or role | What it does | Since |
|---|---|---|
| Risk Committee and ad hoc cyber risk subcommittee | Oversee cybersecurity, information security, data privacy and technology programs; receive reports from the CISO and CIO; the subcommittee was formed in 2024 for added cyber oversight | 2024[4] |
| Technology & Cybersecurity Committee (board) | Charter approved because technology, AI, data governance and cybersecurity are growing more complex; expected to 'elevate oversight of technology, cybersecurity, information security and data governance' and improve alignment with regulatory expectations | Charter February 2026; members appointed after the June 10, 2026 annual meeting[4] |
| Committee membership | Chair Dr. Michael Papay; members Greta Guggenheim, Mary Chris Jammet, Marianne Boyd Johnson and Anthony Meola | As listed October 2026[5] |
| Dr. Michael Papay, director | Advisory board chair and CISO of Rohirrim (AI company) since 2024; EVP Technology Risk and Information Security at American Express 2019-2024; earlier CISO at Northrop Grumman | December 2025[4][3] |
| Stephen McMaster, CISO | Threat detection, incident response and advising the board on cyber risk; 20+ years at Wells Fargo, last in cloud security, data loss prevention and third-party cybersecurity | January 2026[6] |
| Chief Risk Officer Emily Nachlas's priorities | 'Maturing emerging and specialized technology risk oversight' and 'Driving optimization through automation and AI' | Investor day, May 12, 2026[9] |
What do Western Alliance's filings say about AI risk?
AI language in SEC filings, oldest first.
| Filing | AI language | Date |
|---|---|---|
| FY2024 10-K | 'The rapid evolution and increased adoption of artificial intelligence technologies has also given rise to additional vulnerabilities and potential entry points for cyber threats'; AI also listed among technologies changing the industry | February 25, 2025[1] |
| FY2025 10-K risk factor | Risks of safety and soundness, privacy and data handling, fair access to financial services, fair treatment of customers and 'hallucinations'; generative or agentic models may act incorrectly, reflect bias, leak data or infringe IP; limited transparency complicates compliance with rules requiring explanation of decisions; reliance on third-party models brings limited visibility | February 23, 2026[2] |
| 2026 proxy | Technology and AI described as 'strategic considerations, not just operational risks' in the board's reason for the new committee | April 22, 2026[4] |
| Q1 and Q2 2026 10-Qs | AI appears only in the forward-looking cautionary list: 'emerging external focus among regulators and other officials related to risks in connection with the development and use of artificial intelligence' | May 11 and July 31, 2026[10][11] |
What AI controls has Western Alliance described, and what is missing?
The most specific controls are in fraud and cyber: models are trained on obfuscated production data in secure environments, and every new indicator derived from intelligence runs through standard risk, compliance and legal review, per Carl Eberling in June 2025. In settlement payments, the stated rule is to favour legitimate claimants even at the cost of letting some bad actors through.[8][12]
Enterprise AI claims are labelled with their basis: the investor-day deck marks productivity numbers as estimates from Microsoft Copilot usage and use-case savings as internal projections, and the CEO says spending on the top five use cases will be judged on measured return before it enters 2027 plans.[9][13]
Not on the record: a published AI principles or responsible-AI policy, a management AI governance committee, a chief AI or data officer, model-inventory counts, or fairness testing results. The 2026 proxy's governance section describes cyber, information-security and data-governance oversight but names no AI-specific management function.[4][2]
What does the Western Alliance profile record on this topic?
The rows below are the entries of the Western Alliance AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 28 dated moves, 17 use cases and 31 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Vendor due diligence and onboarding | Listed among the initial AI use cases at the 2026 investor day. | In production | [9] |
| AI in Corporate Trust onboarding | The CEO names Corporate Trust pipeline and onboarding time as an early AI gain; the bank has not published a metric. | In production | [13] |
| Board and CISO oversight of technology and AI risk | An AI-company CISO joined the board in December 2025 and an ex-Wells Fargo CISO started in January 2026, ahead of the $100 billion Large Financial Institution threshold. | In production | [3][6] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Sep 16, 2026 | Barclays conference: 15 AI use cases, top five for 2027 | CEO Ken Vecchione says Corporate Trust onboarding time and AmeriHome pricing models are showing early gains, that no AI return is yet embedded in the models, and that the bank will wait for a definitive return before adding cost to 2027 plans. | [13] |
| Jul 31, 2026 | Q2 2026 10-Q repeats the AI regulatory-focus factor | The only AI language in the filing is the same forward-looking cautionary factor; the Q2 earnings release and presentation of 21 July carry it too. | [11] |
| May 11, 2026 | Q1 2026 10-Q lists AI regulatory focus as a cautionary factor | Item 31 of the forward-looking-statement list: emerging external focus among regulators and other officials on risks from the development and use of AI. No other AI language was found in the filing. | [10] |
| Feb 23, 2026 | 2025 10-K adds a dedicated AI risk factor | The development and use of AI by the bank or its third- and fourth-party vendors carries risks including 'hallucinations', bias, data leakage and limited transparency of generative or agentic models; AI adoption also adds cyber entry points. | [2] |
| Jan 21, 2026 | Stephen McMaster appointed CISO | Ex-Wells Fargo head of cloud security, third-party cybersecurity and data loss prevention; responsible for threat detection, incident response and advising the board on cyber risk. | [6] |
| Dec 11, 2025 | Board adds cybersecurity and risk expertise | Dr. Michael Papay (AI company CISO, ex-American Express) and Clarke Starnes III (ex-Truist chief risk officer) join as the bank nears the $100 billion Large Financial Institution threshold. | [3] |
| Mar 21, 2025 | Third-party breach exposes 22,000 customers | A vulnerability in a vendor's file-transfer software. | [14] |
Does Western Alliance have a board committee for AI?
Yes, in effect. In February 2026 the board approved a charter for a standing Technology & Cybersecurity Committee, citing the growing complexity of technology, AI, data governance and cybersecurity, with members appointed after the June 10, 2026 annual meeting. The bank's governance page lists Dr. Michael Papay as chair with four other directors as members.
What AI risks does Western Alliance disclose in its 10-K?
The FY2025 10-K, filed February 23, 2026, has a dedicated risk factor covering safety and soundness, privacy, fair access and fair treatment of customers, hallucinations, bias, data leakage, intellectual-property infringement and the opacity of generative and agentic models, plus dependence on third-party models. The FY2024 10-K had mentioned AI only as a source of new cyber vulnerabilities.
Does Western Alliance publish AI principles?
No published AI principles or responsible-AI policy was found. The bank's statements are general: its 2025 annual report says AI is 'deployed thoughtfully across the entire organization with strong governance and controls', and the chief risk officer's 2026 priorities include maturing technology risk oversight and driving optimization through automation and AI.
Who is responsible for AI security at Western Alliance?
CISO Stephen McMaster, appointed January 2026 after more than 20 years at Wells Fargo, leads threat detection and incident response and advises the board on cyber risk. CIO Sonny Sonnenstein presented the AI program at the 2026 investor day, and director Dr. Michael Papay, CISO of AI company Rohirrim, chairs the board's Technology & Cybersecurity Committee.
How does Western Alliance handle bias in its AI models?
The only described practice is from fraud and cyber work: Carl Eberling said in June 2025 that the bank trains models on obfuscated production data in secure environments and runs new indicators through risk, compliance and legal review. The 10-K acknowledges that AI may reflect biases in training data. No fairness testing results have been published.
- Western Alliance Bancorporation Annual Report on Form 10-K for the fiscal year ended December 31, 2024
- Western Alliance Bancorporation Annual Report on Form 10-K for the fiscal year ended December 31, 2025
- Western Alliance Bancorporation Appoints Two New Board Members
- Western Alliance Bancorporation 2026 Proxy Statement (Schedule 14A)
- Board committee composition (Technology and Cybersecurity Committee)
- Western Alliance Appoints Stephen McMaster as Chief Information Security Officer
- Western Alliance Bancorporation 2025 Annual Report to Shareholders
- How Truist and Western Alliance deploy AI to fight fraud
- Western Alliance Bancorporation Investor Day 2026 presentation (Form 8-K, Exhibit 99.1)
- Western Alliance Bancorporation Quarterly Report on Form 10-Q for the quarter ended March 31, 2026
- Western Alliance Bancorporation Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Western Alliance co-created tech blocks class action fraud
- Western Alliance at Barclays Conference: shift to profits, buybacks (transcript)
- Western Alliance breach exposes 22K customers' data
When Western Alliance moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning