# Western Alliance Bancorporation: Responsible AI

Source: https://www.bankingnewsai.com/banks/western-alliance/responsible-ai
Last updated: Oct 16, 2026

*Part of the [Western Alliance Bancorporation AI strategy profile](https://www.bankingnewsai.com/banks/western-alliance).*

## How does Western Alliance govern AI risk?

Western Alliance's AI governance is mostly board and disclosure structure built in 2025-2026 as it approached the $100 billion Large Financial Institution threshold. Its FY2024 10-K (February 2025) mentioned AI only as a source of new cyber entry points; the FY2025 10-K (February 23, 2026) added a dedicated risk factor on hallucinations, bias, data leakage, intellectual property and the opacity of generative and agentic models, including third-party ones. In December 2025 the board added Dr. Michael Papay, CISO of AI company Rohirrim, and in February 2026 it approved a charter for a standing Technology & Cybersecurity Committee because 'technology and AI are strategic considerations, not just operational risks'; the bank's governance page lists Papay as its chair. Stephen McMaster, ex-Wells Fargo, became CISO in January 2026. Management describes controls in general terms: AI 'deployed thoughtfully... with strong governance and controls' (2025 annual report), obfuscated production data for model training and risk, compliance and legal review of new fraud indicators (2025), and 'maturing emerging and specialized technology risk oversight' in the chief risk officer's 2026 priorities. There is no published AI principles document and no named AI ethics or model governance officer. ([Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000121254525000090/wal-20241231.htm), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026010336/wal-20251231.htm), [Business Wire](https://businesswire.com/news/home/20251211183186/en/Western-Alliance-Bancorporation-Appoints-Two-New-Board-Members), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm), [Western Alliance Bancorporation](https://investors.westernalliancebancorporation.com/governance/committee-composition), [Western Alliance Bancorporation](https://investors.westernalliancebancorporation.com/News-and-Presentations/news/news-details/2026/Western-Alliance-Appoints-Stephen-McMaster-as-Chief-Information-Security-Officer), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170413/wal_ars_2026.pdf), [American Banker](https://americanbanker.com/news/how-truist-and-western-alliance-deploy-ai-to-fight-fraud), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026033850/wal_investordayx2026xfin.htm))

## Who oversees AI risk at Western Alliance?

Board and management bodies as the filings and governance pages describe them.

| Body or role | What it does | Since | Sources |
| --- | --- | --- | --- |
| Risk Committee and ad hoc cyber risk subcommittee | Oversee cybersecurity, information security, data privacy and technology programs; receive reports from the CISO and CIO; the subcommittee was formed in 2024 for added cyber oversight | 2024 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm) |
| Technology & Cybersecurity Committee (board) | Charter approved because technology, AI, data governance and cybersecurity are growing more complex; expected to 'elevate oversight of technology, cybersecurity, information security and data governance' and improve alignment with regulatory expectations | Charter February 2026; members appointed after the June 10, 2026 annual meeting | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm) |
| Committee membership | Chair Dr. Michael Papay; members Greta Guggenheim, Mary Chris Jammet, Marianne Boyd Johnson and Anthony Meola | As listed October 2026 | [Western Alliance Bancorporation](https://investors.westernalliancebancorporation.com/governance/committee-composition) |
| Dr. Michael Papay, director | Advisory board chair and CISO of Rohirrim (AI company) since 2024; EVP Technology Risk and Information Security at American Express 2019-2024; earlier CISO at Northrop Grumman | December 2025 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm), [Business Wire](https://businesswire.com/news/home/20251211183186/en/Western-Alliance-Bancorporation-Appoints-Two-New-Board-Members) |
| Stephen McMaster, CISO | Threat detection, incident response and advising the board on cyber risk; 20+ years at Wells Fargo, last in cloud security, data loss prevention and third-party cybersecurity | January 2026 | [Western Alliance Bancorporation](https://investors.westernalliancebancorporation.com/News-and-Presentations/news/news-details/2026/Western-Alliance-Appoints-Stephen-McMaster-as-Chief-Information-Security-Officer) |
| Chief Risk Officer Emily Nachlas's priorities | 'Maturing emerging and specialized technology risk oversight' and 'Driving optimization through automation and AI' | Investor day, May 12, 2026 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026033850/wal_investordayx2026xfin.htm) |

## What do Western Alliance's filings say about AI risk?

AI language in SEC filings, oldest first.

| Filing | AI language | Date | Sources |
| --- | --- | --- | --- |
| FY2024 10-K | 'The rapid evolution and increased adoption of artificial intelligence technologies has also given rise to additional vulnerabilities and potential entry points for cyber threats'; AI also listed among technologies changing the industry | February 25, 2025 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000121254525000090/wal-20241231.htm) |
| FY2025 10-K risk factor | Risks of safety and soundness, privacy and data handling, fair access to financial services, fair treatment of customers and 'hallucinations'; generative or agentic models may act incorrectly, reflect bias, leak data or infringe IP; limited transparency complicates compliance with rules requiring explanation of decisions; reliance on third-party models brings limited visibility | February 23, 2026 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026010336/wal-20251231.htm) |
| 2026 proxy | Technology and AI described as 'strategic considerations, not just operational risks' in the board's reason for the new committee | April 22, 2026 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm) |
| Q1 and Q2 2026 10-Qs | AI appears only in the forward-looking cautionary list: 'emerging external focus among regulators and other officials related to risks in connection with the development and use of artificial intelligence' | May 11 and July 31, 2026 | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026033054/wal-20260331.htm), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026051418/wal-20260630.htm) |

## What AI controls has Western Alliance described, and what is missing?

The most specific controls are in fraud and cyber: models are trained on obfuscated production data in secure environments, and every new indicator derived from intelligence runs through standard risk, compliance and legal review, per Carl Eberling in June 2025. In settlement payments, the stated rule is to favour legitimate claimants even at the cost of letting some bad actors through. ([American Banker](https://americanbanker.com/news/how-truist-and-western-alliance-deploy-ai-to-fight-fraud), [American Banker](https://americanbanker.com/news/western-alliance-co-created-tech-blocks-class-action-fraud))

Enterprise AI claims are labelled with their basis: the investor-day deck marks productivity numbers as estimates from Microsoft Copilot usage and use-case savings as internal projections, and the CEO says spending on the top five use cases will be judged on measured return before it enters 2027 plans. ([Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026033850/wal_investordayx2026xfin.htm), [Investing.com](https://www.investing.com/news/transcripts/western-alliance-at-barclays-conference-shift-to-profits-buybacks-93CH-4904090))

Not on the record: a published AI principles or responsible-AI policy, a management AI governance committee, a chief AI or data officer, model-inventory counts, or fairness testing results. The 2026 proxy's governance section describes cyber, information-security and data-governance oversight but names no AI-specific management function. ([Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000119312526170399/wal-20260422.htm), [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026010336/wal-20251231.htm))

## What does the Western Alliance profile record on this topic?

| Date | Move | Detail | Sources |
| --- | --- | --- | --- |
| Sep 16, 2026 | Barclays conference: 15 AI use cases, top five for 2027 | CEO Ken Vecchione says Corporate Trust onboarding time and AmeriHome pricing models are showing early gains, that no AI return is yet embedded in the models, and that the bank will wait for a definitive return before adding cost to 2027 plans. | [Investing.com](https://www.investing.com/news/transcripts/western-alliance-at-barclays-conference-shift-to-profits-buybacks-93CH-4904090) |
| Jul 31, 2026 | Q2 2026 10-Q repeats the AI regulatory-focus factor | The only AI language in the filing is the same forward-looking cautionary factor; the Q2 earnings release and presentation of 21 July carry it too. | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026051418/wal-20260630.htm) |
| May 11, 2026 | Q1 2026 10-Q lists AI regulatory focus as a cautionary factor | Item 31 of the forward-looking-statement list: emerging external focus among regulators and other officials on risks from the development and use of AI. No other AI language was found in the filing. | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026033054/wal-20260331.htm) |
| Feb 23, 2026 | 2025 10-K adds a dedicated AI risk factor | The development and use of AI by the bank or its third- and fourth-party vendors carries risks including 'hallucinations', bias, data leakage and limited transparency of generative or agentic models; AI adoption also adds cyber entry points. | [Western Alliance Bancorporation (SEC filings)](https://www.sec.gov/Archives/edgar/data/1212545/000162828026010336/wal-20251231.htm) |
| Jan 21, 2026 | Stephen McMaster appointed CISO | Ex-Wells Fargo head of cloud security, third-party cybersecurity and data loss prevention; responsible for threat detection, incident response and advising the board on cyber risk. | [Western Alliance Bancorporation](https://investors.westernalliancebancorporation.com/News-and-Presentations/news/news-details/2026/Western-Alliance-Appoints-Stephen-McMaster-as-Chief-Information-Security-Officer) |
| Dec 11, 2025 | Board adds cybersecurity and risk expertise | Dr. Michael Papay (AI company CISO, ex-American Express) and Clarke Starnes III (ex-Truist chief risk officer) join as the bank nears the $100 billion Large Financial Institution threshold. | [Business Wire](https://businesswire.com/news/home/20251211183186/en/Western-Alliance-Bancorporation-Appoints-Two-New-Board-Members) |
| Mar 21, 2025 | Third-party breach exposes 22,000 customers | A vulnerability in a vendor's file-transfer software. | [Banking Dive](https://www.bankingdive.com/news/western-alliance-data-breach-22000-customers-cleo-third-party-software/743215/) |

## Common questions

### Does Western Alliance have a board committee for AI?

Yes, in effect. In February 2026 the board approved a charter for a standing Technology & Cybersecurity Committee, citing the growing complexity of technology, AI, data governance and cybersecurity, with members appointed after the June 10, 2026 annual meeting. The bank's governance page lists Dr. Michael Papay as chair with four other directors as members.

### What AI risks does Western Alliance disclose in its 10-K?

The FY2025 10-K, filed February 23, 2026, has a dedicated risk factor covering safety and soundness, privacy, fair access and fair treatment of customers, hallucinations, bias, data leakage, intellectual-property infringement and the opacity of generative and agentic models, plus dependence on third-party models. The FY2024 10-K had mentioned AI only as a source of new cyber vulnerabilities.

### Does Western Alliance publish AI principles?

No published AI principles or responsible-AI policy was found. The bank's statements are general: its 2025 annual report says AI is 'deployed thoughtfully across the entire organization with strong governance and controls', and the chief risk officer's 2026 priorities include maturing technology risk oversight and driving optimization through automation and AI.

### Who is responsible for AI security at Western Alliance?

CISO Stephen McMaster, appointed January 2026 after more than 20 years at Wells Fargo, leads threat detection and incident response and advises the board on cyber risk. CIO Sonny Sonnenstein presented the AI program at the 2026 investor day, and director Dr. Michael Papay, CISO of AI company Rohirrim, chairs the board's Technology & Cybersecurity Committee.

### How does Western Alliance handle bias in its AI models?

The only described practice is from fraud and cyber work: Carl Eberling said in June 2025 that the bank trains models on obfuscated production data in secure environments and runs new indicators through risk, compliance and legal review. The 10-K acknowledges that AI may reflect biases in training data. No fairness testing results have been published.
## Deeper on Western Alliance

- [What is Western Alliance's AI strategy?](https://www.bankingnewsai.com/banks/western-alliance/ai-strategy)
- [How does Western Alliance use AI for fraud detection and credit?](https://www.bankingnewsai.com/banks/western-alliance/fraud-and-credit-ai)


---

Canonical page: https://www.bankingnewsai.com/banks/western-alliance/responsible-ai
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (42 authorities, 243 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.