AI Governance Framework for FS

← Back to Enterprise.AI

Most FS institutions already have model risk and operational risk frameworks. The mistake is building AI governance from scratch. Instead, extend what you have — adding AI-specific controls, committees and reporting into existing three-lines-of-defense structures.

The five pillars

Effective AI governance in FS rests on five mutually reinforcing pillars. Weakness in any one creates exposure that the others cannot fully compensate for.

1. Policy & Standards

An enterprise AI policy approved by the board, supplemented by standards for model development, GenAI usage, third-party AI and data use.

2. Decision Rights & Committees

Clear RACI for AI decisions. Most institutions need an AI Steering Committee (executive) and an AI Risk Committee (independent), feeding into existing risk governance.

3. Risk Identification & Controls

An AI risk taxonomy mapped to existing operational, model and conduct risk frameworks, with controls embedded in the SDLC and MLOps pipeline.

4. Inventory & Lifecycle

A single AI/ML inventory that tracks every model from intake through decommissioning, with risk tiering, validation status and ownership.

5. Reporting & Assurance

Dashboards for the board, regulators and external auditors that prove AI is being used responsibly — not just claimed to be.

6. People & Culture

AI literacy at every level, escalation paths people actually use, and incentives that reward raising concerns rather than hiding them.

Roles and accountability (RACI)

Effective AI governance requires clear decision rights. The RACI matrix below defines accountability across the three lines of defense, extended for AI and GenAI decisions.

Activity	Board / Risk Cmte	AI Steering	1st Line	2nd Line	3rd Line
Approve AI strategy & risk appetite	A	R	C	C	I
Approve high-risk AI use cases	I	A	R	C	I
AI risk appetite & limits framework	A	R	I	C	I
Develop & deploy models	I	I	A/R	C	I
GenAI usage policy & gateway	I	A	R	C	I
Independent model validation	I	I	C	A/R	I
AI inventory & classification	I	I	R	A	I
Fairness & bias testing	I	I	R	A/C	I
Monitoring & drift detection	I	I	R	C	I
Incident escalation & response	C	R	C	R	I
Third-party AI vendor risk	I	C	R	A	I
Regulatory reporting on AI	I	R	C	A	I
Audit of AI controls	I	I	C	C	A/R
Data governance for AI training	I	I	R	A	I
EU AI Act & regulatory compliance	I	C	C	A/R	I

R = Responsible (does the work) · A = Accountable (final authority) · C = Consulted (provides input) · I = Informed (kept updated)

Risk-tiering AI use cases

Not every AI use case needs the same level of governance. A pragmatic tiering model lets you concentrate scrutiny where it matters and avoid suffocating low-risk experimentation.

Tier	Examples	Approval	Validation	Monitoring
Tier 1 — Critical	Credit decisioning, AML, fraud, customer-facing GenAI	AI Steering + Risk Cmte	Independent, pre-launch	Real-time, monthly review
Tier 2 — High	Underwriting support, KYC enrichment, advisor copilots	AI Steering	Independent, pre-launch	Weekly metrics, quarterly review
Tier 3 — Moderate	Operational automation, marketing personalization	Business head + 2nd line	Peer review	Monthly metrics
Tier 4 — Low	Internal productivity, document summarisation	Business head	Self-attestation	Sample-based

Risk tiering: Full governance model

Risk tiers determine the intensity of governance, validation, and ongoing oversight. This four-tier model aligns governance investment with downside risk.

Tier	Examples	Board/Regulatory Exposure	Approval Gate	Validation	Monitoring Cadence	Revalidation
1 — Critical	Credit decisioning, AML/CFT, customer-facing GenAI generating advice, fraud detection impacting customer outcomes	Material revenue/loss impact; regulatory criticism; potential enforcement action	AI Steering + Risk Committee + sign-off by LOB head	Independent, pre-launch, comprehensive	Real-time alerting + daily metrics review	Quarterly or on material change
2 — High	Underwriting support, KYC enrichment, advisor copilots, premium modelling, customer segmentation	Moderate revenue impact; regulatory interest; reputational risk possible	AI Steering Committee approval	Independent, pre-launch, focused on top 3 risks	Weekly metrics + monthly risk review	Semi-annually or on change
3 — Moderate	Operational automation, marketing personalization, process optimisation, internal productivity GenAI	Low direct customer impact; operational efficiency focus	Business head + 2nd line sign-off	Peer/self review against checklist	Monthly metrics sampling	Annually
4 — Low	Document summarisation, internal FAQ chatbot, data exploration, non-client-facing experimentation	Negligible external impact; learning/efficiency only	Business head approval	Self-attestation to MRM checklist	Quarterly or sample-based	On request only

Policy template outline

A board-approved AI policy should cover these elements. Use this outline as a template for your own enterprise policy.

Purpose & scope. States the institution's commitment to responsible AI, and defines which systems are in and out of scope (e.g., GenAI, third-party, traditional ML).
Principles. Five to seven core principles (e.g., fairness, explainability, human oversight, compliance, accountability) with concise definitions.
Governance structure. Roles, committees, escalation paths. Define AI Steering Committee (executive decision-making) and AI Risk Committee (independent oversight) charters.
Risk management. Reference to risk appetite statement, risk tiering model, and core controls (intake gate, validation, monitoring, decommissioning).
Model lifecycle. Intake through development, validation, deployment, monitoring and decommissioning. Point to the MRM checklist.
GenAI-specific obligations. Foundation model selection, prompt governance, grounding/RAG architecture, hallucination controls, usage logging.
Data governance. Data sourcing, quality requirements, PII/sensitive data handling, bias testing, representativeness.
Third-party & vendor risk. Vendor assessment criteria, contractual controls (data residency, audit rights, liability), indemnity requirements.
Regulatory compliance. Mapping to SR 11-7, SS1/23, EU AI Act, NIST AI RMF, GDPR, fair lending regs. Quarterly reporting cadence to 2nd line and board.
Escalation & incident response. When and how to report AI failures, bias findings, compliance gaps. Who owns incident response.
Training & literacy. Mandatory training for executives, tech leads, risk staff. Annual refresher cadence.
Review & approval. Board sign-off, 2nd line ownership, annual refresh cycle.

Regulatory mapping table

AI governance across FS jurisdictions requires navigating multiple, overlapping frameworks. This table maps common regulatory requirements to governance components.

Regulation	Key Requirement	FS Relevance	Governance Response
SR 11-7 (Federal Reserve)	Extend model risk management to all "models" including AI/ML and some GenAI	Applies if you operate in US; overseas banks with US subsidiaries must comply	Extend existing MRM policy to AI models; independent validation gate; ongoing monitoring
SS1/23 (Bank of England)	AI risk management within operational resilience framework; third-party AI dependencies	Applies to UK-regulated entities and global banks with UK operations	Map AI risks to operational resilience categories; vendor risk framework; testing & assurance
EU AI Act	Classification, conformity assessment, training data governance, human oversight for high-risk systems	Applies to EU-facing institutions; extraterritorial reach to non-EU banks	Risk classification inventory; conformity documentation; data lineage tracking; human-in-the-loop audit trails
NIST AI RMF	Six functions (Govern, Map, Measure, Manage) and four pillars (safety, security, resilience, accountability)	Industry standard; increasingly expected by regulators; useful alignment tool	Map internal governance to NIST framework; document risk profiles; annual self-assessment
SAMA Guidelines (Saudi Arabia)	AI governance for Saudi-regulated banks; AI policy, oversight committee, risk assessment	Applies to Saudi banks and foreign subsidiaries; covers all material AI use	Board AI policy; oversight committee; risk register; annual reporting to SAMA
GDPR (EU/UK)	Lawful basis for training data; DPIA for automated decision-making; right to explanation	Applies whenever personal data is processed in EU/UK training or inference	Data governance module in AI policy; DPIA template for high-risk models; transparency documentation
Fair Lending / Consumer Protection	Non-discriminatory credit decisions; adverse action notices; explainability on demand	Applies to credit, lending, insurance pricing; varies by jurisdiction (FCRA, ECOA, FCA)	Fairness testing framework; protected attribute monitoring; model explainability tooling

Committee terms of reference (ToR) template

Two key committees manage AI governance. Here is a template structure for each.

AI Steering Committee

Purpose: Executive-level decision-making on AI strategy, portfolio prioritization, use case approvals (Tier 1 & 2), and major policy changes.
Membership: CIO/CTO, Chief Risk Officer, Chief Compliance Officer, Head of Model Risk Management, LOB heads (Investment Banking, Retail, Wealth, Ops), Chief Data Officer. Optional: Chief Innovation Officer, General Counsel.
Frequency: Monthly (minimum); more often if incidents or major regulatory changes.
Accountability: Accountable to the Board Risk Committee for AI strategy execution and risk appetite compliance.
Key decisions: Approve Tier 1 use cases; approve new GenAI pilots; review AI incident reports; approve AI vendor contracts above threshold; review regulatory feedback.
Escalation: Material breaches of risk appetite, regulatory criticism, or major incidents escalate to Board Risk Committee within 48 hours.

AI Risk Committee (Independent Oversight)

Purpose: Independent review of AI risk register, control effectiveness, regulatory alignment, and validation outcomes. Reports to the Board Audit & Risk Committees.
Membership: Chief Risk Officer (chair), independent 2nd line model risk head, external AI risk advisor (optional), Chief Compliance Officer, Head of Internal Audit (observer).
Frequency: Quarterly minimum; monthly if under active regulatory scrutiny.
Accountability: Reports findings and recommendations to the Board Risk Committee and Audit Committee.
Key reviews: Validation exception tracking; fairness testing results; monitoring alert trends; third-party vendor assessments; regulatory gap closure status.
Escalation: Unresolved control gaps, validation failures, or fairness breaches are escalated to the Board within 10 business days.

Reporting dashboard requirements

Board and executive dashboards should track real-time AI governance health. Minimum recommended metrics:

Metric	Frequency	Target/Threshold	Owner
AI inventory completeness	Monthly	100% of models registered and classified	2nd Line
Tier 1 & 2 validation coverage	Monthly	100% independent validated pre-launch	Model Risk
Model monitoring active coverage	Weekly	100% of Tier 1–2 models, ≥80% Tier 3	1st Line + Model Risk
Performance drift alerts	Daily	Zero unresolved alerts >3 days	1st Line
Fairness test exceptions	Quarterly	All disparate impact ≥2% sigma documented and remediated	Model Risk
GenAI prompt governance	Monthly	100% production prompts versioned, reviewed, audit-logged	AI Steering
Third-party vendor audit status	Quarterly	All Tier 1–2 vendors SOC 2 / annual attestation current	Vendor Risk
Regulatory compliance gap closure	Quarterly	100% of findings from prior quarter closed on schedule	Compliance / 2nd Line
AI-related incidents reported	Monthly	Root cause analysis within 5 days of discovery	Compliance / Risk
AI policy & control training completion	Quarterly	100% of tech leads & risk staff trained annually	Learning & Development

Governance without teeth is worse than no governance — it creates a false sense of security. Tie AI governance decisions to promotion gates, budget allocation, and deployment pipelines so they actually stop bad models from going live.

Implementation roadmap

Rolling out a governance framework is a 9–18 month program. This roadmap is a typical delivery sequence:

Phase 1: Foundation (Months 1–3)

Board workshop: AI strategy & risk appetite session. Agree on scope, risk tiers, committee structure.
Draft enterprise AI policy aligned to SR 11-7, EU AI Act, NIST RMF. Regulatory mapping workshop with compliance & risk teams.
Establish AI Steering & Risk Committees. Publish ToRs. Schedule first meetings.
Build AI inventory intake template. Begin data collection from all LOBs and tech teams.

Phase 2: Inventory & Classification (Months 3–6)

Complete AI inventory. Risk tier all models. Identify Tier 1 & 2 gaps in validation, monitoring.
Classify under EU AI Act, GDPR, fair lending regs. Identify high-risk systems requiring conformity.
Launch independent model risk function if not in place. Define validation scope & exception tracking.
Board presentation: Summary of AI portfolio, top risks, near-term remediation plan.

Phase 3: Controls & Validation (Months 6–12)

Deploy monitoring infrastructure for Tier 1 & 2 models. Define SLOs, alerting thresholds, escalation paths.
Fairness testing framework & tooling. Begin testing backlog of existing models.
GenAI governance: Establish usage policy, foundation model selection framework, prompt governance process. Deploy enterprise GenAI gateway if not existing.
Third-party vendor assessment. Build questionnaires, audit schedules, contract amendments.
AI literacy training for executives, tech leads, risk staff. Board & Risk Committee certification.

Phase 4: Assurance & Regulatory Readiness (Months 12–18)

Regulatory compliance gap closure. EU AI Act conformity documentation for high-risk systems.
Board dashboard launch. Quarterly AI risk reporting to the board begins.
External audit of AI governance. SOC 2 / Type II assessment if third-party AI dependencies material.
Regulator readiness. Prepare documentation for SR 11-7 exams, EU AI Act enforcement, SAMA inspections.
Establish AI incident & response playbook. Run tabletop exercises with crisis comms.

Quick reference: Common failure modes

Watch out for these patterns in AI governance programs:

Governance without teeth. Policies and committees that exist on paper but don't actually block bad models or slow down deployment. Fix: Tie governance decisions to promotion gates & budget allocation.
Shadow AI running rampant. Business teams using GenAI and external AI tools outside central visibility. Fix: Enforce firewall rules, deploy gateway, monitor SaaS app spending, offer approved alternatives.
Validation bottleneck. Independent validation function is undersourced and creates 6-month backlogs. Fix: Hire or contract validation expertise; deploy self-service validation tooling; risk-tier to avoid over-validating low-risk experiments.
Fairness testing theater. Fairness tests run but findings are not acted on; disparate impact is documented but unresolved. Fix: Make fairness test outcome a go/no-go gate; tie LOB incentives to fairness SLOs.
Stale inventory. AI inventory is built once and never maintained. Models drop off; new uses aren't registered. Fix: Make inventory a live operational system with quarterly audits; incentivize LOBs to keep it current.
Committee theater. Committees meet but don't make decisions; escalations are vague; accountability is diffuse. Fix: Publish meeting minutes with explicit decisions & owners; track action items with deadlines.

Ready to implement this in your organisation?

Get in touch to discuss how this accelerator fits your institution.

Book a Consultation →

AI Governance Framework for Financial Services

The five pillars

1. Policy & Standards

2. Decision Rights & Committees

3. Risk Identification & Controls

4. Inventory & Lifecycle

5. Reporting & Assurance

6. People & Culture

Roles and accountability (RACI)

Risk-tiering AI use cases

Risk tiering: Full governance model

Policy template outline

Regulatory mapping table

Committee terms of reference (ToR) template

AI Steering Committee

AI Risk Committee (Independent Oversight)

Reporting dashboard requirements

Implementation roadmap

Phase 1: Foundation (Months 1–3)

Phase 2: Inventory & Classification (Months 3–6)

Phase 3: Controls & Validation (Months 6–12)

Phase 4: Assurance & Regulatory Readiness (Months 12–18)

Quick reference: Common failure modes

Ready to implement this in your organisation?