AI Governance for Financial Services

For a financial institution, AI governance has four moving parts. The first is a current AI inventory that names every model, large language model, and generative system in use, including the shadow deployments nobody registered. The second is a risk classification that tiers each system by its impact and its regulatory exposure, so a model that informs a credit decision is treated differently from a tool that drafts internal email. The third is a control crosswalk that maps governance work onto the frameworks and supervisory expectations you already answer to, so one control set answers several regimes at once. The fourth is ongoing monitoring and documentation, because supervisors expect AI to be governed over its life, not signed off once and forgotten.

The reason this is harder than traditional model governance is that the supervisory map is fragmented. There is no single AI rule for US banks. Instead, different uses of AI fall under different authorities, and one system can sit under several at the same time. The matrix below is the fastest way to see which authority governs which use, and it is the practical asset this hub exists to provide.

The matrix makes one point that a sophisticated risk leader will recognize immediately: the carve-out in the model-risk guidance does not remove obligations, it moves them. Generative and agentic AI fall outside SR 26-2, but they remain subject to third-party risk guidance, fair lending law, UDAP, and your institution's own risk-management practices. Governing them is now your program's job, with an adapted approach rather than the documented-and-reproducible playbook traditional model risk was built on.

SR 26-2, the Revised Guidance on Model Risk Management issued on 17 April 2026, supersedes SR 11-7 (2011) and SR 21-8. It is non-binding guidance that does not set enforceable standards, it is most relevant to banks above $30 billion in assets, and it explicitly excludes generative and agentic AI from its scope. The agencies signaled a forthcoming AI-specific request for information to address those systems. For the full breakdown of what changed and what banks need to do now, read SR 26-2 vs SR 11-7: what changed for AI model risk management.

Most banks still run machine-learning and AI systems that do behave like models in spirit, informing a credit, pricing, or capital decision. Those belong inside an adapted model-risk process: an inventory, independent validation suited to non-deterministic behavior, documentation, and ongoing monitoring. The practitioner walkthrough of how to extend model-risk discipline to AI lives in AI model risk management and SR 11-7.

The hardest case is the one SR 26-2 set aside on purpose. When generative and agentic systems take actions or chain tools, the question of what law still applies is answered by third-party risk, fair lending, and UDAP rather than the model-risk guidance. The control architecture for that gap is covered in agentic AI governance for banks and the SR 26-2 gap.

For a US financial institution, the most useful organizing framework is the NIST AI Risk Management Framework, because its Govern, Map, Measure, and Manage functions give the program a structure that maps cleanly onto supervisory expectations. How banks and fintechs operationalize it, function by function, is the subject of NIST AI RMF for financial services.

It also helps to separate two things that get conflated. Governing AI is the engineering and risk work of making a system behave and stay defensible; proving compliance is the evidence work of showing a regulator or a customer that you did. Readiness comes first, and the distinction matters for how you sequence the program. That split is unpacked in AI governance vs AI compliance in financial services.

Fair lending and model validation

Fair lending law does not care whether a denial came from a scorecard or a neural network: a disparate-impact problem is a disparate-impact problem. Where AI touches credit, validation has to include bias and disparate-impact testing under ECOA, Regulation B, and the Fair Housing Act. The validation framework is laid out in the AI fair lending model validation framework for US banks.

Third-party and vendor AI risk

Most banks consume AI through a vendor rather than building it, which puts the 2023 interagency third-party risk guidance squarely in scope. A vendor's certificate is an upstream attestation, not coverage of how you deploy the system. The structured approach is in the third-party AI vendor risk assessment checklist for banks and fintechs.

Responsible GenAI use policy

For generative AI specifically, the first control most institutions need is a written acceptable-use policy that defines what staff can and cannot put into a model and how outputs are reviewed. The drafting guide is the responsible GenAI use policy for financial services.

The EU AI Act, for firms with EU exposure

If your institution places AI systems on the EU market, the EU AI Act adds risk-tiered obligations on top of the US supervisory stack, and your counsel owns the legal interpretation. What it means for US institutions is covered in the EU AI Act for US banks and fintechs.

Not ready for a paid engagement yet? Start with the free AI governance audit-readiness checklist: 14 self-scored items across NIST AI RMF, mapped to ISO/IEC 42001 and US supervisory expectations. When you are ready for senior-led work, the AI Governance Readiness engagement for banks and fintechs turns this hub into a defensible inventory, a risk classification, a gap assessment, and a remediation roadmap. To see exactly what that produces, walk through a redacted sample Snapshot deliverable. If the more urgent question is whether a deployed system can be broken, AI red teaming and LLM security testing is a separate engagement. All of the downloadable workbooks sit in the financial services compliance resource library.