AI is now embedded across the financial services value chain, from credit underwriting and fraud detection to liquidity optimisation and client interaction. This is evidenced by numerous bank disclosures (JPMC, GS, Citi), supervisory and central bank reports (BIS, FINMA, FSB, ECB).
Yet the central issue for banks is not technological capability, but governance capacity. As highlighted in recent risk architecture analyses published by the BIS, the FSB, the ECB, FINMA and the BoE, deployment velocity is outpacing the maturity of control frameworks, creating a structural gap at board level.
This dynamic is not unprecedented. Financial services have repeatedly faced governance lag following innovation, notably in credit securitisation prior to the Global Financial Crisis, high-frequency trading, and cloud outsourcing with its concentration risks. The securitisation cycle provides the closest parallel to AI, as in both cases, rapid scaling of model-driven decision-making outpaced institutional understanding and control frameworks. Governance remained reactive, with boards lacking sufficient visibility and challenge capability. AI follows the same pattern, but with greater opacity, scale, and autonomy, which accelerates risk propagation and further constrains effective human oversight.
The risk profile of AI is multidimensional. Model opacity challenges explainability and auditability. Embedded bias creates conduct and regulatory exposure. Cyber risks evolve through adversarial attacks and data poisoning. Meanwhile, concentration risk emerges from reliance on a small number of cloud and model providers, introducing systemic dependencies. Perhaps most critically, herding effects raise macroprudential concerns that extend beyond individual firms.
Despite these risks, banks remain strongly incentivised by the immediate financial benefits of AI. Efficiency gains, cost reductions, and enhanced analytics capabilities translate rapidly into improved P&L performance. However, governance structures required to manage long-term risks and tail events lag behind. Current initiatives to train employees and extend traditional model risk management are meaningful but remain insufficiently integrated. Responsibilities are often fragmented across functions, creating gaps in oversight, monitoring, and accountability.
Accordingly, board oversight remains uneven. Supervisory evidence indicates that many banks continue to treat AI as an extension of traditional model risk, relying on governance frameworks designed for relatively interpretable and static models, and only partially adapted to the dynamic, opaque, and system-level characteristics of modern AI. This activity-based approach governs discrete models within established risk silos. It remains pragmatic but ultimately insufficient. AI systems are inherently adaptive, data-dependent, and frequently externally sourced, blurring the boundaries between model, operational, cyber, and third-party risks and exposing gaps in fragmented control architectures.
A key structural issue is that many banks are digitising existing processes with AI rather than redesigning their risk frameworks for AI-native operations. This reinforces governance fragmentation and limits the effectiveness of existing controls.
Addressing this requires a shift from model-centric to decision-centric governance, where entire decision pipelines are subject to oversight. AI must be embedded within a unified risk architecture integrating operational, model, cyber, and third-party risks. A further deficiency lies in the absence of explicit AI risk appetite frameworks. While banks define tolerances for credit or market risk, few articulate quantitative thresholds for model error, bias, explainability, or third-party dependency. Without such parameters, governance lacks enforceability, and decisions default to business-driven deployment rather than risk-constrained approval.
Board capability is another structural constraint. Directors are rarely equipped to challenge AI risk meaningfully, leading to reliance on management narratives. This asymmetry weakens oversight and shifts boards toward passive ratification. In a domain characterised by non-linear risks and poorly understood failure modes, such passivity constitutes a governance risk in itself.
Closing this gap requires a transition from model governance to decision governance, supported by continuous monitoring, real-time risk visibility, and lifecycle oversight. Integrated control architectures must replace fragmented approaches, with clear end-to-end accountability for AI risk.
Equally, boards must evolve through targeted education, access to independent expertise, and formalisation of AI risk appetite. Governance must become proactive rather than reactive, aligning with the speed and scale of AI deployment.
Ultimately, the primary risk is not AI itself, but the scaling of AI faster than the evolution of integrated control systems. Until governance frameworks catch up with deployment, the banking sector remains exposed to risks that may only materialise under stress conditions.
Timing is critical. In financial services, delayed governance is rarely neutral; it is where operational failures, regulatory breaches, and systemic risks accumulate. Institutions that recognise this early will not only mitigate risk, but define the standards others are forced to follow.
