Banking supervisors address AI governance and risk management

More than 85 percent of large banks under European supervision already use AI, with adoption accelerating, particularly for generative and agentic AI.

This expansion is not just in number of use cases but in depth, moving beyond traditional areas like credit risk and fraud detection.

AI is increasingly deployed in IT operations (incident management, coding), legal and document analysis (contract reviews, regulatory interpretation), and front-line applications (customer support, relationship management).

This horizontal spread means AI is now part of banks' day-to-day operating fabric, shifting the nature of risk from narrow model risk to broader governance, business model, operational, conduct, compliance, and strategic risks.

Workshops with banks revealed confidence in managing AI benefits and risks, leveraging existing governance and risk modelling capabilities.

However, supervisors note that AI introduces qualitative changes requiring more than just expanding current frameworks.

Despite progress, AI governance remains uneven, with supervisors emphasizing the need for clear accountability, effective senior management oversight, and robust challenge mechanisms.

Fragmented ownership across various functions is a persistent concern, underscoring that AI must be governed as a core business and risk topic.

Existing risk management frameworks also face challenges in addressing AI-specific issues.

These include ensuring explainability of model outputs, managing the continuous lifecycle of evolving AI models, and maintaining high data quality to prevent bias, which can lead to prudential risks.