AI governance in financial services: what regulators now expect

Why financial services is held to a high bar

Three things combine to raise the bar in financial services. The decisions AI is used for, lending, credit scoring, insurance pricing, fraud detection, fundamentally affect people's financial lives. The sector is already subject to extensive regulation and a strong culture of risk management and accountability. And financial regulators have long experience with model risk, the discipline of governing the models that drive financial decisions, which they naturally extend to AI. The combination means AI in financial services is expected to be governed to a high standard.

The key risk areas

AI governance in financial services concentrates on several areas:

• Fairness and non-discrimination: AI used in credit, insurance, and similar decisions must not produce unlawful discrimination, an area of intense regulatory focus and the heart of laws like the Colorado AI Act.
• Model risk: The accuracy, robustness, and ongoing validity of the models driving decisions, building on the sector's established model-risk-management practices.
• Transparency and explainability: The ability to explain decisions to customers and regulators, which is both a fairness and a regulatory requirement.
• Accountability: Clear ownership of AI systems and decisions, consistent with the sector's expectations of senior accountability.
• Data governance: Rigorous management of the data feeding AI, given its impact on outcomes.

What regulators expect

Across jurisdictions, financial regulators expect firms to govern AI as they would any system driving consequential decisions: with clear accountability, robust risk management, validation, documentation, transparency, and the ability to demonstrate all of it. The expectation is not just that AI works, but that the firm can show it is governed, fair, and controlled. Binding laws like the EU AI Act add specific obligations on top, since many financial AI uses are high-risk under such laws.

Building a defensible practice

For a financial services firm, the path is to extend its existing risk and governance discipline to AI: bring every AI system into a governed inventory, classify by risk with particular attention to consequential decisions, apply rigorous controls and validation to high-risk systems, ensure genuine oversight and explainability, and maintain the evidence to demonstrate it all. Much of this builds on capabilities the sector already has in model risk management, which is an advantage.

The coherence imperative

In a regulated firm, the ability to demonstrate governance on demand is everything, and that depends on coherence. When the classification, validation, controls, and evidence for each AI system are connected and current, the firm can answer a regulator, an auditor, or a customer confidently. When they are scattered, the firm is exposed precisely when scrutiny is highest. For financial services, where scrutiny is a constant, keeping AI governance coherent, with each system's record connected and defensible, is not optional but central. It is what turns a set of AI systems into a governed, defensible practice that meets the sector's elevated expectations.

Key terms

Model risk

The discipline of governing the models that drive financial decisions for accuracy, robustness, and validity.

Fairness

Avoiding unlawful discrimination in AI-driven decisions, especially in credit and insurance.

Senior accountability

Clear executive ownership of AI systems and the decisions they drive.

Demonstrable governance

Governance that can be shown to regulators, auditors, and customers on demand.

References

• NIST AI Risk Management Framework
• OECD AI Principles