The Question You're Not Ready For

"Walk me through your institution's governance framework for artificial intelligence and machine learning systems used in financial decision-making, customer data processing, and operational risk management."

Most institutions cannot answer this question.

Not because they don't use AI — they almost certainly do — but because no one established governance over how AI is adopted, deployed, monitored, and controlled.

The examiner follows up:

"Do you have an inventory of AI systems in use?"
"How do you validate AI models used in credit decisioning?"
"What controls prevent AI systems from exposing customer PII?"
"How do you govern AI embedded in third-party vendor platforms?"
"What's your process for approving new AI adoption?"

If the answer is "we're working on that" or "we don't think we use AI" — you have ungoverned risk.

And examiners are starting to ask.

Where AI Hides in Financial Institutions

Most institutions underestimate their AI exposure because they think AI adoption requires deliberate deployment of machine learning models.

In reality, you use AI if you have:

Fraud detection and anti-money laundering tools

‍Most modern fraud platforms use machine learning to detect anomalous transactions, flag suspicious patterns, and generate risk scores. If you can't explain how those models work, how they're trained, or how you validate their accuracy — you have ungoverned model risk.

Credit decisioning and underwriting platforms

‍Alternative credit scoring models, automated underwriting systems, and lending decisioning tools increasingly use AI. If these systems make or influence credit decisions, they introduce Fair Lending risk, ECOA compliance risk, and model risk management requirements.

Customer service chatbots and virtual assistants

‍AI-powered chatbots process customer inquiries, handle complaints, and access account data. If you don't govern what data these systems can access, where that data goes, or how responses are generated — you have data governance and consumer protection risk.

Data analytics and business intelligence platforms

‍Many analytics tools use AI to generate insights, predict trends, and automate reporting. If finance teams use AI-generated analysis for forecasting or decision-making without understanding model limitations — you have operational risk.

Third-party vendor platforms

‍Your core banking system, payment processor, loan origination platform, or risk management tool likely embeds AI. Your contract probably doesn't require the vendor to disclose AI use, explain how it works, or govern its data handling. When examiners ask how you oversee third-party AI risk — you can't answer.

The common thread:

‍AI adoption happened without governance oversight — because no one defined what requires governance approval.

Why This Is an Examination Topic Now

AI governance isn't a future regulatory concern. It's a current examination focus — particularly for institutions subject to:

Model Risk Management (SR 11-7)

‍Federal banking regulators expect institutions to validate models used in financial decision-making. If your fraud detection tool or credit scoring platform uses machine learning — it's a model. If you haven't validated it, you have a model risk management gap.

Fair Lending and ECOA Compliance

‍If AI influences credit decisions, examiners will ask: How do you prevent bias? How do you validate fair outcomes? How do you explain adverse actions? If you don't govern AI decisioning systems for Fair Lending risk — you have a compliance gap.

Data Privacy and GLBA

‍If AI systems process customer data, examiners will ask: What data can AI access? Where does that data go? Who controls it? If you use ChatGPT to draft customer communications without data governance controls — you've exposed PII.

Third-Party Risk Management

‍Examiners expect you to govern vendor risk — including vendor use of AI. If your vendor contracts don't address AI transparency, data handling, or model governance — you have a third-party risk management gap.

Operational Risk and ICFR If AI automates operational processes, makes decisions, or generates financial data — it introduces control risk. If you haven't assessed whether AI systems maintain segregation of duties, produce audit trails, or operate within approved parameters — you have operational and ICFR risk.

The regulatory expectation is straightforward: If you use AI, you govern it. If you can't govern it, you don't use it.

The Five Governance Failures That Create AI Risk