AI Governance for Banks: Connecting Data, Models, and Internal Structures

AI Governance for Banks: Connecting Data, Models, and Internal Structures

AI governance for banks is most useful when it is understood as the layer that ties together what financial institutions already do well and where they already invest heavily: for example BCBS 239 compliance and three-lines structures as required by the EBA Guidelines on internal governance. A well-designed AI governance framework does not replace established disciplines. It inherits the rigor of data governance, expands the scope of model governance, and reinforces the decision-making clarity of internal governance.

In this article, we focus on the three areas that determine whether AI governance in financial institutions produces real risk reduction or remains a documentation exercise:

• Data governance for AI — the foundation on which every model depends
• AI model governance — designed for the specific risk profile of AI systems
• Internal governance — the structure that allocates accountability across the three lines of defense

Data Governance for AI: The Foundation That Cannot Be Skipped

Every AI system inherits the limitations of the data used to build it, that is, the data used to train the underlying model from scratch, the data used for retraining, the documents for RAG, or the data used for fine-tuning of a pre-trained model. For vendor models, a bank cannot inspect the pre-training data of a purchased foundation model, but it controls the data it adds on top.

In practice, the weakest data source typically constrains the operational value of even the most sophisticated AI system. For this reason, data governance for AI must go beyond a continuation of existing data management programs.

Banks should extend their data governance to cover, at minimum:

• Data suitability assessment for AI — a formal evaluation of whether data fits the intended use case, including representativeness, recency, label quality, and coverage of edge cases
• Bias detection procedures — systematic checks for disparate treatment and disparate impact across protected and proxy attributes
• Data provenance tracking — clear documentation of where data originated, how it was processed, and which transformations were applied before it reached the model
• Sensitive attribute handling — evidence that personal data, special-category data, and inferred attributes are treated in line with GDPR, the EU AI Act, and sector-specific rules

Where in case of vendor models the direct data access for an institution ends, governance shifts to vendor due diligence and outcome-based validation. Supervisors have been consistent in this point: outsourcing a model never outsources the accountability for its risks.

Model risk in practise: a model that performs well in development but fails in production often traces back to a data governance gap.

Model Governance Redesigned Under an AI Governance Framework

Model governance is the area most directly affected by AI. Traditional frameworks (SR 11-7, MaRisk module AT 4.3.4) are principle-based rather than technology-specific, yet their validation practices and supervisory expectations matured around linear, logistic, or tree-based models, where assumptions are explicit and validation procedures are largely standardized. The revised US guidance (SR 26-2) explicitly places generative and agentic AI outside its scope. Indeed, AI systems behave differently. They learn from high-dimensional inputs, can drift quickly, and may produce emergent behavior that is not anticipated during validation.

On the path toward AI model governance, three shifts deserve specific attention.

1. From periodic validation to continuous AI model monitoring. AI systems often deteriorate faster than classical models due to data drift and shifting customer or market behavior. Financial institutions should operate automated monitoring dashboards with predefined thresholds for performance, stability, and fairness metrics. Periodic AI model validation alone would leave a control gap that opens up between two annual reviews.
2. From optional to mandatory explainability standards. Explainability requirements in banking should be defined per use case, with minimum standards for customer-facing and high-impact internal decisions. In this connection methods such as SHAP and LIME are useful, but they only contribute to governance when they are embedded in the framework rather than applied ad hoc.
3. From one-time documention to disciplined AI lifecycle management. AI models evolve rapidly, and retraining cycles can occur weekly or even daily. Without strict version and change control, an institution may lose visibility over which model version produced which decision. That’s a problem that becomes acute during customer complaints, audits, or regulatory inquiries.

Beyond these three shifts, human oversight requirements for AI systems must be documented at each point where automated decisions affect customers or generate material risk. This includes defining what human reviewers can actually do, what they see, and which decisions they have authority to override. For high-risk AI systems, the EU AI Act will turn this into a formal requirement (Art. 14). Then generic "human-in-the-loop" statements will no longer be sufficient.

Finally, AI lifecycle management in financial services should specify, for each system, which roles or committees are responsible for design, validation, deployment, use, and retirement. Lifecycle accountability is the single control that prevents slow-burning risks from accumulating unnoticed.

Internal Governance: Anchoring Accountability for AI Risks

Internal governance provides the decision-making structure that determines who is accountable for AI risks and how the control functions interact with AI systems. AI governance does not replace these structures — it embeds itself into them.

Boards are expected to demonstrate transparency on AI usage, the associated risks, and the institution's capacity to oversee complex automated systems. In supervisory dialogues, board accountability for AI is a recurring theme: precise reporting lines, defined roles across the three lines of defense (a model the MaRisk adopt as their central control framework), and a working escalation mechanism for model-, data-, and AI-related incidents.

Each line of defense needs to evolve:

• First line (business and IT): Owns AI use cases and the day-to-day controls around data, deployment, and human oversight.
• Second line (risk and compliance): Must develop AI-specific expertise, particularly in explainability standards, fairness testing, and the regulatory mapping of AI use cases against the EU AI Act, MaRisk, and the related DORA expectations.
• Third line (internal audit): Must assess AI lifecycle controls, documentation completeness, and the maturity of the AI risk management approach.

Necessary action for most institutions: formalize how risk, compliance, and internal audit collaborate on AI — not as a one-off project but as a permanent operating model.

When AI governance is properly integrated into internal governance, financial institutions avoid fragmented oversight and can demonstrate to supervisors that AI is managed with the same rigor as credit, liquidity, or operational risk.

Bringing the Picture Together: What AI Governance Means for Banks

A coherent AI governance framework for financial institutions relies on the discipline of data governance, extends the scope of model governance, and strengthens the clarity of internal governance. When these three areas operate as a connected whole, financial institutions can deploy AI responsibly and at scale — and they can do so without exposing themselves to silent systemic risks that typically surface only when an incident is already underway.

Frequently Asked Questions

What is the difference between AI governance and model governance?

AI governance is broad: it covers data, models, internal structures, human oversight, vendor management, and the regulatory mapping of the full population of AI use cases. AI model governance is one component within AI governance, not a substitute for it.

Who should own AI governance in a bank?

Ownership typically sits with a senior accountable executive — often the Chief Risk Officer or a designated AI officer — with operational responsibility distributed across the three lines of defense for AI. The board retains ultimate accountability. Treating AI governance as an IT-led initiative is a common cause of failure. IT sits in the first line and delivers the very systems that governance must independently challenge. Moreover, material risks at stake are for example reputation risks rather than technology risks.

Which regulations shape AI compliance in the financial sector?

The EU AI Act, GDPR, DORA, MaRisk, and the EBA Guidelines on outsourcing arrangements all interact with AI governance. The EU AI Act adds use-case classification, risk management system requirements, and transparency obligations that financial institutions must map against their existing model risk frameworks.

How often should AI models be monitored?

Continuous monitoring is the appropriate default for production AI systems. Predefined thresholds for performance, data drift, and fairness should trigger automated alerts. Periodic validation continues to play a role, but it cannot replace ongoing model drift monitoring for systems exposed to dynamic data.

What does a dataset suitability assessment involve?

A dataset suitability assessment evaluates whether the data fits the intended use — covering representativeness, recency, label quality, coverage of edge cases, presence of bias, and alignment with the operational environment in which the model will run.

How does the three lines of defense model apply to AI risk?

The first line owns AI use cases and day-to-day controls. The second line provides independent risk management and compliance oversight, including AI-specific expertise in explainability and fairness. The third line audits the maturity of AI lifecycle controls and the effectiveness of the overall AI risk management framework.

How can a bank start implementing AI governance without slowing innovation?

Begin with an AI use-case inventory, classify each use case by risk and regulatory exposure, and apply proportional controls. Heavy controls belong on high-risk systems; lighter, standardized controls suit lower-risk experimentation. The aim is risk-based proportionality, not uniform restriction.