AI Risk and Governance Index: Where US banking is scaling, exposing, and confronting AI risk — in real time

Key findings

Among the key findings are:

• More than one-third of institutions identify model governance and validation as the primary barrier to scaling AI—outpacing fairness and explainability concerns by a significant margin.
• Nearly two-thirds of data risk concern is concentrated in synthetic data misrepresentation and automated data-quality errors, signaling a shift toward compounded, system-level data risk.
• Collections and recovery ranks as the highest-risk function for AI-driven customer harm, exceeding credit risk and underwriting by more than 10 percentage points.
• AI control priorities are tightly distributed, with fairness, monitoring, governance, and data assurance all emerging as simultaneous—not sequential—investment requirements.
• Over 70 percent of institutions report weakest preparedness in regulatory reporting and model kill-switch capabilities—the two incident response functions regulators will demand first.
• Automation bias has emerged as the leading human-centric AI risk, surpassing incentives and skills gaps, and elevating governance design as a behavioral—not just technical—challenge.

What you’ll learn

The full US Banking AI Risk and Governance Index provides detailed analysis across the core dimensions shaping AI risk exposure in banking:

• How institutions are addressing model governance gaps as deployment outpaces validation and monitoring infrastructure
• Why collections and customer-facing AI workflows represent the highest near-term regulatory and reputational exposure
• How third-party, data, and cloud dependencies are redefining systemic risk in AI ecosystems
• Why human factors—particularly automation bias—are becoming central to effective AI governance design

Download the full H1 2026 US Banking AI Risk and Governance Index to access detailed survey data, and actionable insights for institutions navigating the growing demands of AI governance, regulatory scrutiny, and operational risk at scale.