Building trustworthy AI governance

Oversight and accountability

As artificial intelligence becomes more deeply embedded in organizational processes, oversight and accountability take center stage. The role of an AI Governance Officer (or equivalent) becomes increasingly critical. This individual serves as a key figure in ensuring that AI systems and their use are not only effective but also strategically, ethically and legally sound, helping to steer the bank through the potentially complex landscape of AI governance, balancing innovation with responsibility.

Federal guidance already points to a clear model for oversight. The federal policies we noted earlier require federal agencies to assign a Chief AI Officer (CAIO) to oversee AI governance, risk management, and strategy. In the banking sector, the Chief Compliance Officer (CCO) stands out as uniquely positioned to oversee a bank’s AI governance efforts. This is not only due to their deep understanding of regulatory frameworks and risk management, but also because AI governance intersects with core compliance responsibilities like data privacy, ethical use, transparency, accountability, and third-party risk.

CCOs already manage regulatory risk, coordinate across departments, interact with boards, and understand the legal implications of data-driven decisions. The GAO report, for example, highlights the importance of cross-functional leadership and interagency coordination — skills compliance professionals routinely exercise. By taking a leadership role in AI governance, compliance officers can ensure that AI systems meet ethical standards, regulatory requirements, and internal controls. Their involvement also helps bridge the gap between technical teams and executive leadership, fostering a culture of responsible innovation. In short, compliance officers can help banks adopt AI responsibly — shaping innovation while safeguarding institutional integrity.

Responsibilities of the AI governance function

The governance function in a U.S. bank, typically headed by the board of directors, is responsible for setting the strategic direction of the institution and ensuring compliance with laws, rules and regulations that apply to its business model. This includes overseeing the ethical, secure, and compliant deployment of artificial intelligence technologies across the organization. That work begins with knowing where, how and with whom the bank uses or wants to use AI and ensuring those initiatives align with the bank’s strategic goals, risk appetite, and ethical standards.

Key responsibilities include:

1. Maintaining regulatory compliance.
A key responsibility is maintaining regulatory compliance by keeping current with federal and state laws, including those related to topics like privacy, algorithmic fairness, cybersecurity, and consumer protection.

2. Setting strategy and policies.
A bank’s governance function is also responsible for developing and enforcing policies that reflect applicable regulations and ethical guidelines, ensuring consistent implementation across the institution. This also means aligning AI initiatives with broader enterprise risk management and model-risk frameworks.

3. Cross-functional collaboration
AI governance requires deep cross-functional collaboration across all areas of the bank, such as risk, compliance, IT, legal, operations, and most importantly, senior leadership and the board. Effective AI governance requires cross-functional collaboration, as no single area can fully assess all associated risks.

4. Risk assessment and mitigation
Risk assessments are another key function of AI governance, involving the identification of potential compliance issues such as bias, lack of transparency, or misuse of data, and recommending strategies to mitigate these risks.

5. Training and awareness
Additionally, the AI governance function plays a vital role in educating employees about responsible AI practices, compliance obligations, and fostering a culture of awareness and accountability. Because employees are already using AI tools in their daily work, training should be accompanied by a clear policy that restricts use to bank-approved, monitored systems. Periodic attestations of understanding and compliance can reinforce accountability. As with other high-risk compliance obligations, they may also consider requiring a periodic attestation of understanding of the policy and their adherence to it.

6. Auditing and reporting
Regular audits and reporting are also part of the AI governance team’s remit, providing oversight and transparency to the board and senior leadership and, as necessary, to regulatory bodies. This reinforces trust in the governance framework and demonstrates the institution’s commitment to responsible AI oversight.

Recommended actions

The following steps draw from leading federal resources that can help financial institutions build effective AI governance programs. While some, like the Federal Reserve’s SR 11-07, are binding for specific entities, others, like the NIST Framework and the GAO report are voluntary but influential and are often used to help shape internal policies and risk frameworks. Together, they provide a strong foundation for structuring internal policies and controls.

1. Designate a Senior AI Leader
First, designate a CAIO or similarly titled position. Assign this position to a senior compliance or risk leader to oversee AI governance, consistent with federal agency guidelines and applicable state standards. In many banks, the Chief Compliance Officer (CCO) is best positioned for this role given their cross-departmental oversight and deep understanding of regulatory and ethical frameworks.

2. Create and Maintain an AI Use-Case Inventory
Next, create a comprehensive inventory of the bank’s current AI use cases Interview your different departments to find out how they are using AI. Engage each department to identify how AI is currently being used or tested — including lesser-known areas such as procurement, vendor management, or HR — to ensure full visibility. You may find, for example, that the bank is paying for multiple products/solutions that essentially do the same or very similar things utilizing AI. Look for overlapping tools or redundant vendors to minimize the number of third parties providing AI-related services. Keep only those relationships with dependable, well-known vendors that have transparent risk controls, and a proven track record and strong reputation with your bank and/or peers.

3. Implement Ongoing Controls and Risk Assessments
Once the inventory is established, implement ongoing controls to maintain and update it regularly. This is especially important for those use cases with high impacts on customer rights, safety, or access to financial services. Conduct risk assessments w to determine what levels of ongoing control and oversight may be needed. Once assessed, apply strong risk management practices to ensure the application of pre-deployment testing, impact assessments, and ongoing risk-based monitoring.

4. Align Existing Policies with AI-Specific Risks
Ensure internal policies relevant to the use of AI such as data governance, IT infrastructure, privacy, and cybersecurity reflect AI-specific risks and controls. Establish oversight mechanisms such as an internal AI governance board or cross-functional team to coordinate decision-making and ensure accountability. Regularly solicit feedback from your stakeholders such as customers, employees, and external experts.

5. Publish an AI Strategy to Promote Transparency

OMB M-25-21 is emerging as a possible de facto standard for responsible AI in the private sector as banks and other financial institutions use it as a benchmark to help shape their own AI governance programs. Banks can elect to align with this approach by publishing an AI strategy as directed for federal agencies by OMB M-25-21. If used, it could include current and planned AI use cases, governance structures, risk protocols, and plans for workforce development. Making your AI strategy publicly accessible promotes greater transparency and builds trust with stakeholders by demonstrating a commitment to responsible and ethical AI practices.

Key elements of an AI governance program

An effective AI governance program is anchored in oversight and accountability, with clearly defined structures that ensure responsible decision-making and risk management. At the highest level, the board of directors must fully approve the governance framework, signaling organizational commitment and ensuring alignment with strategic, ethical, and regulatory priorities. Senior management plays a critical role in operationalizing this framework, translating board-level directives into actionable policies and procedures.

Cross-functional oversight
Oversight should be carried out by a cross-functional governance committee that include representatives from across the organization such as compliance, legal, data science, IT, risk, and business operations. Consider charging this committee with evaluating AI systems across their lifecycle, from design and training to testing, deployment and monitoring. This step ensures that decisions are made collaboratively and transparently.

Comprehensive documentation is essential to each stage of this process, capturing model development, data sources, decision logic, risk assessments, and mitigation strategies. This documentation supports traceability, facilitates audits, and enables meaningful engagement with regulators and stakeholders.

Phased implementation and measurement
Effective governance programs are built in phases, beginning with a risk assessment and stakeholder mapping, followed by policy development, employee training, and system integration. Key performance indicators (KPIs) — such as model accuracy, fairness metrics, incident response times, and audit completion rates — should be established to measure effectiveness and drive continuous improvement. Case studies from similar organizations or industries can provide valuable insights into successful governance models and common pitfalls.

Embedding ethical and technical safeguards
To ensure responsible AI usage, governance programs should incorporate best practices that reflect both technical and ethical standards. These include maintaining a human-in-the-loop for critical decision-making processes, especially for high-risk use cases. Subject matter expert oversight should be embedded throughout the AI lifecycle to validate assumptions, interpret outputs, and guide ethical use. Where appropriate, organizations may opt for closed-system large language model (LLM) installations to enhance data security, reduce exposure to external risks, and maintain tighter control over model behavior.

Transparency and customer rights
Consider providing customers with the ability to opt out of AI-driven decisions and request human review. Ensure appeal processes are accessible, fair, and timely (OMB M-25-21, OECD AI Principles).

Building a living framework
Ultimately, a governance program should be a dynamic, living framework — approved by the board, championed by leadership, and embedded across the organization. It must evolve alongside technological advancements and regulatory shifts, ensuring that AI systems remain trustworthy, transparent, and aligned with the organization’s mission and values.

Conclusion
AI governance is not optional — it’s foundational to your bank’s future. Federal agencies have laid out a roadmap that banks can adapt to their own operations, starting with leadership, strategy, risk management, and transparency. Banks should take the lead in translating these federal expectations into banking best practices. By doing so, they will not only protect their institutions from risk but also unlock the full potential of AI to serve customers, improve efficiency, and drive innovation. The tools and guidance already exist — what remains is for institutions to act with intention, ensuring their AI use is responsible, explainable, and aligned with regulatory and ethical standards.