AI arrives in a bank from many directions at once: a fraud model from one vendor, a chatbot from another, a staff member pasting text into a public assistant. Governance is how a bank turns that scattered adoption into something it can explain to its board and its regulator.
Step one: build an inventory
You cannot govern what you have not listed. Start with a register of every AI system in use or in procurement: what it does, who owns it, what data it uses, and which customers or decisions it affects.
Step two: rate the risk
Not every system needs the same scrutiny. An assistant that drafts internal emails is different from a model that decides who gets credit. Rate each system on the harm it could cause, the data it touches and how much a person checks its output.
Step three: set the rules
- A policy that says which uses are allowed, which need approval and which are prohibited.
- Clear owners for each system, with responsibility for its performance and its failures.
- Requirements for human review where decisions affect customers.
- Records: what was approved, when, by whom, and on what evidence.
Step four: keep checking
Models change, vendors update their products and new uses appear. Governance is a cycle of review, not a document written once. Schedule reviews, track incidents and update the inventory as part of normal operations.
Standards such as ISO/IEC 42001 give this work a recognised structure. But the first useful step needs no standard at all: a complete list of where AI is already at work in your bank.
