AI Governance for Financial Services
Most financial institutions already have model risk management programs. Extend those processes to generative and agentic AI. Identify where autonomous actions need controls the existing program does not cover.
Start with existing model risk management
Banks using frameworks such as SR 11-7 already maintain model inventories, validation processes, and lifecycle governance. A Fortune 500 bank case study describes centralizing the inventory and tracking models through their lifecycle. It also describes automated compliance workflows. Apply that work to AI within the infrastructure used for traditional models.
Review the gaps created by autonomous actions
Traditional model risk frameworks assume people act on model outputs. Agents can execute trades, approve transactions, or interact with customers themselves. The Bank of England has signaled that agentic AI may need bespoke regulatory frameworks. Existing financial rules were not designed around autonomous decisions. Review agent-specific governance wherever current model risk controls leave those actions uncovered.
Input validation failures have direct financial consequences
A data poisoning attack forced a financial AI agent to recommend fabricated securities. The incident exposed a validation gap. Testing historical output accuracy alone would miss resistance to adversarial inputs. Include poisoned data and other adversarial inputs in financial AI validation.
Regulators are already watching concentration risk
AI investment strategies face scrutiny over concentration risk. The SEC's probe of an AI-focused hedge fund illustrates questions that extend beyond individual model accuracy. Include concentration and correlation across AI-driven strategies in board risk reporting, alongside model performance.
Related guidance
Find your financial services AI governance gaps
Use the self-assessment to identify gaps between your model risk program and your use of generative or agentic AI.
Start the self-assessment