China's Banking AI Guidelines Require Board Oversight and Risk-Tiered Controls

What happened

Why it matters

• ·Banks and financial institutions operating in China face binding or quasi-binding expectations that AI used in credit, underwriting, or contract decisions must clear a risk committee before deployment. Non-compliance risks regulatory censure under China's Interim Measures for the Management of Generative Artificial Intelligence Services and related supervisory frameworks.
• ·The restriction on sensitive personal data in generative AI training creates a direct obligation to audit what data flows into any foundation model the bank fine-tunes or deploys internally. This closes a gap that many institutions have not yet addressed in their data governance programs.
• ·The board-level accountability requirement raises the stakes for directors personally. Organizations without a formal AI governance committee charter or documented risk appetite for AI will struggle to demonstrate compliance. A regulator or auditor asking who approved a high-risk AI deployment must receive a clear answer.

Governance controls affected

What to do now

• ☐Map every AI system currently used in credit approval, underwriting, claims assessment, or financial contract decisions and confirm that each one has documented risk committee approval before continued operation.
• ☐Audit the training data pipelines for any generative AI model the bank fine-tunes or self-hosts to confirm that sensitive personal information has been excluded, and document the controls that enforce this restriction.
• ☐Review the board or risk committee charter to confirm it explicitly assigns accountability for AI governance, including the authority to approve or reject high-risk AI deployments, and update it if that language is absent.
• ☐Establish or update the AI lifecycle management process to require human oversight checkpoints at deployment, at material model updates, and at periodic review intervals for all high-risk AI use cases.
• ☐Confirm that access controls for foundation models are documented, tested, and assigned to a named owner, and include this as a standing item in the next technology risk or model risk review.

What to watch next

Supervisory bodies in China are increasing the pace and specificity of AI-related guidance across financial services. Banks should monitor whether these guidelines harden into formal rules under the China Draft AI Law or through dedicated banking sector regulations. The Bank for International Settlements has separately flagged that AI strains core supervisory expectations on model governance, as covered in BIS Warns AI Strains Core Bank Supervisory Expectations on Model Governance. Chinese regulatory signals may align with a broader international supervisory trend. Organizations with cross-border operations should track whether these requirements influence guidance from other regulators, particularly in jurisdictions where AI in financial services is under active review.