JPMorgan and HSBC Embed AI Governance Into Firm-Wide Risk Structures

What happened

Why it matters

• ·Regulators examining banks under the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) now have a peer-institution benchmark to compare against. Firms without integrated AI risk structures face a higher bar to demonstrate supervisory adequacy.
• ·The use-case scorecard model makes explainability and consumer impact formal gate criteria, not aspirational principles. Compliance teams that lack a documented classification process for AI applications risk gaps in audit readiness and regulatory examination responses.
• ·Embedding AI governance under senior management accountability raises the stakes for individual executives. If an AI system causes consumer harm or a conduct breach, the accountability trail now runs to named individuals rather than abstract governance committees.

Governance controls affected

What to do now

• ☐Map your current AI governance structure against your existing model risk, data governance, and conduct risk frameworks to identify where AI oversight sits outside those structures.
• ☐Ask the risk team whether each AI application in use has been classified using a documented scorecard or equivalent tool that records consumer impact and explainability criteria.
• ☐Confirm that a named senior executive is accountable for AI governance outcomes, not just a committee or policy document, and that accountability is recorded in governance documentation.
• ☐Review your AI model inventory to determine which applications would qualify as high-risk under a consumer-impact or systemic-relevance standard, and flag any lacking a formal pre-deployment review record.
• ☐Bring the JPMorgan and HSBC integrated model to your next governance committee meeting as a benchmark and ask whether your program structure would satisfy the same supervisory scrutiny.

What to watch next

Banking supervisors are increasing AI-specific examination activity, and peer institutions are setting documented benchmarks that examiners can reference. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is already shaping examination expectations. The Financial Stability Board AI in Finance report continues to influence cross-border supervisory thinking. Compliance teams should monitor whether regulators begin explicitly citing integrated governance structures as a condition of satisfactory examination findings. They should also watch whether the scorecard model used by large institutions becomes an informal industry standard that smaller firms are expected to adopt or explain away.