AI Governance Institute
← News
Research2026-10-11

JPMorgan and HSBC Embed AI Governance Into Firm-Wide Risk Structures

What happened

According to a report in The Asian Banker, JPMorgan Chase and HSBC have stopped treating AI governance as a separate compliance function. They are instead weaving it into existing firm-wide risk and control structures. Both institutions link AI oversight to model risk management, data governance, conduct risk, and senior management accountability in a single integrated program. A central tool in this approach is a use-case scorecard. It rates each AI application on dimensions including consumer impact, explainability to regulators, and potential systemic relevance. The scorecard creates a tiered review process, with higher-risk applications requiring more intensive oversight before and after deployment. This mirrors the direction signaled by supervisory guidance, including the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2). It also aligns with governance benchmarks discussed in coverage of SR 26-2 Forces Banks to Rethink Model Governance From Inventory to Board Oversight.

Why it matters

  • ·Regulators examining banks under the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) now have a peer-institution benchmark to compare against. Firms without integrated AI risk structures face a higher bar to demonstrate supervisory adequacy.
  • ·The use-case scorecard model makes explainability and consumer impact formal gate criteria, not aspirational principles. Compliance teams that lack a documented classification process for AI applications risk gaps in audit readiness and regulatory examination responses.
  • ·Embedding AI governance under senior management accountability raises the stakes for individual executives. If an AI system causes consumer harm or a conduct breach, the accountability trail now runs to named individuals rather than abstract governance committees.

Stay ahead of stories like this

Get developments like this, plus everything else that matters in AI governance. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

HOC-001AI System Risk ClassificationALC-002High-Risk AI Audit TrailBRD-002AI Governance Committee Charter and Decision RightsALC-004AI Explainability DocumentationMGV-002AI System Intake and Approval Workflow

What to do now

  • ☐Map your current AI governance structure against your existing model risk, data governance, and conduct risk frameworks to identify where AI oversight sits outside those structures.
  • ☐Ask the risk team whether each AI application in use has been classified using a documented scorecard or equivalent tool that records consumer impact and explainability criteria.
  • ☐Confirm that a named senior executive is accountable for AI governance outcomes, not just a committee or policy document, and that accountability is recorded in governance documentation.
  • ☐Review your AI model inventory to determine which applications would qualify as high-risk under a consumer-impact or systemic-relevance standard, and flag any lacking a formal pre-deployment review record.
  • ☐Bring the JPMorgan and HSBC integrated model to your next governance committee meeting as a benchmark and ask whether your program structure would satisfy the same supervisory scrutiny.

What to watch next

Banking supervisors are increasing AI-specific examination activity, and peer institutions are setting documented benchmarks that examiners can reference. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is already shaping examination expectations. The Financial Stability Board AI in Finance report continues to influence cross-border supervisory thinking. Compliance teams should monitor whether regulators begin explicitly citing integrated governance structures as a condition of satisfactory examination findings. They should also watch whether the scorecard model used by large institutions becomes an informal industry standard that smaller firms are expected to adopt or explain away.

Related Coverage

Research2026-11-01

Financial Model Risk Frameworks Miss Most AI Systems, Research Finds

A peer-reviewed study in the Journal of Banking Regulation finds that financial institutions' model risk management programs contain systematic gaps when applied to AI systems. The research identifies three core weaknesses. These are: model definitions that exclude many AI tools, tiering criteria that don't reflect AI-specific failure modes, and vendor governance protocols that haven't kept pace with third-party AI procurement. The authors propose targeted fixes for each gap, illustrated through market risk modeling, enterprise chatbots, and AI use-case discovery.

Research2026-10-24

FSB Names Concentration and Model Governance as AI's Systemic Financial Risks

The Financial Stability Board published a report on October 21, 2026, identifying AI-related risks to the financial system. Risks include dangerous concentration among a small number of AI providers, weak model governance, data quality gaps, cyber exposure, and poor explainability. The FSB recommends that firms integrate AI risk management proportionately into existing governance and risk structures rather than building parallel programs. The report applies globally and gives prudential supervisors a ready benchmark for examinations.

Corporate Policy2026-10-30

Humanist AI Exemption Expands Who Qualifies for Workplace Accommodation

A University of Kentucky administrator became the first publicly known humanist to secure a workplace religious accommodation allowing him to opt out of employer-mandated AI tool use. The American Humanist Association confirmed that nontheistic, sincerely-held belief systems qualify for the same legal protections as traditional faiths under US employment law. Enterprises with mandatory or strongly encouraged AI adoption policies must now review their accommodation processes to account for a broader population of eligible objectors.