AI Governance Institute
← News
Research2026-10-25

Only 18% of Banks Have Fully Embedded AI Governance, SAS Survey Finds

What happened

SAS and FT Longitude published the FT Longitude AI Risk Report, a global survey of banking institutions examining AI governance maturity. The report found that only 18% of banks have fully operational, organization-wide AI governance processes in place, with the remainder at partial or early-stage maturity. Only 19% of respondents have real-time monitoring to detect when AI models start performing differently from how they were originally built and tested, a process known as drift monitoring. Critically, 42% have no defined procedures to shut down or constrain AI models that cross preset risk boundaries. These findings arrive as banking supervisors are actively examining whether AI governance programs can be audited. Related pressure comes from the ECB Requires Bank AI Cyber Action Plans by October 31, 2026. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) also updates expectations for model oversight.

Why it matters

  • ·The 42% kill-switch gap is directly measurable by examiners. Banks without documented, tested procedures to halt or contain a misbehaving AI model now face a named deficiency against a published industry benchmark, increasing examination and enforcement exposure.
  • ·The 19% real-time drift monitoring figure means most banks cannot demonstrate that the AI model a regulator approved is still behaving the same way today. Without ongoing monitoring, model risk policies required under the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) are difficult to substantiate in an audit.
  • ·The ambition gap is the deeper risk: banks plan to expand AI into consequential decisions even as governance maturity lags. Boards approving AI expansion without addressing this gap are accumulating liability that regulators and, increasingly, investors are beginning to quantify.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

CHM-003Model Rollback and Emergency ShutdownMON-002Model Drift DetectionALC-004AI Explainability DocumentationHOC-007Board AI Risk Reporting and Escalation ThresholdsBRD-006AI Risk Tolerance and Appetite Documentation

What to do now

  • ☐Run the survey's three key metrics against your own program: ask your model risk team to confirm what percentage of AI models have (1) real-time drift monitoring active, (2) a defined and tested shutdown procedure, and (3) a current explainability document that a regulator could read.
  • ☐Test your kill-switch procedures: schedule a tabletop exercise in which a model is assumed to have crossed a risk threshold and verify that the shutdown steps work end to end, including who has authority to act and how long it takes.
  • ☐Map which AI models are making or influencing consequential decisions (credit, fraud, pricing) without a documented human override path, and escalate any gap to your model risk committee within 30 days.
  • ☐Confirm that board AI risk reporting covers governance maturity metrics, not just model performance numbers: directors should see the percentage of models with active monitoring and tested shutoff procedures at least quarterly.
  • ☐Use the 18% benchmark when briefing your audit committee: frame your program's current maturity level against the survey data so the board understands where the institution stands relative to peers and what regulators are likely to ask.

What to watch next

Banking supervisors in multiple jurisdictions are moving from guidance to examination questions, and this survey gives them a ready-made peer comparison. Compliance teams should track whether the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is followed by further supervisory letters citing industry maturity data. The BIS Warns AI Strains Core Bank Supervisory Expectations on Model Governance signal suggests international coordination on examination criteria is advancing. Any bank planning to expand AI autonomy in credit or fraud decisions should expect examiners to ask specifically about drift monitoring and kill-switch readiness before approving new deployments.

Related Coverage

Research2026-11-12

OCC Supervisory Framework Puts Generative and Agentic Bank AI Under Examiner Scrutiny

The OCC issued a supervisory framework on November 4, 2026. It guides examiners reviewing how national banks and federal savings associations use AI in credit decisioning, payments, fraud detection, customer service, and risk management. The framework is non-binding and sets no new enforceable standards. It fills a governance gap left by the April 2026 interagency model risk management guidance, which explicitly excluded generative and agentic AI as 'novel and rapidly evolving.' Banks with material AI deployments in those categories now face structured examiner scrutiny without previously having been required to build matching controls.

Research2026-11-07

Board AI Oversight Disclosures Are Now Under Proxy-Season Scrutiny

A Harvard Law School Forum on Corporate Governance analysis finds that board-level AI oversight disclosures are increasing among large public companies. Expectations now extend well beyond naming a responsible committee. Companies face scrutiny on whether they have defined accountability structures, escalation triggers, measurement frameworks, and board-use rules for AI tools.

Research2026-11-06

IIA Sets Banking AI Audit Baseline With 12-Bank Input

The Institute of Internal Auditors has published a principles-based audit structure for AI in banking organizations, developed with input from 12 global banks. The guide covers governance and policy, risk taxonomy, model risk management, cybersecurity, operational resilience, third-party management, and AI literacy. It gives internal audit teams a practical basis for scoping AI reviews and testing whether controls are actually working.