AI Governance Institute
← News
Research2026-10-25

Only 18% of Banks Have Fully Embedded AI Governance, SAS Survey Finds

What happened

SAS and FT Longitude published the FT Longitude AI Risk Report, a global survey of banking institutions examining AI governance maturity. The report found that only 18% of banks have fully operational, organization-wide AI governance processes in place, with the remainder at partial or early-stage maturity. Only 19% of respondents have real-time monitoring to detect when AI models start performing differently from how they were originally built and tested, a process known as drift monitoring. Critically, 42% have no defined procedures to shut down or constrain AI models that cross preset risk boundaries. These findings arrive as banking supervisors are actively examining whether AI governance programs can be audited. Related pressure comes from the ECB Requires Bank AI Cyber Action Plans by October 31, 2026. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) also updates expectations for model oversight.

Why it matters

  • ·The 42% kill-switch gap is directly measurable by examiners. Banks without documented, tested procedures to halt or contain a misbehaving AI model now face a named deficiency against a published industry benchmark, increasing examination and enforcement exposure.
  • ·The 19% real-time drift monitoring figure means most banks cannot demonstrate that the AI model a regulator approved is still behaving the same way today. Without ongoing monitoring, model risk policies required under the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) are difficult to substantiate in an audit.
  • ·The ambition gap is the deeper risk: banks plan to expand AI into consequential decisions even as governance maturity lags. Boards approving AI expansion without addressing this gap are accumulating liability that regulators and, increasingly, investors are beginning to quantify.

Governance controls affected

CHM-003Model Rollback and Emergency ShutdownMON-002Model Drift DetectionALC-004AI Explainability DocumentationHOC-007Board AI Risk Reporting and Escalation ThresholdsBRD-006AI Risk Tolerance and Appetite Documentation

What to do now

  • ☐Run the survey's three key metrics against your own program: ask your model risk team to confirm what percentage of AI models have (1) real-time drift monitoring active, (2) a defined and tested shutdown procedure, and (3) a current explainability document that a regulator could read.
  • ☐Test your kill-switch procedures: schedule a tabletop exercise in which a model is assumed to have crossed a risk threshold and verify that the shutdown steps work end to end, including who has authority to act and how long it takes.
  • ☐Map which AI models are making or influencing consequential decisions (credit, fraud, pricing) without a documented human override path, and escalate any gap to your model risk committee within 30 days.
  • ☐Confirm that board AI risk reporting covers governance maturity metrics, not just model performance numbers: directors should see the percentage of models with active monitoring and tested shutoff procedures at least quarterly.
  • ☐Use the 18% benchmark when briefing your audit committee: frame your program's current maturity level against the survey data so the board understands where the institution stands relative to peers and what regulators are likely to ask.

What to watch next

Banking supervisors in multiple jurisdictions are moving from guidance to examination questions, and this survey gives them a ready-made peer comparison. Compliance teams should track whether the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is followed by further supervisory letters citing industry maturity data. The BIS Warns AI Strains Core Bank Supervisory Expectations on Model Governance signal suggests international coordination on examination criteria is advancing. Any bank planning to expand AI autonomy in credit or fraud decisions should expect examiners to ask specifically about drift monitoring and kill-switch readiness before approving new deployments.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Research2026-10-24

FSB Names Concentration and Model Governance as AI's Systemic Financial Risks

The Financial Stability Board published a report on October 21, 2026, identifying AI-related risks to the financial system. Risks include dangerous concentration among a small number of AI providers, weak model governance, data quality gaps, cyber exposure, and poor explainability. The FSB recommends that firms integrate AI risk management proportionately into existing governance and risk structures rather than building parallel programs. The report applies globally and gives prudential supervisors a ready benchmark for examinations.

Research2026-10-19

China's Banking AI Guidelines Require Board Oversight and Risk-Tiered Controls

New guidance for Chinese banks sets board-level accountability for AI governance, cross-functional coordination, and full lifecycle management of AI systems. High-risk uses such as credit approval, underwriting, and financial contract decisions require risk committee sign-off, human oversight, and in some cases regulatory reporting. The guidelines also restrict use of sensitive personal information in generative AI training and impose access controls on foundation models.

Research2026-10-15

80% of EMEA Enterprises Escalate AI Incidents to the Board, IBM Finds

IBM's October 2026 study of EMEA enterprises finds that eight in ten organizations now escalate AI incidents to board or C-suite level. Despite this visibility, accountability structures and governance capabilities are not keeping pace with AI adoption. Agentic AI deployments are accelerating the problem by creating new incident types that existing escalation frameworks were not designed to handle.