AI Governance in Banking

Why governance decides whether AI ships

In most industries an AI system can go live on the strength of a good demo. In a bank it cannot. Output that reaches a client or a regulator has to be defensible, sometimes years later. The hard questions are therefore not about the model. They are about approval, access, oversight and accountability, and until those are answered, nothing moves from pilot to production.

What good AI governance owns

• Approval. Which workflows may use AI at all, and on what evidence a new one is approved.
• Access. A named list of who can use each system, not everyone with a login.
• Traceability. Every answer traceable to the version and sources that produced it.
• Human oversight. Where a person must review, and how much review is really needed.
• Sign-off. A go-live decision with a name against it.
• Monitoring. Someone who sees a system drift before a client does.
• Cost control. Model choice and spend managed centrally, not left to hundreds of individual users.

These map closely to what regulators already expect: the PRA’s SS1/23 principles on model risk management, which explicitly cover AI and machine learning, and the EU AI Act’s requirements on logging, human oversight and deployer obligations for high-risk systems.

Governance as an accelerator

The purpose of governance is not to say no. It is to make yes repeatable. When the rules are written down and built into the platform, teams can use AI with confidence and new workflows ship quickly, because each one follows a known path. Governance written this way also makes a capability durable: it survives mergers, restructurings and leadership changes because it does not depend on any single expert.

In practice

Prerit Ahuja owns AI governance for the production AI platform in DNB Carnegie’s Investment Banking Division: workflow approval, access control, human review, cited answers and central cost control. That governance is a large part of why the platform and its adoption held through a merger, a restructuring and changes of leadership.

What does AI governance in a bank cover?

Workflow and use-case approval, access control, human-in-the-loop design, model and version traceability, sign-off before go-live, monitoring for drift, and model risk management. It applies to generated output, not only to traditional models.

Which regulations shape AI governance for UK and EU banks?

The PRA's supervisory statement SS1/23 on model risk management, which covers AI and machine learning models, and the EU AI Act, whose obligations for high-risk systems include logging, human oversight and deployer duties.

Does governance slow AI adoption down?

Not when it is designed with the workflows. Clear approval paths and access rules let teams use AI without asking permission each time. Informal governance is what slows adoption, because every new use case restarts the argument.

Who should own AI governance?

One accountable owner, typically a Chief AI Officer or Chief Data and AI Officer, working with risk, compliance and the business. When ownership is split, AI accumulates as disconnected pilots.