What Regulators Are Finding in Banks' AI Risk Management

Key Takeaways

• Assurance Methods: APRA's April 30 letter, drawing on a late-2025 review of selected large banks, insurers and superannuation trustees, found reliance on point-in-time, sample-based assurance poorly suited to adaptive, probabilistic AI. Few entities had continuous validation or monitoring.
• Post-Deployment Controls: In the Bank of England–FCA survey of UK financial services firms (196 responses, 105 to the full questionnaire on which most figures are based), more than 90% reported human approval, pre-deployment review and vendor due diligence. Only 52% reported routinely monitoring drift or bias indicators, and 34% monitored associated risk metrics.
• Third-Party Oversight: Externally provided systems made up 53% of respondents' highly material AI systems. For those third-party systems, 81% of respondents relied on vendor assurance and contracts and 59% on assurance of behavior or outcomes. APRA found limited evidence of contract provisions on audit rights, model updates and incident notification.
• Uneven European Governance: Pedro Machado, an ECB representative on its Supervisory Board, said in February that banks' AI governance "remains uneven." He pointed to fragmented ownership and called for explanations that serve decision-makers, risk managers, auditors and senior management.
• US Supervisory Position: The April interagency model risk guidance excludes generative and agentic AI and sets no enforceable requirements. The OCC's November framework guides examiners on AI broadly without creating new expectations. Neither publishes examination findings.

Deep Dive

In a letter sent on April 30 to every institution it supervises, the Australian Prudential Regulation Authority reported that assurance over artificial intelligence at the large banks, insurers and superannuation trustees it had reviewed was relying on methods designed for a different kind of system. Assurance providers were leaning on point-in-time, sample-based testing, which APRA judged poorly suited to probabilistic models that "learn, adapt and degrade over time." Many internal audit and risk functions, it added, lacked the specialist skills and tools to assess AI. Its summary was plain: "assurance practices are not keeping pace with the scale, speed and complexity of AI."

Sampling is a sound way to test a probabilistic system, provided the sample design, the frequency of testing and the evaluation criteria reflect how the system actually behaves. The weaker element in what APRA describes is the point-in-time part. No control holds its effectiveness indefinitely. Staff turn over, processes erode and controls get worked around, and assurance cycles are set with those risks in mind. Many AI systems add another source of change. A model that is retrained or updated, or whose inputs move away from the data it was built on, can produce different results while the controls around it stay exactly as they were. Even a model fixed at deployment is exposed to the second of those. Tested once against criteria set at approval, such a system can perform as intended on the day and drift well before the next review. APRA's concern is whether the cadence and design of assurance match the ways the system being assured can change.

APRA's letter is one of several documents published this year that deal with the period after an AI system has been approved. They are different kinds of evidence and should be read that way. APRA reports aggregate findings from a supervisory review. A February speech by Pedro Machado, one of the European Central Bank's representatives on its Supervisory Board, described what supervisors had observed without publishing institution-level results. The survey released by the Bank of England and the Financial Conduct Authority on October 26 records what firms said about their own controls. The documents issued by US banking agencies in April and November set out model risk guidance and an examiner framework for AI, and disclose nothing about what examiners have found. Read separately, the first three still return to the same two subjects: the controls meant to operate after deployment, and the large share of AI that institutions acquire from outside.

The British survey is the only one of these sources that breaks AI governance down control by control, which makes it the most useful place to see where the gap opens. It is the fourth such exercise the two regulators have run, and it drew 196 responses. Only 105 completed the full questionnaire, and unless the report says otherwise its percentages are based on those full responses. Banks were a minority of the 196: 23 UK banks and 21 respondents in a category combining international banks operating in the UK with PRA-regulated broker-dealers, against 100 investment and capital markets firms and smaller groups of insurers, non-bank lenders, payments firms and market infrastructure providers. The percentages are what those firms reported about themselves, so they describe financial services broadly, not banking.

On the architecture of governance, the answers were close to unanimous. Ninety-four percent of respondents reported firmwide AI policies, principles or standards, and 84% a centralized AI or model-risk governance forum. The gates in front of deployment were just as widely reported: human approval at 95%, pre-deployment review of privacy and data security at 95%, contractual or vendor due diligence at 94%.

The controls that operate afterward were reported less often. Ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half of respondents. Fifty-two percent said they routinely monitor indicators of model drift, bias or data drift. Thirty-nine percent monitor customer-impact metrics for their AI systems, and 34% monitor associated risk metrics.

None of this establishes that the remaining firms are out of compliance with anything. The survey also cannot distinguish a firm that has judged continuous monitoring disproportionate for a handful of low-stakes tools from one that simply has not built it. Proportionality, though, presupposes that a firm knows which of its systems matter. Sixty-two percent of respondents reported a formal process for classifying AI systems by materiality, and 68% a central inventory. Counting arrangements that were partial or still in development, those figures rise to 87% and 92%. On both measures, roughly a third of respondents had not completed the work.

Machado's speech, delivered at the KPMG RiskTech Conference in Frankfurt on February 24, described the European picture without percentages. Supervisors, he said, had watched banks adopt AI policies, establish dedicated committees or centers of expertise, and clarify how AI use cases are approved, but "governance remains uneven across institutions and use cases." He drew on an annual data collection showing that more than 85% of large banks under ECB supervision use AI in some form, on workshops with banks using it in credit risk and fraud detection, and on targeted reviews and on-site inspections in 2024 and 2025. He did not say how often the weaknesses he described occurred, but the concerns he set out correspond closely to the gaps in the British figures. One concern supervisors continue to encounter, he said, is ownership of AI split across IT, data science teams, business lines and control functions without a clear accountability framework. Risk management, compliance and internal audit were expected to provide robust challenge. Because machine-learning models change as their data changes, Machado said, banks need continuous performance monitoring to detect drift and unintended effects, with defined routes for escalation and remediation.

His treatment of explainability went further than the familiar demand for documentation. Explainability tools were spreading, and supervisors welcomed them, but technical explanations and model documentation were not sufficient by themselves. An explanation had to serve the people who make decisions with a model, the risk managers who challenge its output, the auditors who review it independently and the senior managers who answer for it. In effect, the standard applies across all three lines of defense. Framed this way, explainability is a governance question: do the committee that approves a model, the function that challenges it and the board that oversees it each have enough information to do what their role requires? A bank that cannot supply that information has not relieved those people of responsibility, which Machado said AI does not dilute. It has made that responsibility harder to discharge, and APRA's finding that boards lean on vendor presentations shows how the problem looks at the top of the institution.

He also said that AI "shifts supervisory attention upstream from models to data," and singled out retail credit and customer segmentation, where historical data can carry structural biases. The conclusion he drew was prudential. Bias becomes a supervisory concern for risk, and not only for conduct, when it leads a bank systematically to underestimate or misprice risk, or produces concentration effects. That brings bias testing within the remit of credit risk and model risk functions as well as conduct and compliance.

APRA covers similar ground with more severity, and with the weight of a review whose findings it chose to publish. The letter went to all APRA-regulated entities and draws on banks, insurers and superannuation trustees together, so its conclusions should not be read as a verdict on Australian banks alone. APRA did not say how many institutions it examined.

Boards, it found, showed strong interest in AI's potential benefits, but many were still "developing the technical literacy required to provide effective challenge," and APRA noted "an overreliance on vendor presentations and summaries." Entities tended to treat AI risk as "just another technology," overlooking characteristics such as adaptive behavior. APRA found weak controls over post-deployment monitoring, model behavior monitoring, change management and decommissioning, and few entities had continuous validation or monitoring capable of detecting drift, bias or control breakdowns in good time. On information security, APRA found that identity and access management capabilities "have not yet adjusted to nonhuman actors such as AI agents." APRA describes its prudential framework as principle-based and technology and vendor agnostic, and notes that most entities recognize existing prudential standards apply to AI risk. The letter sets out expectations within that framework; it does not introduce a new prudential standard.

Someone Else's Model

In the British survey, third-party systems accounted for 39% of all reported AI systems and 53% of those classified as highly material. The 2024 survey put those shares at 33% and 35%. The regulators caution, however, that the two surveys did not draw on the same population of firms and that comparisons should be made with care, so the increase is better treated as indicative than as measured. The level stands on its own: among respondents, more than half of the AI systems that matter most came from outside.

How firms understand those systems differs sharply by origin. For internally developed high-materiality systems, 77% of respondents cited deep knowledge of the system. For high-materiality third-party systems, 24% did, and 81% relied on vendor assurance and contractual arrangements. Asked about governance challenges, 54% named applying model risk management principles to vendor-supplied models, the most common answer, and 49% cited overseeing systems provided or materially influenced by third parties.

Reliance on a supplier's assurance is not a weakness in itself. Institutions can negotiate audit and inspection rights, review independent assurance reports, test an external system against their own data and outcomes, and limit what it is permitted to do. The British figures suggest many firms combine these approaches. For the same high-materiality third-party systems, 59% of respondents reported assurance of behavior or outcomes, and 64% reported constraining the system's autonomy or range of action, alongside the 81% relying on vendor assurance and contracts. How independent that assurance is depends on the evidence, transparency and access an institution can actually obtain.

APRA found that access often falls short. Contracts often lagged practice, with limited evidence of specific provisions on audit rights, model updates, incident notification and data handling. Upstream dependencies, including foundation models and fourth-party providers, were often opaque, which limits entities' ability to assess model performance, bias, resilience and security independently. Some entities depended heavily on a single provider for multiple AI use cases, and few had demonstrated robust contingency planning or tested exit and substitution strategies for critical AI providers. APRA's observation about boards relying on vendor presentations describes the same dependence at board level. Its expectations follow directly. Entities should map the full AI supply chain, including fourth parties, secure contractual transparency and auditability, and assess whether substitution or exit from critical providers is credible and feasible. Machado made a parallel point about generative AI, which banks typically source from a small number of providers, run on cloud infrastructure and cannot fully see into. He tied the resulting concerns about concentration, vendor lock-in and exit to the EU's Digital Operational Resilience Act.

The British survey is the only one of these documents that tries to measure that concentration. The three largest cloud and compute providers accounted for 79% of the provider relationships respondents reported in that category, and the three largest model API/hosting providers for 54%. (A chart in the report puts the latter figure at 55%.) These are shares of reported relationships across the survey population, not measures of systemic exposure. They do describe a market in which highly material systems at many firms may rest on the same few suppliers. Accountability for those systems remains with the institution using them, whatever the contract allocates to the supplier.

A Framework Without Findings

On April 17, the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation issued revised interagency guidance on model risk management, published by the Fed as SR 26-2 and by the OCC as Bulletin 2026-13. It replaced SR 11-7, the 2011 guidance that had shaped model governance at American banks for fifteen years. The new text is addressed to banking organizations and calls for model risk management tailored to an institution's model risk profile and the size and complexity of its operations. It addresses validation, monitoring, governance and controls, and vendor and other third-party products. It also states that it "does not set forth enforceable standards or prescriptive requirements" and that noncompliance "will not result in supervisory criticism against a banking organization."

The guidance excludes generative and agentic AI, on the ground that those models are "novel and rapidly evolving." The agencies said they planned to issue a request for information on model risk management generally, with attention to banks' use of AI, including those technologies. The exclusion means that the guidance's principles on development, validation and governance are not, by its own terms, the reference point for generative and agentic systems. It does not place those systems outside supervision. The laws and regulations that govern a banking activity apply to it whether or not a model of any kind is involved, and neither document purports to change them.

On November 4, the OCC issued Bulletin 2026-54, a supervisory framework for evaluating banks' use of what the agency now calls super intelligence, a term it defines as covering the technologies and systems previously encompassed by the term "Artificial Intelligence" as defined in federal statute. The bulletin went to the chief executives of national banks, federal savings associations and federal branches and agencies, but it is written for examiners. It asks them to tailor their work to the materiality of each use case and to its consequences, autonomy and complexity. It suggests classifying risk by potential consequences, the transfer of agency and the degree of human oversight, and says control intensity could increase with the potential consequences of an agent's failure or misuse. Examiners are told not to treat the technology as a separate and distinct risk category, and banks are not required to define a separate risk appetite for it. The framework is meant to help examiners identify considerations that supplement existing model risk management, governance, technology, compliance and operational-risk practices. It "does not establish supervisory expectations for banks."

The two documents therefore do different things. One is guidance addressed to banks that carries no enforceable requirements and leaves generative and agentic AI outside its scope. The other is a tool for examiners that covers AI broadly, agents included, and creates no new expectations. Neither is the source of a bank's obligations. Those continue to come from the laws, regulations and existing supervisory standards that apply to the activity in question, and the November framework describes how an examiner may assess AI against them.

Neither document reports what examiners have found. There is no American counterpart to APRA's list of common weaknesses or to the British control-by-control percentages. That absence does not show that US institutions share the gaps reported elsewhere, and it does not show that they have avoided them. What the American documents establish is where supervisors intend to look: at consequences, autonomy and human oversight, within the risk frameworks banks already maintain.

APRA's letter is the one document here that states consequences. Its expectations for assurance are specific. Second-line risk and internal audit functions should have the technical capability and tooling to assess AI systems independently, including probabilistic models and agentic workflows. Risk and information security assessments should take place before deployment and throughout a system's life. Monitoring should be continuous and proportionate to the criticality of the use case. Where entities fail to manage AI risks proportionately, APRA wrote, it "will take stronger supervisory action and, where appropriate, pursue enforcement."

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey