Examination-Ready AI Is the New Competitive Advantage

In the 1990s, I helped build a large-scale data warehouse at Bank of America Corp. and sponsored early data science work. During this time, I learned a critical lesson: If you can’t trace the data, you can’t trust the answer.

Since then, I’ve sat across from examiners as a bank CEO, and I led a mortgage company through the merger that made it a bank. The first question is always the same: “Where did this number come from?”

The rapid adoption of artificial intelligence (AI) makes it harder to answer, because the honest reply is too often “the model.”

Industry research already shows that AI adoption is outpacing compliance and governance guardrails. In ProSight Financial Association’s 2026 survey of chief risk officers, 54% said their banks have AI in production, while only 12% called their AI governance highly developed.

Banks that can explain how they produced, reviewed and approved every AI output will be better positioned to move ahead, while banks that cannot may delay deployment or worse, proceed without being able to defend the results.

In April, the banking agencies replaced SR 11-7, the 2011 model risk guidance, with a shorter, principles-based version aimed mainly at banks over $30 billion. Generative and agentic AI were left out as “novel and rapidly evolving,” leaving each bank to address them through its broader risk management. When guidance is principles-based, the bank’s own documentation becomes the standard.

However, despite increased regulatory interest in AI, many bankers are less concerned compared to a year ago. Regulatory risk ranked as a top concern for only 28% of respondents to Bank Director’s 2026 Risk Survey, down from 55% a year earlier.

Three Questions Examiners Will Have
After asking, “Where did this number come from?” two additional questions always follow: “Who reviewed it?” and “Can it be reconstructed without the person who wrote the prompt?”

To answer these questions, banks need approved use cases and clear ownership. Inventory every place AI is used and assign one executive to each to create accountability.

There must also be reliable sourcing and traceable outputs. Every figure should trace to a primary source a reviewer can open. Uncited AI outputs should be treated like an unsupported number in a credit memo.

Human review should also be required for material decisions. Regulators will not accept “because the model said so” as an excuse. Lenders and bankers have a clear responsibility to ensure a named person signs off on anything touching credit, capital, compliance or a customer.

Finally, documentation must be sufficient to reproduce the work. Keep the inputs, model version, sources and reviewer’s decision so someone else can rebuild the result a year later.

Bankers tend to see governance as friction. I see it like covenants in a credit agreement. They are the early warning system that lets you lend with confidence. These controls provide a framework that both protects the bank and enables the rollout of future tools and decisions.

Questions Boards Should Ask
What is the board’s role?

Directors should assess AI risk the same way they evaluate credit or any other capital risk. Bank Director’s 2026 Governance Best Practices Survey found 60% of boards have adjusted AI policies or oversight, yet 21% say the board doesn’t oversee AI risk at all.

To start, ask these four questions at the next board meeting as a starting point for evaluating the AI governance gap:

1. 1. Where is AI being used?
2. 2. Who is accountable for its outputs?
3. 3. Can management defend an AI-assisted decision to examiners?
4. 4. Are third-party tools held to the same standards?

If these questions don’t have clear answers, boards need to direct the bank’s leadership to develop policies and standards to move in that direction.

Failing to do so can derail everything from a small project to a charter application. Just this past summer, the Office of the Comptroller of the Currency turned down the applications of Wise and bunq for bank charters. For Wise, the OCC cited a lack of demonstrated competence among the proposed management team along with Bank Secrecy Act and anti-money laundering concerns. For bunq, it cited difficulties in capital plans and management expertise. This shows that a bank charter is as much a compliance test as a business plan test.

Institutions that can show an examiner where a number came from, who reviewed it and how to rebuild it won’t have to argue for the next tool or project. They’ll already have the AI record confirmed and certified for compliance and risk.