How Banks Can Govern AI Without Slowing Innovation

Artificial intelligence is quickly changing how banks operate. Banks are using AI to enhance productivity, analyze data, detect fraud, support customer service, assist certain credit decisions and automate manual processes.

AI is also built into many third-party systems banks already rely on. AI encompasses a number of subclasses with different inherent risk profiles as they connect to your data, make a decision or automate a process. For bank leaders, the question is how to capture the benefits while maintaining the governance, controls and accountability expected in a highly regulated industry.

Start With Governance
Directors should expect management to regularly report on AI adoption, significant use cases, key risks, control effectiveness and material incidents. Questions around data privacy, model performance, vendor reliance and regulatory developments should become part of ongoing board discussions. Governance for AI leverages risk-based frameworks that should be familiar within your institution.

Evaluate how AI is already being used. Develop an inventory of AI use cases across your organization, including internally developed tools, employee use of generative AI and AI functionality embedded within vendor applications.

From there, scale governance to your institution’s size, complexity and risk profile. At a minimum, it should define:

• Who owns AI oversight
• How new uses are reviewed and approved
• Which uses should be restricted or prohibited
• Where certain applications need escalation

AI introduces new risks, but those risks often intersect with information security, privacy, model risk management, compliance, third-party risk management and change management. As banks define AI governance, existing governance structures often provide a strong foundation.

Internal Controls Are Essential
Strong AI governance depends on strong internal controls. Traditional internal control principles including authorization, validation, segregation of duties, monitoring and accountability all still apply.

The difference is how they’re applied when AI becomes part of a process. Consider controls throughout the AI lifecycle, from initial use case approval through implementation and ongoing.
Internal controls may include access restrictions, data classification, testing and validation, review controls, change controls, exception monitoring and periodic reassessment. Employees need clear boundaries regarding what information may be used within AI tools and when those tools must operate within bank-controlled environments.

Human review of AI-generated output is critical and shouldn’t be overlooked. Generative AI can produce responses that look complete and authoritative but may be inaccurate or unsupported. Internal controls should define when human review is required and who remains accountable for the final decision. While AI may assist decision-making, accountability remains with management. Institutions can’t outsource responsibility to algorithms, models or vendors.

Be Aware of Third-Party AI
In many cases, a bank’s first exposure to AI isn’t through internally developed tools but through existing vendors, also known as shadow AI. Shadow AI is the use of an AI tool or application by employees without formal oversight or governance from the institution’s IT and security, which introduces new risks like data leakage. Management and directors should understand where AI is embedded within critical technologies and whether existing vendor oversight processes adequately address those risks.

Banks rely on third parties for many areas, which may include core processing, fraud monitoring, lending, compliance and customer-facing technologies. As vendors add AI to these platforms, banks need to understand how that functionality affects risk as part of their vendor management program.

Vendor due diligence should address AI use, data handling, model governance, monitoring, subcontractors and communication of material changes. A bank can’t outsource accountability simply because the AI resides in a vendor system.

Internal Audit’s Role
For directors, internal audit can independently test whether AI risks are being identified, governed, and monitored in a manner consistent with your institution’s risk appetite. Internal audit shouldn’t own the framework or design management’s controls; however, it can independently assess if AI governance is keeping pace with adoption.

As AI becomes more integrated into business processes, internal audit plans should evolve. AI should be considered not only as a standalone emerging risk, but also within audits of lending, operations, cybersecurity, compliance, third-party risk management and financial reporting.

AI governance isn’t meant to limit innovation; it’s meant to establish the guardrails for innovation to occur safely and responsibly. Banks successfully governing AI can be better positioned to realize the technology’s benefits while maintaining customer, regulator and shareholder trust.

Regulators continue to expect financial institutions to demonstrate sound governance regardless of whether decisions are made by people, models, or AI-enabled technologies. As AI becomes increasingly embedded across banking operations, institutions realizing the greatest benefits won’t necessarily be those adopting AI the fastest, but those governing it the most effectively.

The information contained herein is general in nature and is not intended, and should not be construed, as legal, accounting, investment, or tax advice or opinion provided by CliftonLarsonAllen LLP (CLA) to the reader. For more information, visit CLAconnect.com.

CLA exists to create opportunities for our clients, our people, and our communities through our industry-focused wealth advisory, digital, audit, tax, consulting, and outsourcing services. CLA (CliftonLarsonAllen LLP) is an independent network member of CLA Global. See CLAglobal.com/disclaimer. Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC-registered investment advisor.