AI Governance and Model Risk in Regulated Finance

Introduction

Artificial intelligence has moved from isolated experimentation into investment research, client service, compliance, operations, risk analysis and technology delivery. In regulated finance, the central management question is whether each use can be governed in proportion to its consequence. The answer requires an inventory, a defensible classification, accountable decision rights, independent challenge, reliable evaluation, traceable operation and credible exit. A policy statement alone cannot provide that evidence.

The regulatory baseline changed materially in 2026. The US federal banking agencies issued revised model risk management guidance on 17 April 2026. The guidance supersedes SR 11-7, emphasises a risk-based and tailored approach, and is expected to be most relevant to Federal Reserve regulated banking organisations with more than USD 30 billion in total assets [1]. The OCC also stated that generative AI and agentic AI are outside the scope of that revised guidance because they are novel and rapidly evolving [2]. That scope boundary matters. It means an institution cannot assume that conventional model risk management alone answers every generative or agentic AI question.

In the UK, the April 2026 version of PRA Supervisory Statement SS1/23 applies model risk management principles across models used to inform business decisions, including vendor models and artificial intelligence where the principles apply [4]. The Bank of England, FCA and HM Treasury separately called for board understanding and active mitigation of frontier-AI cyber and operational-resilience risks in May 2026 [9]. In June 2026, the Financial Stability Board proposed 12 sound practices covering organisation-wide governance, lifecycle controls, cyber, information and communication technology, and third-party risk [10]. That FSB document remained a consultation at the 1 August 2026 evidence cut-off; its final report was scheduled for October 2026 [10].

The UAE position also became more specific. The Central Bank of the UAE issued consumer-protection guidance for responsible AI and machine-learning use by licensed financial institutions in February 2026 [16]. The DFSA published regulatory expectations on AI risk management in the DIFC in June 2026 [18]. These materials sit alongside the UAE regulators' 2021 enabling-technology guidelines, the UAE personal-data framework and DIFC rules for personal data processed by autonomous and semi-autonomous systems [17,22,23].

This paper converts those overlapping sources into an operating framework for A2 family-office CIOs and heads of alternatives and A1 international institutional allocators. The framework is designed for investment institutions that may be regulated directly, may allocate to regulated firms, may procure AI-enabled services, or may need institutional-grade governance because of fiduciary, contractual or reputational exposure. It distinguishes law, binding rules, supervisory guidance, consultation material, standards and voluntary practice. Applicability must be confirmed by qualified legal and compliance owners for the entity, activity and jurisdiction.

The contribution is practical. It defines a common inventory covering models, AI systems, assistants, agents and embedded vendor capabilities; a materiality method that separates decision consequence from technical novelty; a lifecycle with evidence gates; evaluation requirements for deterministic, predictive, generative and agentic systems; third-party and concentration controls; and board information that supports actual challenge. Two worked operating cases are included. Every numerical input in those cases is explicitly unverified and illustrative. Attributed Matchpoint or client revenue, cash cost reduction and loss reduction remain USD 0 until approved observed evidence exists.

The paper makes five propositions.

Scope, Definitions And Evidence Boundaries

Scope

The subject is governance and model risk for AI used in regulated finance and institutionally governed investment activity. Covered uses include research, screening, portfolio analytics, valuation support, forecasting, financial crime controls, client communications, suitability support, operations, coding, document analysis and workflow agents. The paper addresses internally developed systems, configured third-party systems, embedded AI features and externally supplied model outputs.

The paper does not determine legal status, regulatory perimeter, fiduciary compliance, suitability, data-law compliance or accounting treatment for a particular institution. It does not certify a model, a vendor or an AI system. Each institution must establish the applicable requirements through its authorised legal, compliance, risk, information-security, privacy and business owners.

Working definitions

Definitions vary across rules and standards. The institution should preserve the applicable legal definition in its obligations register and maintain a broader operational perimeter for governance.

The operational perimeter is intentionally inclusive. A spreadsheet formula, vendor score, retrieval assistant or workflow agent may not satisfy every legal definition of a model. It can still create consequential dependency. Registration routes the item to the correct governance owner; it does not predetermine regulatory classification.

Evidence classes

Evidence has different authority. Mixing these classes creates false certainty.

Evidence cut-off and current-state limitations

Sources were reviewed through 1 August 2026. The EU implementation timetable changed in July 2026, including extended dates for high-risk AI obligations [25]. Article 50 transparency obligations were scheduled to apply from 2 August 2026, one day after the evidence cut-off [26]. The FSB sound practices remained a consultation [10]. NIST stated that AI RMF 1.0 was being revised [29]. The obligations register must therefore record source date, current status, next review date and accountable legal owner.

Research method

The paper prioritises primary laws, regulators, standard setters and recognised standards bodies. It triangulates model risk, AI governance, operational resilience, cybersecurity, data protection and third-party risk. It does not treat a survey percentage as a universal adoption rate. It does not treat a voluntary standard as law. It does not interpret consultation language as final policy.

A2 And A1 Decision Map

A2 family-office CIOs and heads of alternatives

The Topic Tracker defines A2 as investment professionals at single-family offices, multi-family offices, private-wealth organisations and external asset managers across the GCC, UK, Switzerland, Singapore and the EU. Their AI governance problem often spans a small internal team, confidential family information, external managers, private-market documents, bank and administrator data, and multiple outsourced technology providers.

A2 institutions should avoid copying a bank's organisational scale. Proportionality can preserve the same control objectives with fewer committees. A named accountable executive, an independent challenger and a complete evidence pack may be more effective than multiple forums with unclear ownership.

A1 international institutional allocators

The Topic Tracker defines A1 as pensions, insurers, endowments and fund-of-funds in the US, EU and UK evaluating or scaling allocations to UAE and GCC private markets. Their AI governance problem adds delegation, public or beneficiary accountability, regulated outsourcing, committee process, manager oversight and cross-border data flows.

Shared governance outcome

Both ICPs need a compact decision contract.

Regulatory And Supervisory Landscape

United States banking model-risk guidance

The April 2026 interagency guidance describes model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs. It highlights effective development and use, validation, and governance and controls [1]. It expects tailoring to the banking organisation's model risk profile, size and complexity. Federal Reserve applicability is described as most relevant above USD 30 billion in total assets [1]. The OCC stated that the guidance is not an enforceable standard and that generative and agentic AI models are outside its scope [2].

This creates a two-part governance task. Conventional models should be mapped to the revised guidance where applicable. Generative and agentic systems need an adjacent AI-risk method that retains useful model-risk disciplines while adding content, interaction, tool-use, security, data-rights and autonomy controls. Institutions should record which regime or policy owns each control objective.

United Kingdom

PRA SS1/23 sets five principles: model identification and classification; governance; development, implementation and use; independent validation; and model-risk mitigants [4]. It applies to vendor models as well as internally developed models and addresses AI in modelling techniques where the general principles apply [4]. Bank and FCA materials also emphasise governance, accountability, data, model and third-party risks [5,6].

The May 2026 UK joint statement adds a distinct frontier-AI cyber-resilience concern. It calls for board and senior-management understanding, investment and resourcing, access management, network security, data protection, protective and detective capabilities, threat containment and response [9]. The July 2026 Financial Stability Report described four channels: core financial decision-making, financial markets, service-provider operational risk and the changing external cyber threat [8].

The governance implication is that AI risk cannot sit only within model validation. It needs coordination across business ownership, model risk, operational risk, information security, privacy, compliance, procurement and resilience.

UAE and DIFC

The CBUAE's February 2026 guidance focuses on consumer protection and market conduct for licensed financial institutions using AI and machine learning. It addresses transparency, bias, ethics, accountability, explainability and data privacy [16]. The joint UAE enabling-technology guidelines address AI, big-data analytics, cloud, application programming interfaces, biometrics and distributed ledger technology [17].

The DFSA's June 2026 SEO letter records regulatory expectations for AI risk management in the DIFC [18]. Its 2025 survey covered 661 authorised firms with 88 per cent participation. The DFSA reported that 52 per cent used AI, 60 per cent had some form of AI governance structure and 21 per cent lacked clear accountability or oversight even where use was critical [19]. Those figures describe that survey population and date; they are not universal adoption estimates.

DIFC Data Protection Regulation 10 addresses personal data processed through autonomous and semi-autonomous systems [22]. UAE Federal Decree-Law No. 45 of 2021 establishes the federal personal-data framework [23]. The institution's obligations register should identify the governing data regime, controller and processor roles, legal basis, sensitive-data constraints, transfer requirements, individual rights, retention and incident obligations.

European Union

Regulation (EU) 2024/1689 establishes a risk-based AI framework [24]. The July 2026 AI Omnibus changed elements of implementation and extended the start of high-risk AI rules to 2 December 2027, with rules for AI embedded in regulated physical products scheduled for 2 August 2028 [25]. Transparency obligations for specified AI interactions and generated or manipulated content were scheduled to apply from 2 August 2026 [26].

DORA requires financial entities in scope to identify and document ICT assets, dependencies and critical interconnections; manage ICT risk; govern third-party arrangements; test resilience; and maintain contractual and exit capabilities [27]. GDPR continues to govern personal-data processing and automated decision issues where applicable [28]. AI classification should therefore connect to existing ICT, outsourcing, privacy, conduct and resilience registers.

International coordination and standards

The FSB's June 2026 consultation proposes 12 sound practices. The first four address organisation-wide governance, the next six address lifecycle risk management and the final two address cyber, ICT and third-party risk [10]. The document states that the practices are not intended to create an international standard or prescribe whether institutions should adopt AI [10].

Basel Committee materials link digitalisation to governance, model risk, third-party dependency, operational risk and resilience [12-14]. BIS FSI research observed that most financial authorities address AI through existing technology-neutral frameworks while identifying gaps around governance, skills, model risk, data, third parties and new business models [15].

NIST AI RMF organises outcomes under Govern, Map, Measure and Manage [29]. Its Generative AI Profile identifies risks and suggested actions specific to or amplified by generative AI [30]. ISO/IEC 42001 specifies an AI management-system standard [33]. ISO/IEC 23894 provides AI-risk-management guidance [34]. These are useful control-design references. Their use does not establish legal compliance.

Applicability matrix

Inventory And Classification

One perimeter, multiple taxonomies

An institution should maintain one discoverable AI and model register with linked classifications. Separate unconnected inventories for models, SaaS, end-user computing, privacy, vendors and operational processes create gaps. The master record should link to specialist registers rather than duplicate every field.

Discovery routes

Inventory completeness needs multiple detection routes. Self-attestation alone is weak because embedded features and shadow use can be invisible to central teams.

Materiality model

Materiality should be assessed before controls are selected. The proposed score uses eight dimensions, each rated from zero to four. The score supports judgement; it does not replace it.

Proposed initial bands are 0-7 for Tier 1, 8-15 for Tier 2, 16-23 for Tier 3 and 24-32 for Tier 4. These bands are management design parameters, not regulatory thresholds. A mandatory override should elevate uses involving legal rights, material client communications, autonomous value movement, regulatory reporting, safety, credit or suitability decisions, or critical service dependencies.

Authority classification

Authority frequently drives risk more directly than model type.

Classification output

The classification record should state facts, conclusions and uncertainty separately.

Governance And Decision Rights

Accountable ownership

Each registered use needs a business owner who owns the outcome and residual risk. Technology ownership does not substitute for business accountability. Model risk, compliance, privacy and security owners provide independent or specialist challenge within their mandates.

Proportional forum design

A2 institutions may use an existing investment, risk or operating committee with a standing AI agenda. A1 institutions may use a central AI risk committee with business-level approvals. The required outcome is clear authority and documented challenge.

Policy architecture

The institution should avoid a stand-alone AI policy that conflicts with established obligations. A concise AI policy should define perimeter, principles, roles, prohibited uses, approval, monitoring, incidents and exceptions. Supporting standards should connect to model risk, data, privacy, cybersecurity, outsourcing, operational resilience, conduct, records, change and audit.

Risk appetite

Risk appetite should specify prohibited activities, quantitative or categorical limits, approval authorities and escalation. Examples include:

Competence and challenge

Training should match role. General users need data, source, hallucination, phishing, prompt-injection and escalation awareness. Owners need classification, evidence and incident responsibilities. Validators need technical and domain competence. Boards need enough understanding to challenge risk concentration, autonomy, limitations and resourcing [9,10]. Training completion is weak evidence on its own; scenario testing and observed behaviour provide stronger evidence.

Lifecycle And Evidence Gates

Lifecycle

The proposed lifecycle contains ten stages: idea, registration, classification, design, development or procurement, evaluation, approval, controlled deployment, monitoring and retirement. Iteration returns to the appropriate earlier gate when the model, prompt, data, tool, purpose, population or provider changes.

Design evidence

The design pack should show the full system, including the user's task, data, model, retrieval, deterministic controls, tools, interfaces, human review and downstream action. A model card without workflow context is incomplete for a material AI use.

Approval pack

The approval pack should answer one question: does the available evidence support the proposed bounded use? It should identify gaps rather than convert absence of evidence into a positive conclusion.

Change control

AI services can change through model versions, prompts, system instructions, retrieval content, tools, policies, safety filters, providers, data, user populations and hosting. The change standard should classify each change and define required regression.

Retirement

Retirement should remove access and dependency while preserving required records. For critical systems, the institution should test data export, replacement operation and recovery before approving production. Vendor termination rights without an operational transition plan are weak evidence.

Validation And Evaluation

Validation objective

Validation provides effective challenge over conceptual soundness, implementation, performance, use and limitations. The depth depends on materiality, complexity and exposure [1,4]. The validator should be independent enough to challenge the owner and competent across the relevant domain, data, model and workflow.

Evaluation by system type

Representative evaluation set

The evaluation population should reflect normal, difficult, adverse and prohibited cases. It should include material subgroups and periods, known failure modes, boundary conditions and out-of-distribution examples. Test-set governance should prevent contamination and untracked changes.

Metrics

A single accuracy percentage is insufficient for most material AI uses.

Thresholds must be tied to consequence. A drafting assistant and an automated client instruction should not share the same tolerance. For zero-tolerance event types, the evaluation objective should be absence in the tested population plus strong preventative and detective controls; it should not be described as proof that the event cannot occur.

Generative AI evaluation

The NIST Generative AI Profile identifies risks including confabulation, data privacy, harmful bias, human-AI configuration, information integrity, information security, intellectual property and value-chain dependency [30]. Evaluation should cover the system as configured, including prompts, retrieval, tools, safety controls and workflow. Provider benchmark scores cannot establish fitness for a local investment or regulated-finance use.

Agentic evaluation

Agentic systems add sequence, state, tool and authority risk. A step may be individually acceptable while the sequence produces an unauthorised outcome. Evaluation should record each action, tool input, tool output, permission decision, human intervention and final state.

Independent challenge record

The validation report should state scope, methods, evidence, limitations, findings, severity, conditions and conclusion. A qualified conclusion can support a bounded pilot. Missing evidence should remain a limitation or issue. Management acceptance should name the accountable owner and authority.

Data, Privacy, Security And Third Parties

Data governance

AI controls inherit from the data lifecycle. Each material use should establish provenance, ownership, permission, purpose, quality, lineage, minimisation, retention, transfer, deletion and incident response.

Secure development and operation

NIST CSF 2.0 and the NCSC secure-AI guidance provide governance and lifecycle security references [31,32]. OWASP's LLM application risk work provides a technical threat catalogue [36]. The institution should select controls from its applicable security framework and record their implementation.

Third-party AI

Financial institutions remain responsible for risks created by services they procure or rely on. DORA, Basel materials, FSB work, FINMA guidance and UAE regulator materials all reinforce the importance of third-party dependency, governance and resilience [10,12,15-17,27,37].

Concentration and fourth parties

Foundation models, cloud infrastructure, data services and specialist tooling can create common dependencies across apparently different applications. The inventory should identify ultimate providers and material subprocessors. Scenario analysis should examine simultaneous failure, degraded service, unilateral term change, region outage, model withdrawal and loss of audit access.

Contract control schedule

The contract should define service scope, approved data use, confidentiality, security, incident notice, business continuity, audit, regulator access where applicable, subcontracting, model changes, performance, intellectual property, record retention, deletion, exit assistance and liability allocation. Contract language must be reviewed by qualified counsel. A right without operational testing remains incomplete evidence.

Human Oversight, Conduct And Accountability

Meaningful human oversight

Human review is meaningful when the reviewer has competence, time, authority, information and an effective ability to challenge or stop the outcome. A mandatory click with no supporting evidence is weak control.

Automation bias and workload

Oversight can fail when users defer to polished output, review too many items, or lack access to source evidence. Monitoring should measure correction, override, review time, exception and disagreement patterns. A very low override rate may indicate high quality; it may also indicate weak challenge. Investigation requires sampled evidence.

Fairness and affected parties

Where AI affects access, pricing, suitability, employment, credit, insurance or other consequential treatment, the institution should identify legally and operationally relevant groups, evaluate differential outcomes, document legitimate objectives, provide appropriate explanation and maintain contest or escalation routes. Applicable law determines specific obligations. OECD principles, NIST outcomes, CBUAE guidance and FINMA expectations provide supporting governance references [16,29,35,37].

Records and explanations

The record should preserve the input, relevant source version, system configuration, output, reviewer action, final decision and reason at the level required for reconstruction. Explanation should be appropriate to the audience and decision. Technical interpretability does not automatically satisfy client or legal explanation requirements.

Prohibited and restricted uses

Each institution should define prohibited uses based on law, mandate and risk appetite. Restricted uses can operate only under stated conditions. Examples for management consideration include unapproved confidential-data entry, unsupervised legal or investment advice, autonomous transfer of value beyond limits, fabricated source attribution, covert client interaction, and use of personal data outside approved purpose. These are proposed policy examples; legal owners must establish the actual prohibitions.

Monitoring, Incidents And Assurance

Monitoring design

Monitoring should connect system behaviour to risk appetite and approval conditions.

Incident taxonomy

An AI incident can be a model, data, security, privacy, conduct, operational, legal or third-party event. The incident process should avoid routing everything to a specialist AI team. The severity assessment should consider actual and plausible consequence, exposure, containment, regulatory notification, affected parties and recurrence.

Control assurance

First-line testing should confirm controls operate. Second-line monitoring should challenge classification, approval, issues and aggregate risk. Internal audit should assess framework design and operating effectiveness using a risk-based plan. External assurance may support vendor or technical evidence, but the institution must assess scope, period, exclusions and relevance.

Aggregate risk

Portfolio reporting should identify concentration by provider, model, cloud, data source, business process, geography and authority level. Individually low-tier assistants can become material when they share a provider, process a large volume, or embed common error into multiple decisions.

Illustrative A2 Operating Case

Case definition

[Unverified] A family-office investment team is assumed to use a retrieval-augmented assistant to summarise private-market fund documents, compare material terms and draft investment-committee questions. The system has no authority to approve investments, communicate with managers or transmit instructions. All numerical values and operating assumptions in this section are unverified illustrations.

Classification

The proposed materiality assessment is Tier 3 because the use handles confidential data and can influence investment analysis, while output remains draft and reversible. A mandatory override would apply if the output entered committee records without review, generated legal conclusions, or initiated external communications.

Evaluation design

[Unverified] Illustrative proposed thresholds are 100 per cent support for defined material terms in the tested set, zero cross-deal access failures, zero autonomous actions, at least 98 per cent citation fidelity and documented escalation for every unresolved source conflict. These values are proposed management assumptions and require approval.

Control design

Economic boundary

[Unverified] The use may release analyst capacity. Released time is not a cash saving unless an approved financial consequence is observed. Attributed Matchpoint or client revenue, cash cost reduction and loss reduction remain USD 0. A value ledger can record accepted outcomes, review time, rework and full operating cost without converting theoretical hours into realised benefit.

Illustrative A1 Operating Case

Case definition

[Unverified] An institutional allocator is assumed to use a predictive and generative system to monitor external managers, flag reporting anomalies and draft due-diligence follow-up questions. The model can prioritise review; it cannot change an allocation, issue a breach notice or communicate externally. All numerical inputs and thresholds in this section are unverified illustrations.

Model and workflow boundary

The predictive component detects anomalies against approved features and benchmarks. The generative component explains the flag using controlled records and drafts questions. A deterministic rules layer enforces exposure limits and required escalations. The investment-risk owner decides whether to escalate. This separation allows different evaluation methods and reduces authority assigned to probabilistic output.

Evaluation

[Unverified] An illustrative pilot uses 18 months of historical records, 60 adjudicated events and a three-month shadow period. These values are management assumptions. The institution would need to assess whether the sample supports the intended claims and material subgroups.

Decision and escalation

Portfolio and third-party aggregation

The allocator should aggregate common providers across manager monitoring, research, reporting and client-service tools. A single foundation-model or cloud dependency may support multiple nominal vendors. The board pack should show this look-through concentration and the tested recovery path.

Economic boundary

[Unverified] No financial benefit is attributed in the illustrative case. A later evaluation could measure review throughput, accepted flags, material omissions, false escalation, time to resolution and operating cost. Revenue, cash-cost and loss claims require approved observed evidence and a defensible counterfactual.

Board Pack, Roadmap And Implementation

Board information

Board reporting should support direction and challenge. It should separate exposure from activity and report exceptions plainly.

Twelve-month roadmap

First 30 days

The first month should establish authority and visibility. Name the accountable executive, issue interim data and authority restrictions, create a single intake route, reconcile known applications and subscriptions, and connect AI events to existing incident management. Prioritise uses that can affect clients, capital, reporting, rights, confidential data or movement of value.

Days 31-90

Build the obligations register from applicable legal and supervisory sources. Complete classification for material uses. Create evaluation, approval, monitoring, change and retirement templates. Review critical vendors and embedded AI features. Establish an exception process with expiry and compensating controls.

Months four to twelve

Evaluate and approve or suspend material uses. Test access isolation, failure recovery and vendor exit. Reconcile provider concentration. Implement board metrics and independent assurance. Refresh the framework when the FSB consultation is finalised, NIST updates AI RMF, or jurisdictional rules change.

Control maturity model

Limitations, Research Agenda And Conclusion

This paper synthesises cross-jurisdictional materials; it does not establish applicability for a particular entity. Requirements can overlap and change. The FSB sound practices were consultative at the evidence cut-off. The EU timetable changed shortly before publication. The US revised model-risk guidance expressly excludes generative and agentic AI from scope. Standards and voluntary frameworks do not establish legal compliance.

The operating framework requires empirical testing. Future research should compare classification consistency across institutions; measure validation reliability for generative and agentic workflows; evaluate whether citation and human-review controls reduce material errors; assess fourth-party concentration; and test exit plans under provider withdrawal, model change and cyber disruption. Institutions should publish or share incident taxonomies and evaluation methods where confidentiality permits.

The central conclusion is that controlled AI adoption is an evidence problem. A complete inventory shows exposure. Materiality and authority determine proportional control. Evaluation establishes bounded fitness. Governance assigns the decision. Monitoring keeps approval current. Incident and exit capability contain failure. For A2 family offices and A1 institutional allocators, this structure supports innovation while preserving investment authority, confidentiality, traceability and resilience.

Attributed Matchpoint or client revenue, cash cost reduction and loss reduction remain USD 0 until approved observed evidence supports attribution.