A workable framework for banks, fintechs, mortgage companies, and credit unions navigating AI risk, oversight, and accountability.
Artificial intelligence has moved from pilot project to boardroom agenda item at unusual speed. That momentum is exciting, but it creates a familiar challenge for financial institutions: the technology may be new, but expectations around risk management, consumer protection, accountability, and documentation are not.
Banks, fintechs, mortgage companies, and credit unions do not need AI governance that is overengineered, but rather oversight that is disciplined, defensible, and practical.
Recent authoritative guidance points in that direction. The U.S. National Institute of Standards and Technology’s (NIST) AI Risk Management Framework (AI RMF) emphasizes governance across the AI lifecycle, and NIST’s generative AI resources highlight risks specific to generative AI. At the same time, financial services expectations around AI model risk management and consumer protection still apply. On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised interagency guidance on model risk management through Federal Reserve SR 26-2, which emphasizes a risk-based approach tailored to an institution’s model risk profile, size, and complexity. While the Consumer Financial Protection Bureau’s (CFPB), in May of 2025, undertook a mass withdrawal of interpretive rules and statements, its guidance on AI also remains and continues to make clear that all existing laws apply fully to the uses of AI. For example, lenders using complex algorithms for underwriting must still provide accurate and specific reasons for adverse action.
Taken together, these sources provide a practical foundation for AI governance that is less about novelty and more about whether an institution can explain, control, and defend what it is doing.
Start with governance, not tools
One of the earliest mistakes institutions make is treating AI as a technology purchasing issue rather than a governance issue. Effective AI risk management begins with clear policies, defined roles, and decision-making authority across an organization. This strategy aligns with NIST’s lifecycle-based governance approach and with the broader supervisory expectation that AI model risk management be grounded in sound governance, policies, controls, and oversight.
In practice, that means identifying who owns AI strategy, who approves use cases, who performs challenge and review, and who has authority to stop deployment when risks are not well understood.
A strong starting point is an enterprise AI governance framework approved by senior management and understood by the board of directors. That framework should establish:
- a working definition of AI and which tools fall within scope;
- risk tiers for different use cases;
- approval authorities for development, procurement, and deployment;
- required reviews by compliance, legal, information security, model risk, and business owners; and
- reporting expectations for management and the board.
If this framework reads as more measured than bold, that is appropriate. In regulated financial services, novelty is rarely the objective.
Build an inventory before scaling use cases
You cannot govern what you cannot identify. Institutions should maintain a current inventory of AI use cases, models, tools, vendors, and data flows. NIST’s AI RMF emphasizes mapping context, intended use, and risk across the lifecycle, which supports a structured inventory approach before broad deployment.
Inventory should cover not only customer-facing uses such as underwriting, fraud detection, servicing, collections, and marketing, but also internal uses such as coding assistants, document summarization, complaint analysis, and human resources screening. Inventory should capture the purpose, owner, inputs, outputs, decision impact, vendor involvement, validation status, and applicable legal or regulatory considerations for each use case.
For many institutions, the inventory process reveals an immediate truth: AI is already present in the organization, even where no one has formally labeled it as such.
Apply current AI model risk discipline where it fits
Financial institutions do not need to reinvent risk management every time a vendor adds the phrase “AI-powered” to a slide deck or solution documentation. Existing model risk principles remain highly relevant, especially where AI tools inform business decisions or affect customer outcomes.
That point is now grounded in the revised interagency guidance issued in April. The agencies stated that the revised guidance reflects supervisory experience, industry feedback, and advances in modeling practices, and that it emphasizes a risk-based approach tailored to an organization’s model risk profile and the size and complexity of its operations.
The right questions are often the familiar ones:
- What problem is the tool solving?
- What data does it use?
- How was it trained, configured, or implemented?
- What limitations are known or reasonably foreseeable?
- How will performance be monitored over time?
- Who independently validates or challenges the output?
If a use case affects pricing, underwriting, fraud decisions, servicing treatment, or other customer outcomes, the bar for documentation, testing, and challenge should be materially higher than it is for a low-risk productivity tool. That is a practical application of the agencies’ risk-based framing, not a new rule unique to AI.
Prioritize explainability where consumer impact is real
Not every AI tool must be perfectly explainable in the abstract; however, financial institutions should be cautious when a system materially affects consumers, and the institution cannot explain how outputs are produced. This is especially true in lending and other decision environments where legal obligations require specific, accurate explanations. As mentioned above, the CFPB has stated that when creditors use complex algorithms, including so-called black-box models, they still must provide applicants with accurate statements of specific reasons for adverse action under the Equal Credit Opportunity Act and Regulation B.
A practical approach is to set explainability standards based on use case risk. For higher-risk applications, institutions should be able to identify key drivers, document decision logic or reasonable approximations, test the accuracy of reason codes, and confirm that business users understand how to interpret outputs.
If a model cannot support compliant explanations, that is not simply a technical inconvenience or framework gap. It is a governance warning sign.
Treat data governance as AI governance
AI risk often begins well before model output. It starts with data quality, lineage, access, retention, and suitability. Poor data can produce unreliable outcomes at scale, which is an efficient way to create inefficient problems.
Institutions should establish controls over training data, input data, feature selection, and data refresh cycles. They should also assess whether proxies or alternative data introduce fair lending, consumer protection, privacy, or reputational concerns. NIST’s AI risk materials support this broader view of trustworthy AI as dependent on people, processes, technology, and data rather than model performance alone.
For financial institutions, this means AI governance should be tightly connected to broader data governance and privacy programs, not managed as a side project in a technical corner of the organization.
Strengthen third-party oversight
Many institutions access AI through vendors rather than build models internally; however, outsourcing the solution does not outsource accountability. In practice, institutions may increasingly treat evidence of AI governance maturity as part of vendor due diligence, alongside information security, SOC reporting, and compliance reviews.
Vendor due diligence should include questions about model design, training data sources, testing, bias monitoring, security, change management, human oversight, and incident response. Contracts should address documentation rights, audit access where feasible, performance expectations, and notification obligations when models change in material ways. For some higher-risk use cases or critical vendors, institutions may want to consider whether external validation, legal review, or structured attestation could help support board oversight, vendor management, and exam readiness.
This is particularly important for generative AI and embedded AI tools, where vendor updates may be frequent and not always visible to business users. NIST’s AI RMF resources and generative AI materials support closer attention to evolving risks and ongoing governance across the lifecycle.
Keep humans in the loop – and make it meaningful
“Human oversight” sounds reassuring; however, it only works when humans are trained, equipped, and genuinely able to challenge outcomes.
Effective governance should identify when human review is mandatory, what escalation paths exist, and what evidence reviewers are expected to examine. Institutions should train frontline users, compliance staff, risk managers, internal audit, and senior management on how AI is being used and where its limitations lie. Board reporting should focus on risk themes, material incidents, significant model changes, and emerging regulatory exposure, not just innovation headlines.
Monitor continuously and document relentlessly
AI governance does not end at implementation. Institutions should monitor drift, error rates, override trends, consumer complaints, adverse outcomes, security events, and performance changes over time. They should also establish triggers for revalidation, retraining, suspension, or retirement.
This is consistent with the revised interagency model risk guidance’s emphasis on risk-based management and with longstanding supervisory expectations that oversight continues throughout model use, not just at approval. Documentation is equally important. If an institution cannot show how a use case was approved, tested, monitored, and governed, it may reflect a framework built more on ambition than implementation.
The practical takeaway
The strongest AI governance programs in financial services will not be the ones with the boldest slogans. They will be the ones that connect innovation to accountability. For banks, fintechs, mortgage companies, and credit unions, the practical path is fairly clear: define scope and inventory use cases, apply risk-based governance, preserve explainability where customer outcomes are affected, strengthen third-party oversight, and continuously monitor performance.
Further, for mortgage lenders, AI governance is not just a generic compliance best practice. It is increasingly relevant to investor eligibility, vendor oversight, and secondary-market readiness. For mortgage lenders, AI governance expectations are no longer theoretical: Freddie Mac’s AI requirements took effect on March 3, 2026, and Fannie Mae followed with Lender Letter LL-2026-04 establishing an AI/Machine Learning governance framework for seller/servicers, signaling growing Government-Sponsored Enterprise scrutiny of how AI tools are governed, documented, and monitored. That makes governance a business continuity and counterparty-risk issue, not simply a policy matter.
AI may be evolving quickly, but sound governance still rewards the same habits it always has – clarity, discipline, challenge, and documentation. Conveniently, regulators tend to appreciate those as well.
Contact CrossCheck to explore how we can support your organization in implementing responsible, compliant, and fair AI practices.
Authored by Rebecca Escario, June 2026
