Banks race to embed AI governance amid scaling struggles

By late 2025, AI governance in financial services had evolved from a peripheral concern to an indispensable discipline, as AI’s amplified scale and complexity forced governance teams to expand their remit beyond traditional data assets to encompass models, training data lineage, prompts, and human oversight. This shift necessitated rebranding data governance teams as combined Data & AI Governance units, emphasizing that effective governance is predominantly about change management and communication—building trust and articulating clear value to stakeholders rather than merely enforcing policies. As one report noted, “AI moved governance from ‘somewhat important’ to non-negotiable,” highlighting the urgency for integrated oversight frameworks that maintain accountability amid AI’s automated decision impacts.

Entering 2026, CFOs emerged as pivotal actors in AI governance, grappling with the challenge not of whether to use AI but how to govern it effectively to mitigate security risks such as Shadow AI—where over-restrictive policies inadvertently push employees to use unauthorized AI tools, exposing sensitive financial data. Glenn’s insights underscore that governance should embrace approved AI tools with pragmatic, concise policies rather than blanket bans, balancing operational flexibility with security. This approach aligns with findings that strict lockdowns increase risk, as employees circumvent controls, emphasizing the governance imperative to audit AI usage, approve secure platforms, and embed human oversight to maintain trust and compliance.

The regulatory landscape intensified governance demands throughout 2026, with frameworks from the Financial Stability Board (FSB) and IOSCO crystallizing the need for organization-wide AI governance, continuous lifecycle oversight, and integrated risk management. The FSB’s 12-practice AI risk framework, championed by Michelle Bowman and Ho Hern Shin, and IOSCO’s supervisory toolkit both emphasize that AI governance must transcend traditional human-centric GRC models to address AI’s probabilistic nature, third-party dependencies, and cyber risks. These initiatives underscore governance as a continuous assurance process—embedding explainability, auditability, and operational resilience into AI systems to uphold financial stability and stakeholder trust amid rapid AI adoption.

Despite mounting regulatory pressures and the clear governance imperative, surveys reveal a persistent gap between AI deployment and governance maturity across financial services globally. For instance, a 2026 European survey found that while 99% of organizations feel pressure to scale AI in customer experience, only 38% have a clear governance approach, with 70% prioritizing speed over compliance—creating blind spots that jeopardize trust. Similarly, Avalara’s research highlights that finance leaders often rush AI agent deployments without updated controls or clear accountability, with up to 27% of Indian finance leaders uncertain who would own responsibility for AI errors. These findings spotlight the urgent need for integrated governance frameworks that embed audit trails, human review, and vendor oversight to bridge the trust and accountability gap.

Financial institutions embed AI governance through cross-functional councils that unify diverse stakeholders—privacy, security, ethics, data, and AI teams—under operational leadership empowered to enforce governance across the AI lifecycle. This approach, exemplified by firms like HSBC appointing Chief AI Officers collaborating closely with Chief Data Officers, ensures governance is not a siloed compliance exercise but an integral part of business processes from inception, aligning controls with organizational goals and embedding accountability early to prevent reactive fixes.

Operationalizing AI governance demands embedding it into IT-led workflows that tackle high-friction tasks rather than superficial applications, as demonstrated by Gold Bond’s integration into ERP intake and document processing. This practical embedding is bolstered by rigorous change management strategies including trained 'super-users' and sandbox testing, which propelled daily AI adoption from 20% to 71%, highlighting that cultural transformation and workforce behavioral shifts are as critical as technological integration for sustainable governance.

By early 2026, a proactive 'governance by design' paradigm emerged, emphasizing early lifecycle integration through use case intake, data readiness assessments, and standardized design templates to shift governance from reactive to anticipatory. Clear ownership across outcomes, value realization, and lifecycle management became pivotal to sustaining governance, with leaders recognizing that cultural transformation and change management—not technology alone—are the greatest challenges to scaling AI governance effectively, reframing it as a business enabler rather than a bureaucratic hurdle.

Embedding AI governance into organizational structures and workflows requires a foundational focus on data access, trust, control, and measurement, integrating governance seamlessly into existing processes rather than bolting on fragmented models. This is critical in financial services where governance must operate like an orchestra—providing a common structure for coordinated decision-making without enforcing uniformity—while enabling risk-based oversight proportional to outcome severity, supported by board-level accountability and continuous monitoring to maintain trust and regulatory compliance across complex, legacy environments.

The evolution of AI governance in financial services has fundamentally expanded the scope of data oversight, requiring governance teams to transform into integrated Data & AI Governance units that manage not only data quality but also model integrity, prompt design, training data lineage, and human impact. As highlighted in late 2025, this shift underscores that governance success hinges less on rigid frameworks and more on effective change management and communication to build trust and articulate clear value, a sentiment echoed by organizations like Gold Bond, Inc., which demonstrated that embedding AI into IT-led workflows and cultivating 'super-users' can dramatically increase adoption rates from 20% to 71%.

By early 2026, the criticality of strong data foundations became unmistakable, with Info-Tech Research Group emphasizing that inconsistent data quality, weak governance, and low data literacy are primary barriers to AI readiness amid mounting regulatory pressures and data volumes. Enterprises are urged to adopt enterprise-wide data accountability and customer-centric data products, supported by structured frameworks that transition fragmented efforts into consistent, value-driven practices. This approach is further reinforced by best practices advocating for alignment among CISOs, data scientists, and business leaders on a shared definition of 'AI ready data,' automated data classification, and embedding strict access controls using AI-driven NLP to prevent training on sensitive information such as KYC or PII.

Operational readiness for AI in financial services demands continuous monitoring, observability, and human oversight to ensure trustworthy and compliant AI outputs. Tools like Databricks’ Unity Catalog exemplify the importance of data lineage and governance in managing interconnected dependencies from models to dashboards, while case studies from regulated entities stress the necessity of telemetry and observability as 'bumper guards' that enable scalable, secure AI deployment. Moreover, change management is not an afterthought but a foundational pillar that must begin at the outset, encompassing upskilling, rollback mechanisms such as version control, and guardrails to reduce hallucinations and maintain data integrity.

Despite these advances, a 2026 survey reveals that six in ten enterprises lack system-level visibility into their AI infrastructure, leading to fragile operations and reliance on manual diagnostics, which impedes effective root cause analysis and optimization. Partnerships like Virtana and Dell are stepping in with AI-powered observability platforms to provide real-time, cross-domain analysis, addressing these gaps. Concurrently, finance professionals express profound concerns—93% worried about AI-generated insight integrity due to hallucinations, bias, and fragmented data—with 42% citing data quality and integration challenges as major obstacles. This has spurred closer collaboration between finance, IT, and data teams, breaking down silos, and a growing recognition that formal upskilling in AI and data literacy is indispensable to managing risks and ensuring operational readiness, as emphasized by leaders like Ainslie van Onselen of CA ANZ.

The transition from AI experimentation to execution in finance hinges on high-quality, standardized, and well-governed financial data, which forms the bedrock for reliable, auditable AI outputs. Organizations that have invested in improving financial close processes, reconciliation controls, and data integrity find themselves better positioned to leverage AI effectively. Importantly, AI is being integrated into existing financial systems and workflows rather than treated as standalone innovations, with governance controls aligned to established enterprise systems like ERPs. This integration is coupled with explicit guardrails to ensure transparency, auditability, and compliance, reinforcing AI as an augmentation tool that supports human oversight rather than replacing it, thereby accelerating decision-making while maintaining rigorous control.

By early 2026, industry leaders like Alli Ward emphasized that successful AI adoption in financial services hinges not just on technology rollout but on embedding AI within a robust change management framework that prioritizes culture, communication, and continuous learning. Establishing centers of excellence, bite-sized training modules, and champions networks proved essential to sustaining momentum and fostering user confidence, while governance measures—such as strict data quality controls and usage tracking via tools like PowerBI—helped maintain transparency and security amid expanding AI deployments.

As AI governance matured, experts highlighted the critical need to integrate governance early in the AI lifecycle to avoid reactive, fragmented controls. Standardized checkpoints—covering use case intake, data readiness, and model design—combined with clear ownership of outcomes and lifecycle management, became foundational to operationalizing governance as a growth enabler rather than an obstacle. Yet, many organizations inadvertently shifted to human-on-the-loop oversight without explicit decisions, creating governance gaps that underscore the importance of leadership engagement and domain expertise in embedding controls within workflows.

Cultural and behavioral shifts emerged as the linchpin for balancing AI innovation with risk, with firms like TIAA and Takeda demonstrating that workforce trust and excitement are cultivated through hands-on access, experimentation, and continuous communication led by frontline managers and employee resource groups. This human-centric approach reframes AI’s impact from increasing workload to enabling better, more strategic work, addressing widespread anxiety about AI integrity and transparency—concerns echoed by 93% of finance professionals in ACCA’s 2026 report who worry about hallucinations, bias, and verifiability.

Despite heavy investment and enthusiasm, many financial organizations struggle with AI adoption due to internal factors like unclear accountability, insufficient training, and governance lagging behind rapid deployment pressures. Surveys from Avalara and Snowflake reveal that over 70% of finance leaders lack in-house AI expertise, with nearly a quarter uncertain who would be accountable for AI errors. Industry voices such as Glenn and Mike Goldsworthy stress that over-restricting AI use fosters risky shadow AI practices, urging CFOs to govern AI tools pragmatically—favoring clear, concise policies and embedding audit-ready documentation to maintain control, transparency, and regulatory compliance while driving innovation.

By early 2026, financial institutions were moving decisively beyond AI pilot projects and demos toward deployments that deliver measurable commercial impact, as noted by US Bank’s Prashant Morodi referencing the Water Leonise report. This shift was accompanied by a diminishing cultural fear of regulatory constraints, which had initially served as a false barrier to adoption. Spring Labs’ Johnson observed that sales cycles compressed significantly due to increased organizational readiness, signaling a growing confidence to install AI solutions that generate tangible business value.

Scaling AI successfully requires embedding governance and change management from the outset, not as afterthoughts. Rick emphasized that initiating change management at the very beginning of digital transformation is imperative, while Robert highlighted the necessity of a strong data foundation with telemetry, auditability, and traceability to satisfy regulatory demands. Their approach of balancing decentralized AI adoption with centralized governance—an 'AI first, AI everywhere' model—enables rapid, compliant scaling across functions, reflecting a governance maturity that transforms AI from isolated experiments into institutional infrastructure.

Despite widespread AI adoption—78% of banks using AI in at least one function—only 7% have fully scaled AI enterprise-wide, underscoring a persistent execution gap. The main obstacles are not AI models but legacy core systems, poor integration, and weak data quality, which impede moving from pilots to production. As one analysis put it, winning banks are those that embed AI into real workflows, improve data quality, and build governance early, turning AI from a slide deck concept into core infrastructure. Regulatory pressures from DORA, CRR3, CRD6, and the EU AI Act further elevate the need for explainability and oversight, making AI scaling as much a governance and operating model challenge as a technical one.

Industry leaders like Rajaram R.K. and Kaue Tozzi stress that scaling AI is fundamentally an operating model and platform challenge rather than merely a technology issue. Transitioning from pilots to platform-based approaches enables organizations to reimagine operations and customer experience, embedding AI as a foundational capability rather than a bolt-on feature. This requires modernizing legacy monolithic systems into cloud-native, composable platforms that integrate real-time data and analytics, paired with governance by design—embedding explainability, auditability, and operational resilience. Such integration supports human-in-the-loop models that augment frontline staff, automate complex workflows, and deliver measurable business outcomes, as demonstrated by AI-first retail banks achieving over 40% sales uplift and 70% call deflection via voice bots.

Robust AI governance frameworks are the linchpin for scaling AI from experimentation to enterprise execution. As Wavestone’s case study and multiple analyses reveal, governance must balance innovation with risk management and regulatory compliance, evolving from mere control gates to enhancing institutional judgment and enabling 'responsible innovation velocity.' This entails operationalizing model risk management, explainability, and third-party oversight from the outset, integrating governance upstream in the operating model. Leadership culture plays a pivotal role in continuously improving governance, transforming AI into a defensible strategic advantage, while practical execution demands managing AI initiatives like an investment portfolio focused on measurable value and reusable capabilities.

The transition from pilots to scalable AI deployments hinges on overcoming operational barriers such as fragmented data, inconsistent labeling, and legacy system constraints. As Aser Blanco and Tiran Rothman highlight, many banks falter by treating AI as a technology initiative rather than embedding it into core business processes, workflows, and risk controls. Successful scaling demands an 'AI factory' approach that integrates connected data infrastructures, change management, and real-time operational controls, replacing trust-based processes with closed-loop systems that verify and act on data instantaneously. This operational rigor enables AI to move from isolated experiments to integral components of financial products and services, driving sustainable value and competitive advantage.

Finally, scaling AI requires transparent, realistic timelines and performance targets to convince leadership to invest in foundational capabilities. Continuous monitoring of AI performance beyond proof of concept phases ensures early detection of issues, while setting benchmarks aligned with legacy systems helps demonstrate long-term productivity gains. Michael Reynolds encapsulates this operational impact, noting AI’s role in automating manual processes, accelerating knowledge retrieval, and improving service delivery, thereby boosting employee productivity without compromising controls. This pragmatic approach signals the end of AI experimentation and the beginning of disciplined, enterprise-wide execution.

By mid-2026, the regulatory landscape for AI in financial services is undergoing a fundamental transformation that emphasizes ecosystem-wide governance and collaboration. The Financial Stability Board’s 12-practice AI risk framework, championed by Michelle Bowman and Ho Hern Shin, underscores the critical role of boards and senior management in balancing innovation with risk management, while also calling for enhanced cross-jurisdictional coordination to maintain financial stability amid rapid AI advancements. Complementing this, IOSCO’s supervisory toolkit for capital markets reinforces continuous AI testing and lifecycle oversight as essential, reflecting growing concerns over the pace of Generative and Agentic AI adoption outstripping firms’ governance capabilities. These frameworks collectively signal a shift from isolated firm supervision toward managing interconnected systems reliant on shared AI models, cloud infrastructure, and third-party data providers, as highlighted by the FCA’s institutional perspective on AI challenges.

Bank-FinTech partnerships have emerged as vital yet complex pillars of modern financial infrastructure, driven by AI, APIs, and real-time payments, but they also introduce significant compliance challenges. Lawmakers and regulators stress that banks retain ultimate compliance responsibility, even as AI and digital assets complicate oversight, necessitating robust due diligence and risk assessment frameworks. This evolving environment has prompted fintech firms like AscentAI to position themselves as key risk management partners, while community banks face heightened enforcement risks due to unclear compliance ownership and fragmented regulatory guidance. Initiatives such as CFES’s STARC certification offer promising pathways to standardize compliance maturity assessments, helping smaller banks navigate this intricate landscape and underscoring the urgent need for industry-wide collaboration to sustain responsible AI and fintech adoption.

The role of compliance in financial services is evolving from a reactive gatekeeper to a proactive operational backbone that integrates regulatory requirements into scalable business processes, enabling firms to balance stringent frameworks like the EU AI Act, DORA, MiCA, and AMLA with customer demands for seamless digital experiences. This shift elevates quality assurance, continuous testing, and model validation teams to frontline defenders of responsible AI adoption, as emphasized by the FSB and IOSCO frameworks. Concurrently, CFOs and boards are increasingly scrutinizing AI governance through a financial lens, tracking AI model consumption and inference costs as distinct budget items, and prioritizing accountability and measurable returns on AI investments. As Dion Williams of Servicely notes, the winners in AI adoption will be those who demonstrate clear cost savings without sacrificing specialized talent, reflecting a maturation of AI governance from technological novelty to disciplined fiscal stewardship.