Artificial Intelligence in Banking: Innovation Without Losing Control

Artificial Intelligence (AI) has quickly become a daily business tool. Employees of financial institutions are using AI-powered assistants to draft emails, summarize documents, analyze data, and improve productivity. Some institutions are even evaluating AI for customer service, fraud detection, loan operations, marketing, and countless other business functions.

While the potential benefits are significant, AI also introduces new risks that financial institutions must carefully manage, such as balancing innovation with regulatory expectations, customer privacy, and information security requirements.

The question is no longer whether AI will be used, but how do we promote usage in a controlled and secure manner?

Key Risks in Using AI

Like all new technologies, AI presents opportunities and challenges for financial institutions.

One of the greatest risks is the potential exposure of sensitive information. For instance, an employee may unknowingly enter confidential customer data, internal documents, or proprietary information into a public AI platform without understanding how that information may be stored, processed, or used.

We must also consider risks associated with inaccurate information. AI-generated content can appear authoritative while containing factual errors, outdated information, or an incomplete analysis. Decisions involving customers, lending, compliance, or risk management should never rely solely on AI-generated output without appropriate human review.

Third-party risk is another growing concern. Software vendors are rapidly integrating AI features into existing products, and in some instances, institutions may not realize that customer information is being processed by AI systems unless they actively engage vendors for an understanding into how AI is being used.

What Regulators and Examiners Are Looking For?

Regulatory guidance continues to evolve, and examiners are increasingly focused on governance and risk management surrounding AI. Institutions must be prepared to demonstrate that they understand where AI is being used, what risks exist, and what controls to reduce the risks have been implemented.

Examiners are likely to ask questions such as:

• What AI tools are employees using?
• Has management approved those tools?
• Are policies governing acceptable AI use in place?
• Has the institution assessed the risks associated with AI?
• How is customer information protected when AI tools are utilized?
• Are third-party AI providers subject to vendor management reviews?
• Is the Board informed about AI-related risks and opportunities?

Institutions that can proactively address these questions now will be better positioned as regulatory expectations continue to mature.

Building an AI Governance Program

Financial institutions do not need a complex AI program to begin managing risk. They do, however, need to establish a foundation that provides visibility, oversight, and accountability in regard to AI. To begin, we recommend the following:

Creating an AI Inventory

The first step is understanding where and how AI is being used. Institutions should develop an inventory of approved AI applications, vendor solutions that incorporate AI, and any internally developed use cases. You cannot manage risks that you do not know exist.

Establishing an AI Usage Policy

Provide employees with clear guidance regarding acceptable AI use. Policies should address:

• Approved and prohibited AI tools
• Restrictions on entering customer or confidential information
• Human review requirements
• Security and privacy expectations
  
  

Incorporating AI into Risk Assessments

AI should be evaluated as part of the institution's risk assessment process. Consider operational, compliance, legal, reputational, and information security risks associated with each use case.

Reviewing Third-Party AI Providers

As vendors add AI capabilities to existing products, institutions should understand:

• What institution data is being processed by vendor AI tools?
• Where institution data is stored.
• Is institution information being used to train models?
• What security controls are in place to protect the environment?
• What contractual obligations and notification requirements are in place to protect the institution?
  
  

Training Employees

Employee awareness remains critical. Employees should understand both the benefits and risks of AI technology. Training should emphasize responsible use, protection of sensitive information, and the importance of validating AI-generated results.

Informing the Board

Boards do not need to become AI experts, but they should understand how AI is being utilized within the institution, the associated risks, and management's approach to governance. Regular reporting can help ensure appropriate oversight and strategic alignment.

Moving Forward with AI

AI offers tremendous opportunities for institutions to improve efficiency, enhance customer service, and support decision-making. However, like any emerging technology, success depends on implementing appropriate governance and controls.

The institutions that benefit most from AI will not necessarily be those that adopt it the fastest. They will be the institutions that understand the risks, establish reasonable safeguards, and integrate AI into their overall risk management framework.

By taking a proactive approach, institutions can embrace innovation while maintaining the security, trust, and regulatory compliance that customers and stakeholders expect.