Adopting AI safely in a bank
In April 2026 the Federal Reserve, the OCC and the FDIC replaced SR 11-7 and left generative and agentic AI outside the new model risk guidance. Banks are still expected to govern it, and the design is now theirs.
What changed in April 2026
SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026 were issued together on April 17, 2026. The guidance's footnote on AI reads: "Generative AI and agentic AI models are novel and rapidly evolving."
Two mistakes to avoid
Don't assume the model risk program covers AI; it no longer does. And don't read excluded as ungoverned, since the AI you run is still your risk.
Sources: the Federal Reserve's SR 26-2, the OCC's Bulletin 2026-13 and the FDIC's announcement. The OCC says the agencies plan a request for information on AI.
What the research says
of UK financial firms using AI report only a partial understanding of the AI they use; a third of uses come from third parties.
Bank of England and FCA, November 2024of U.S. banks surveyed would prioritize governance if restarting their generative AI programs; only 16% of use cases reach full deployment.
EY-Parthenon, September 2025of organizations that reported a breach of an AI model or application lacked proper AI access controls. The study covers all industries.
IBM, Cost of a Data Breach, July 2025control objectives in the financial services AI risk framework, written for institutions and their third-party providers.
U.S. Treasury, February 2026people in the U.S. used a bank's chatbot in 2022, with inaccurate answers and unrecognized disputes among the harms found.
CFPB, June 2023Colorado consumers gain notice, an explanation within 30 days of an adverse automated decision, and a right to human review, lending included.
Colorado SB26-189, May 2026Autonomy, decided per action
An agent trusted to draft a summary may not be trusted to move money. Rate each action by its impact, how reversible it is and how far a mistake would spread.
Never autonomous
Financial, compliance and personnel decisions stay with people, and the record shows who decided.
The controls
Each addresses a question regulators, frameworks or incidents have raised. Together they're the evidence your risk, audit and examination teams will look for.
Governance
Each AI system's owner, purpose and autonomy level, kept beside the model inventory and linked to it.
Test sets and red-teaming before anything is promoted, and again as models, prompts and data change.
Who approved what, against which version, kept as long as the decision it supports.
Specific reasons for adverse action and testing for unfair outcomes, whatever produced the decision.
Security
Agents reach the bank's systems through one controlled point with per-tool allowlists, logging denied calls as well as allowed ones.
Each agent is a named identity with scoped access, or acts under the person who started it, never under a shared account.
Emails, documents, web pages and anything else an agent reads are treated as possible instructions from someone else.
An acceptable-use policy, and detection for AI tools used outside it.
Data and third parties
No training on the bank's data, in writing, and retention, residency and minimization set per use.
Each agent action can be reconstructed after the fact from a record that holds no customer data.
Tiered due diligence for AI providers and the providers behind them, and certified data destruction at exit.
A way to stop any agent at once, and a plan to replace any model or provider.
The infrastructure
Two limits remain. A gateway can be mandatory for agents, but people with direct access can still go around it, so monitoring has to cover both. And an observed pattern of behavior isn't approved until a named person signs it off.
What goes wrong
Poisoned input
Instructions planted in a public issue led a code-hosting agent to leak data from private repositories. The fix was architectural, with least privilege and one repository per session. Invariant Labs, May 2025.
Zero-click
A crafted email could steer a productivity assistant into sending data out, with no click from anyone. It was patched in 2025, but the pattern remains.
Too much autonomy
It happened during a code freeze, with no approval step between its plan and the action. The fault was its autonomy level rather than the model.
Customer harm
The CFPB found inaccurate answers and loops with no way to reach a person across consumer finance.
Shadow AI
One in five organizations in IBM's 2025 study reported a breach involving AI used outside policy, at higher cost than average.
Vendor opacity
A third of AI uses in UK financial services come from third parties, and many firms only partly understand them. Due diligence has to cover the AI.
The frameworks
ISO/IEC 42001 sets the structure of an AI management system and the NIST frameworks supply its risk content, much as ISO 27001 pairs with the NIST Cybersecurity Framework.
How Ignite supports you
They include a governed gateway, agents as named identities, a governance record without payloads and evaluation gates. We bring that reference architecture and the governance build to your program.
An AI inventory, autonomy levels, policies and review, designed to sit beside your model risk program.
Gateway, agent identity, data boundaries and tracing, built into your environment and your identity provider.
Test sets, red-teaming and the records your audit and examination teams will ask for.
What your third-party risk team will ask of any AI provider, including us, answered in one place.
Spend 30 minutes with us
No pitch, no obligation. And if we're not the right team for it, we'll tell you that too.
