By Ravi Nemalikanti
Most bankers today are not debating whether AI belongs in their institutions. That question has largely been settled by competitive reality. The harder conversation, the one happening in boardrooms and executive committees right now, is how to implement AI in a way that is safe, auditable and defensible to regulators and examiners.
Many bank board members are still cautious, because the consequences of poorly governed AI in a regulated environment are devastating. They need a structured implementation approach that gives them genuine oversight.
Institutions that are moving forward successfully with AI have figured out how to provide exactly that.
Governance is a set of operational decisions
The first mistake many institutions make is treating governance as a policy document rather than an operational structure. A written AI policy matters, but what a board can evaluate is whether the institution has made specific decisions about where AI operates, who is accountable for its performance, what human review is required and how outcomes are measured. And each of those decisions needs to be made before deploying AI.
- In what functional areas and workflows will AI be used?
- How are the boundaries for prohibited applications and systems defined?
- What are the human-in-the-loop requirements?
- How will risk be identified, documented, measured, monitored and mitigated?
- What controls govern data, vendors and model inputs?
- Who is accountable for AI decisions and outcomes?
These are not abstract questions, nor is it an exhaustive list. They are the operating parameters that enable a compliance officer to answer an examiner’s questions, a business leader to evaluate whether the tool is performing as intended and a board to exercise meaningful oversight. Institutions that have worked through these decisions before going live have a significantly easier time gaining board approval for subsequent use cases.
Risk-based adoption
Build confidence by first adopting AI when the risk is lower, the processes are rulebased and the workflows are well-defined.
While keeping human review as part of the process, AI can improve consistency and reduce the time experienced staff spend on repetitive data work. The human review loop is the mechanism that builds institutional familiarity with AI performance and surfaces cases that should inform policy.
Starting in lower-risk workflows allows the board and leadership to readily see the actual outputs, evaluate the review process and assess whether the tool is performing within parameters, before the institution expands into applications with higher stakes.
Precisely define human review
Early AI implementations often struggle, or even fail, when it is assumed that “human in the loop” is self-explanatory. In practice, it can mean different things to different people on different days and inconsistencies that create the kind of variability that draws regulatory attention.
Human review and escalation requirements need to be specified at the workflow level. This is what allows an institution to demonstrate to an examiner that its AI tools are operating within a controlled environment. It is also what allows a board member to understand, in concrete terms, where human judgment remains essential and where AI is functioning as a processing and drafting tool rather than a decision-maker.
Business ownership of AI
When accountability is left to the technology or risk departments, and the business leaders view AI as something that happens operationally, AI governance is undermined.
Governance that works assigns clear ownership at the business level. Technology teams maintain infrastructure. Risk and compliance teams define controls and monitor for regulatory alignment. Business leaders — the heads oflending, private banking, treasury management and operations — remain accountable for whether AI is producing the outcomes it was implemented to achieve. They define the success metrics, review performance against them and escalate when something is off.
That ownership structure also yields meaningful reporting to the board. Performance reporting to leadership and the board should focus on institutional impact, including loan processing turnaround, underwriting consistency and fraud detection rates. Metrics that require technical interpretation to evaluate offer leadership very little. Metrics tied to strategic priorities give the board what it needs to assess whether AI is aligned with the institution’s risk appetite and mission.
A path forward that risk-averse boards can support
The clarity of their implementation framework defines the institutions making the most durable progress with AI now. They started workflows with a short feedback loop, making errors easy to catch. They defined ownership and review requirements before deployment. They built a reporting system that leadership could evaluate without a technical background.
That discipline is not a slower path to AI adoption. Boards that trust the governance structure will approve the next use case. Boards that feel they approved something they do not fully control become significant obstacles to everything that follows. Getting the governance model right and being able to demonstrate it clearly is what transforms AI from a risk-management concern into an institutional capability.
Ravi Nemalikanti is chief product and technology officer at Abrigo.
