During one week in late August, four large banks gave us a useful glimpse of where AI deployment is heading.
Bank of America described live work across advisory, payments and engineering. U.S. Bank laid out a disciplined approach to scaling AI. Lloyds Banking Group set a target of £100 million in value through initiatives that include fraud and complaint workflows. Deutsche Bank reported major reductions in completion times for certain tasks.
Different banks. Different businesses. The common theme was how they organized the work around the technology.
We spend a lot of time in banking talking about whether an institution is moving quickly enough. AI adds urgency to that conversation. It also reminds us that moving quickly depends on the strength of the operating model.
The sequence matters
U.S. Bank described six steps: pick the right work, define outcomes, productize and reuse, invest in skills, scale responsibly and prepare for agents.
I like the order. The conversation about agents comes after the basics.
That is familiar ground for anyone who has been through a core transformation. You can make a terrific vendor selection and still end up with a troubled program if nobody owns the end-to-end process or if risk and operations enter the discussion after design decisions have been made.
AI compounds that problem because the results can vary. Quality assurance has to look at decision quality, traceability and recovery performance alongside the traditional question of whether a transaction posts correctly.
When the business team is ready to move and the control functions are still trying to understand the design, everything stops. When those teams work together from the beginning, they can make decisions faster with a clearer view of the risk.
Make accountability visible
I would build a governance minimum around five elements.
- An accountable business owner for each material AI use case with defined authority to pause it.
- An inventory describing the systems in use, the decisions they may influence and the people responsible for oversight.
- A documented review before production with risk, compliance and technology represented where appropriate.
- Traceability for the inputs and outputs that matter to customers, financial decisions and regulatory obligations.
- An escalation process that explains what happens when a model or agent delivers the wrong outcome.
Those items will look different in a $2 billion community bank than they do at a global institution. The underlying responsibilities are remarkably similar.
A small bank can begin with a few priority workflows and a simple decision log. What matters is that the process actually runs and the people involved can explain it.
The regulators are moving too
In April, the Federal Reserve, OCC and FDIC issued revised model risk management guidance. It emphasizes a risk-based approach and supersedes SR 11-7. The agencies specifically excluded generative and agentic AI from that guidance’s scope while signaling further work on the subject.
That distinction matters. Banks should avoid treating the revised document as a complete rulebook for AI agents. They still need governance appropriate to the risks of their deployments and the legal and supervisory obligations applicable to their institution.
I would ask management for a short report that covers the current AI inventory, material decisions made since the last review and any controls that need attention. I would then use that information to set priorities for the next deployment.
Good governance creates a predictable path for getting things done. In AI that path is quickly becoming part of an institution’s competitive position.
We should build the path before the next wave of projects needs to travel it.
Covered in Don’t Blink, my weekly Banking Intelligence Service brief: Issues #31 and Issue #30.
