Banks Want AI to Decide Credit and Risk. Their AI Governance in Banking Is Not Ready.
A survey of 300 banks finds three in four expect autonomous credit and risk decisions within five years, while fewer than one in five have the governance to support them. Two-thirds would trade transparency for performance. AI governance in Banking is the need of the hour.
Three in four banking leaders expect AI to make credit and risk decisions autonomously at scale within five years, and a quarter expect it within two. Fewer than one in five say their bank has fully operational governance for AI today. Those two findings sit in the same survey, and the distance between them is the story. The research, published by SAS with FT Longitude and Microsoft, surveyed 300 banking leaders across 31 countries between June and July, with two-thirds of respondents from institutions holding more than 50 billion dollars in assets.
The numbers are stark in a way that matters, because the decisions in question are the ones regulators care about most. Credit scoring for individuals counts as a high-risk use under the European Union’s AI Act, which brings obligations on risk management, data governance, documentation, transparency and human oversight. The European Banking Authority has mapped those duties against existing banking law and found no significant contradictions, which means the obligations stack rather than replace each other. Read alongside the survey, the picture is of an industry adopting AI faster than it can account for the decisions that AI makes.
What the survey found
The report, titled Why AI at Scale Needs Governance at Speed, describes near-universal adoption. Two hundred and ninety-nine of the three hundred banks use AI somewhere in credit and risk decision-making. Eighty-two per cent use generative AI for decisions and 41 per cent use agentic AI. Only 10 per cent let AI make autonomous credit or risk decisions at scale today, but 76 per cent expect that within five years and 25 per cent within two. On the governance side, the picture inverts. Eighteen per cent have fully operational and embedded AI governance, 19 per cent run real-time model drift monitoring, 42 per cent lack defined kill switches for models that breach preset boundaries, and 36 per cent retrain or update models continuously. More than a quarter have no dedicated AI model risk policy at all.
The governance gap, in numbers
Two findings deserve particular attention. The first is that 92 per cent of respondents say at least one large language model inside their institution operates outside formal governance frameworks, whether a team built it or a vendor supplied it. That is close to a universal admission, and it describes a specific failure mode: the tool arrives through a team, a vendor or a pilot, does real work, and never enters the inventory that risk functions maintain. The second is the 26 per cent with no AI model risk policy. A model risk policy is not a formality; it is the document that defines which models exist, who owns them, how risk teams validate them and when they stop running. An institution without one cannot answer the basic question a supervisor will ask.
The survey also exposes a split between what banks do and what they intend. Fifty-nine per cent have partly or widely embedded AI in decision-making, and AI influences departmental decisions at least monthly in 53 per cent of organisations. It sits inside 63 per cent of credit risk processes and 55 per cent of asset and liability management. Tangerine, a Canadian digital bank, offers an unusually candid account in the report: more than 90 per cent of decisions in its retail credit portfolios are AI-based with little human involvement, while it keeps a human in the loop for high-risk portfolios until it gains more confidence. That is a reasonable position, and it is also a choice that requires the governance machinery the survey says most banks lack.
A Practical Shape
The gap has a practical shape. Banks adopted AI through channels that bypass the usual model approval process: a business unit subscribes to a tool, a vendor embeds a model in software the bank already runs, or a team builds an agent to clear a backlog. Each step is reasonable on its own, and together they produce a portfolio nobody has catalogued. That is why the 92 per cent figure is credible even at the top of the market, where two-thirds of respondents work at institutions with more than 50 billion dollars in assets. Large banks have model risk functions, but those functions grew up around statistical models with defined inputs and documented validation. An agent that calls tools, reads documents and acts on its output does not fit that template, and the survey suggests most institutions have not redesigned the template to fit it.
The black-box temptation
The most uncomfortable finding is that 63 per cent of banking leaders would use a black-box model with little or no transparency if it delivered better performance, returns or liquidity than an explainable alternative. That preference is rational in a narrow sense, and dangerous in a wider one. The OECD, in a January report on supervising AI in finance, describes the problem precisely: the opacity of advanced models complicates model validation, makes it harder to detect and correct flaws, obscures potential bias, and challenges the accountability that most supervisory frameworks require. It also notes that firms are actively trying to balance explainability against performance, use case by use case. The survey suggests that in practice, when the trade-off arrives, a majority leans toward performance.
What the rules already require
The regulatory frame is not theoretical, and banks do not need to wait for it. In Europe, the AI Act classifies AI used to evaluate creditworthiness or set credit scores for individuals as high risk, which triggers obligations on risk management, data governance, technical documentation, transparency, human oversight, accuracy, robustness and post-market monitoring. DORA treats AI systems as ICT systems, so incident reporting, third-party risk management and resilience testing apply. GDPR Article 22 gives people rights over decisions that automated systems make alone, which in lending means the ability to obtain meaningful information about the logic involved.
Outside Europe, the picture is a patchwork: the Equal Credit Opportunity Act in the United States requires adverse action explanations, the UK’s Financial Conduct Authority applies its consumer duty and operational resilience expectations, and Singapore’s Monetary Authority has published AI risk management guidelines that take effect in October 2027 and 2028. The Financial Stability Board, in sound practices published this month, names explainability, human oversight and the containment of autonomous agents as core expectations.
What good governance looks like
The practices that satisfy supervisors are unglamorous and specific. A model registry that tracks every version that ever scored a customer, with its training lineage and the window in which it ran. A decision ledger, separate from the model, that records the decision, the model version, the inputs and any human override, and that stays immutable, because re-running a model later does not reproduce the original decision. A kill switch with pre-agreed thresholds, named owners and a documented process for restarting, since pausing on material drift is a sentence rather than a control. Pre-deployment and post-deployment fairness testing that shares metrics, so production can be compared with the lab. And a clear line between commercial decisions, which a model may drive, and compliance decisions, which it may not.
What banks should ask
For a bank weighing how far to let AI decide, the questions are practical. Can we list every AI model and agent in use, including the ones a business unit bought without telling risk? For each one, which decisions does it influence, and is it high-risk under the AI Act or an equivalent rule? Can we reproduce a decision made eighteen months ago, and show which version made it? What are our kill-switch thresholds, who can pull them, and when did we last test that? How do we detect drift and bias in production, not just at build time? What do we tell a customer who asks why they were declined? And who is accountable when the model is wrong, in a way a regulator will accept?
What it signals
SAS commissioned the survey, and the sponsors sell governance tooling, so the findings serve their interests. That does not make the numbers wrong, and it does not change the arithmetic. Banks have adopted AI almost universally, expect it to take over consequential decisions within a few years, and in most cases have not built the controls that make those decisions explainable, auditable and reversible. Regulators have already written the requirements, and the European Banking Authority’s view is blunt: ambition should match capacity. The banks that move first on governance will not be the slowest to adopt AI; they will be the ones able to adopt it at scale without discovering, after the fact, that nobody can say why the system decided as it did.
The commercial context matters here. SAS sells risk, fraud and compliance software, Microsoft sells the cloud and AI platform underneath it, and both have an interest in a survey that finds a governance gap. That does not invalidate the numbers, and the independent material agrees with the direction of travel: the OECD, the Financial Stability Board and the European Banking Authority all describe explainability and oversight as live supervisory problems rather than settled ones. What the survey adds is a measure of how far the practice lags. The useful response is not to buy a governance product on the strength of a vendor survey, but to test the institution’s own answers to the questions a supervisor will ask, and to start with the one that is hardest to fake: can we list every model and agent we run, and say who owns each one?