ABA Risk & Compliance Conference: Reflections on AI Governance

Peter Dugas and Chinmoy Bhatiya
30 July 2025

In mid-June, Capco Executive Directors Chinmoy Bhatiya and Peter Dugas joined an expert panel titled ‘AI Governance: Mapping out a Strategy for Today and Tomorrow’ at the 2025 American Bankers Association (ABA) Risk and Compliance Conference. The panel highlighted the growing importance of establishing an AI governance framework that is essential to maintaining the safe and sound operation of a financial institution and helps to promote public confidence that a financial institution is using AI in an ethical manner.

The panel session emphasized the need for comprehensive frameworks to manage the risks and opportunities presented by generative AI (GenAI). It also stressed the imperative to create comprehensive policies and procedures for employee use and business case use scenarios.

The evolving AI regulatory landscape is a challenge for banks operating in the US and for those with overseas operations, given they must navigate a complex web of federal, state, and international regulations. The panel noted that institutions need to examine current regulatory and industry AI governance frameworks, such as the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001 – the world's first AI management system standard – and previously enacted legislation including the EU AI Act.

Panelists also discussed the distinctions between GenAI, machine learning, and natural language processing, noting GenAI's rapid adoption and disruptive potential. Effective AI governance requires a multi-faceted approach in which the essential components include corporate governance structures, risk appetite frameworks, data governance, and compliance mechanisms.

Institutions are encouraged to establish AI governance committees, involve subject matter experts, and implement ethical guidelines. Continuous monitoring, model explainability, and incident response playbooks are critical for managing AI risks such as bias, data privacy, and model drift.

The panelists explored practical use cases of AI in banking and the need for an AI governance program to include regulatory change management, policy updates, chatbot deployment, and control testing. Banks are leveraging AI to enhance efficiency and interpret complex regulations into plain language. However, the importance of starting with a solid governance framework and training staff across the organization was repeatedly stressed.

Conversations with conference attendees reinforced these themes and imperatives, centering on the regulatory environment and the necessity for dynamic risk management strategies. These discussions also highlighted the role of boards, cross-functional committees, and external advisors in fostering a culture of responsible AI use. The ISO/IEC 42001 standard and NIST's framework were cited as foundational tools for AI governance.

In summary, the conference underscored that successful AI integration in banking hinges on robust governance, regulatory awareness, and ethical considerations. Institutions must proactively adapt their risk management frameworks to address the unique challenges posed by AI technologies.