TL;DR

• AI governance is the set of policies, ownership, and evidence a bank uses to prove its AI systems are working as intended. Not a document. A standard that has to hold up model by model, in an exam room.
• The US regulatory picture shaping this is more specific than most guides admit. SR 26-2, the Treasury’s Financial Services AI Risk Management Framework, NIST AI RMF, and ISO/IEC 42001 each say something different about what a bank has to show, and confusing them leads to gaps.
• A complete program covers four components: model governance, data governance, continuous monitoring, and audit trail. Missing any one of them leaves an examiner’s question unanswered.
• The gaps are predictable and this cluster covers each one in depth. Ownership, data inputs, AI-specific models, and cross-business-unit coordination each break governance in their own way.
• Building a program from close to zero takes a phased approach. Most institutions get there in stages.
• A short checklist tells you whether your program is complete or has a real gap. Covered below.
• This piece is the overview. Read AI Governance Solutions for Regulated Financial Institutions for what a governance platform needs to do, and the linked pieces throughout for the mechanics of each component.

A bank searching “AI governance” today finds two kinds of answers. One is broad and generic, written for any enterprise in any industry, citing the EU AI Act and calling it done. The other is banking-specific but built around European instruments, DORA, BaFin, the EU AI Act’s risk tiers, with nothing to say about the rules a US examiner applies. Neither answers the question a US bank or credit union is asking: what does SR 26-2 require, what does it leave open, and what has to be built regardless of what the letter of the guidance says. This piece is that answer. It defines AI governance for a regulated US financial institution, maps the real regulatory picture shaping it in 2026, names the four components a complete program covers, and gives a phased way to build one.

What AI governance means for a regulated financial institution

AI governance is the set of policies, named ownership, and produced evidence a financial institution uses to show that every AI system it runs, predictive, generative, or agentic, is developed, deployed, and monitored the way it says it is. That is a working definition. It isn’t a formal one, since no single US instrument defines the term the way SR 26-2 defines model risk management. The definition matters because it sets the bar correctly: governance isn’t a policy binder. It’s the ability to answer, for any model in production, who owns it, what it was tested against, what it’s doing right now, and what happens if it starts doing something else.

That bar applies whether or not a specific model is formally in scope of a specific rule. A generative model summarizing loan documents sits outside SR 26-2’s current scope. It still makes decisions that affect customers, and an examiner still asks how it’s governed. AI governance, done properly, answers that question for every model an institution runs. It doesn’t stop at the ones a named rule happens to cover.

The regulatory picture shaping AI governance in the US right now

Four instruments matter most for a US bank or credit union in 2026, and they don’t say the same thing.

SR 26-2 (Federal Reserve) and OCC Bulletin 2026-13, jointly issued 17 April 2026, replaced SR 11-7, the guidance that shaped US bank model risk management for fifteen years. The replacement states directly that it “does not set forth enforceable standards or prescriptive requirements,” a sharp departure from SR 11-7’s de facto standard status, and it removes the fixed annual validation cadence SR 11-7 required, letting each institution set its own schedule based on its own risk profile. It’s described as “expected to be most relevant to banking organizations with over $30 billion in total assets,” though it explicitly does not exempt smaller institutions “that have significant exposure to model risk because of the prevalence and complexity of their models.” It excludes generative and agentic AI from its scope entirely, calling both “novel and rapidly evolving” and deferring them to separate guidance with no date given, even as examiners continue asking what monitoring and effective-challenge process a bank runs for those models regardless.

The US Treasury’s Financial Services AI Risk Management Framework (FS AI RMF), released 19 February 2026 with the Cyber Risk Institute and the Financial Services Sector Coordinating Council, is the first framework built specifically for this sector, stating it was “designed for all financial institutions, community banks, credit unions, national and multinational banks, insurers, investment firms, and more, and their third-party providers.” It’s voluntary, with no certification path. Even so, it’s the closest thing to a sector-specific playbook a US institution has right now.

NIST AI RMF, published January 2023, is voluntary and cross-sector, organized around four functions: Govern, Map, Measure, and Manage. It doesn’t speak to banking specifically, but examiners recognize its structure and it maps cleanly onto SR 26-2’s own principles.

ISO/IEC 42001, published 2023, is voluntary and has no enforcement behind it. It is the only one of the four a bank can get independently audited and certified against by a third party, which matters for institutions that need to demonstrate governance maturity to a partner or regulator beyond a self-attestation.

None of the four carry SR 26-2’s supervisory weight, and none of them replace it. An institution that adopts NIST’s structure or gets ISO 42001 certified still has to answer SR 26-2’s specific questions when an examiner asks them. The EU AI Act binds a US institution only when it places an AI system on the EU market or that system’s output is used in the Union, a narrower trigger than most guides acknowledge, so a purely domestic US bank isn’t bound by it at all, whatever a generic governance guide implies.

The four components a complete AI governance program covers

Model governance answers who owns each model, what approved it, and what retires it. This is the mechanics SR 26-2 touches most directly, and the ownership question it does prescribe, naming “the individual(s) responsible… throughout the model lifecycle,” is the foundation everything else builds on. Read Model Governance in Banking for the ownership, approval, and retirement structure this covers, and AI Model Governance for what changes once the model in question is generative or agentic and sits outside SR 26-2’s formal scope.

Data governance answers what data trained a model and what data it continues to consume in production. Most data governance programs were built to audit data sourced once and approved before training. An AI model keeps consuming data long after that, often from sources, unstructured text, real-time streams, synthetic data, and its own prior outputs feeding back in, that never pass through the same checkpoint. Read Data Governance Models for AI-Driven Institutions for the structural decision and Data Governance for AI for the specific inputs that slip through.

Continuous monitoring answers what a model is doing right now, beyond what it did when it was validated. A model can drift, degrade, or start returning outputs outside its tested range between formal reviews, and an institution that only checks at the validation cadence is answering a question about a moment that already passed. Read AI Governance Monitoring for what keeps a model inside policy after deployment.

Audit trail answers the question underneath every other one: can the institution produce evidence, on demand, without reconstructing it after the fact. This is where governance either exists as a byproduct of how models run or doesn’t exist at all when an examiner asks for it.

An institution missing any one of these four has a partial program, whatever its policy documents say. A model can be well owned and poorly monitored. It can be well monitored on data nobody ever audited. Each component covers a different failure mode, and none of them substitute for the others.

Where AI governance breaks down in practice

The gaps in AI governance aren’t random, and each one has a predictable shape. An institution running models across more than one business unit finds that a council-level policy and strong local ownership can both exist and the program still breaks at the connection between them, covered in Enterprise AI Governance. An institution that governs its traditional models carefully often treats its generative and agentic models as a separate, lower-priority category, because SR 26-2 doesn’t formally cover them yet, even as examiners ask the same questions regardless, covered in AI Model Governance. An institution evaluating a governance platform can mistake feature breadth for actual coverage of these gaps, covered in AI Governance Software and AI Governance Platforms: Build, Buy, or Extend.

The pattern across all of these is the same. A governance program looks complete on paper because a policy exists, an owner is named, and a platform is licensed. It’s incomplete in practice because one specific connection, board to business unit, traditional model to AI model, feature list to real evidence, was never tested against what an examiner will ask.

Building an AI governance program: a phased approach

An institution starting close to zero doesn’t build a complete program in one project, and treating it as one project is usually why the effort stalls.

Start with model inventory and ownership. Before anything else, name every model in production, predictive, generative, and agentic, and assign an accountable owner to each one. This is the single requirement SR 26-2 does prescribe, and it’s the foundation every other component depends on.

Add data lineage for what each model consumes. Once ownership exists, document where each model’s data comes from, structured and unstructured, one-time and streaming, external and self-generated. This is usually where the biggest surprises show up, since most institutions have never mapped this completely.

Build continuous monitoring on top of the inventory. With models and their data both documented, add monitoring that tracks behavior between formal reviews, tuned to how often each model’s inputs change.

Close the loop with audit-ready evidence. The final stage turns the first three into something an examiner can use directly: evidence produced as models run, ready before a request ever comes in.

This order matters. An institution that starts with monitoring before it has an inventory is monitoring an incomplete list. One that builds audit reporting before it has real data lineage is reporting on gaps it hasn’t found yet.

A short checklist: is your institution’s AI governance program complete

• Every model in production, predictive, generative, and agentic, has a named accountable owner in one shared inventory.
• Every input feeding those models, structured, unstructured, streaming, synthetic, third-party, and self-generated, has a documented source.
• Monitoring runs continuously, tuned to how often each model’s behavior can change, separate from a fixed periodic schedule alone.
• Audit evidence exists as a byproduct of how models run, ready before an examiner has to ask for it.
• The program applies the same standard whether a model is formally in scope of a specific rule or not.

An institution missing two or more of these has a program that will pass a policy review and still struggle in an exam room.

How iTuring supports every layer of AI governance in one platform

iTuring’s Model Governance module, Data Accelerator lineage, and monitoring apply one classification standard, one approval workflow, and one audit trail across an institution’s full model portfolio, predictive, generative, and agentic alike, without waiting for a rule to formally name a category before governing it. The same platform that tracks a traditional model’s approval history tracks a generative model’s prompts and a data feed’s provenance the same way, so the evidence an examiner asks for exists regardless of which component of governance the question touches.

The same discipline supported the 116% improvement in collections recovery iTuring delivered for a leading NBFC in India, where governance ran as part of how every model operated from the start. It was never a program bolted onto the platform after the fact.

An AI governance program that looks complete on a policy document and one that survives an examiner’s actual questions are not the same thing. Book a 15-minute discovery call to see how iTuring covers every component of AI governance on one platform, model by model, from inventory through audit-ready evidence.

Sources

1. “Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management,” Board of Governors of the Federal Reserve System, 17 April 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
2. US Department of the Treasury, Financial Services AI Risk Management Framework, 19 February 2026. https://home.treasury.gov/
3. National Institute of Standards and Technology, AI Risk Management Framework, January 2023. https://www.nist.gov/itl/ai-risk-management-framework
4. International Organization for Standardization, ISO/IEC 42001:2023. https://www.iso.org/standard/81230.html
5. iTuring.ai case study, “Improve Collections and Optimize Efforts.” https://ituring.ai/case-study/improve-collections-and-optimize-efforts/