TL;DR
- AI governance that works for one business unit does not automatically work for five. The real test of enterprise AI governance is not the policy document. It is whether every business unit running models follows the same one.
- The structure that scales has two layers. A governance council sets policy at the top. A named accountable owner sits inside each business unit and applies it. Either layer alone breaks under real volume.
- SR 26-2’s naming requirement becomes a portfolio question once more than one business unit runs models. The rule only asks a bank to name who is responsible for each model. At scale, that turns into whether those names roll up to one place an examiner can see, or sit in five different spreadsheets.
- Most enterprise AI governance programs fail between the council and the business units. A strong policy and a strong business-unit team can both exist, and the program still breaks where the two are supposed to connect.
- A short checklist separates real enterprise governance from a shared slide deck. Five things every business unit needs from the central layer, covered below.
- This piece covers the operating layer that runs across business units. Read AI Governance Solutions for Regulated Financial Institutions for the platform category, and Model Governance in Banking for what a single model’s ownership, approval, and retirement require.
A bank that governs its first AI model well, usually in collections or fraud, tends to assume the hard part is behind it. It is not. The hard part starts when a second business unit, underwriting or deposits, builds its own model with its own team, its own timeline, and no reason to know how the first business unit did it. Enterprise AI governance is the layer that keeps both business units answerable to the same standard without slowing either one down to the pace of a single central team. The structure that does this reliably has two parts: a governance council that sets policy once, and a named owner inside every business unit who applies it locally. What follows explains why both parts are required, where the structure tends to break, and how to check whether your institution has built it.
Why AI governance breaks down the moment a second business unit builds its own program
A bank’s first AI governance effort usually attaches itself to whichever model shipped first. A collections model gets a risk tier, an approval step, and a monitoring dashboard, built by whoever stood the model up. It works, because one team owns both the model and the governance around it.
The second business unit rarely inherits any of that. Underwriting builds its own credit model on its own timeline, often with a different vendor, a different data team, and no visibility into what collections already did. Nothing about this is negligent. Nobody told underwriting that a governance pattern existed to reuse. By the third or fourth business unit, a bank has three or four different definitions of what “approved” means, three or four different monitoring dashboards, and an examiner asking for one answer to a question that currently has three or four.
This is not a policy failure. Most banks in this position already have a written AI policy. It is a structural failure: nothing connects the policy to how each business unit works day to day.
The structure that scales: one governance council, named ownership inside each business unit
Every credible version of enterprise AI governance research converges on the same two-layer structure, and the reason is not tradition. It is that each layer solves a problem the other cannot.
A governance council, drawing risk, compliance, legal, and technology leadership, sets classification standards, approval thresholds, and escalation rules once, for the whole institution. This is what keeps five business units from inventing five incompatible definitions of a high-risk model. Without it, “enterprise” governance is five separate governance programs that happen to share a logo.
The council cannot do the second job: applying those standards to the actual models a business unit runs, day by day. That requires a named owner inside each business unit, someone accountable for that unit’s model inventory, its tiering, and its evidence when an examiner asks. Without this layer, the council’s standards stay a document nobody operationalizes, and every business unit interprets “high risk” its own way regardless of what the council wrote down.
Most fragmented AI governance programs are missing exactly one of these two layers. A bank with a strong central policy and no business-unit ownership has a document. A bank with strong business-unit ownership and no central council has five good local practices that cannot answer one enterprise-wide question.
What SR 26-2’s naming requirement means once more than one business unit is running models
SR 26-2, the Federal Reserve’s April 2026 replacement for SR 11-7, sets a narrower bar than its predecessor for most model risk mechanics. On ownership, it asks one specific thing: a bank has to “delineate the individual(s) responsible… throughout the model lifecycle” for each model it runs.
At a single business unit running a handful of models, that requirement is easy to satisfy. One team, one list of names, one place to check it. The requirement gets harder to satisfy the moment a second and third business unit start running their own models under their own local practice. The regulation does not ask for a single list. It asks that the individual be identifiable, model by model. Nothing in SR 26-2 forces those names into one place a bank can hand an examiner in a single request, and that gap is exactly where the two-layer structure above earns its keep. A governance council that requires every business unit to name an owner in one shared inventory is what turns a scattered set of technically compliant answers into one an examiner can verify in a single sitting.
Where it breaks in practice: the friction points between one council and many business units
The two-layer structure fails in a small number of predictable places, and naming them ahead of time is cheaper than discovering them during an exam.
The approval queue becomes a bottleneck. If every business unit’s model has to clear the same central review before deployment, the council becomes the same single point of congestion a purely centralized data governance model runs into once model volume grows past what a small team can review at a reasonable pace.
Business units route around governance that feels too slow. A team under deadline pressure that cannot get a timely answer from the council will quietly deploy first and document later, which produces the exact gap an examiner is trained to find.
Classification drifts apart even with a shared policy. Two business units both call a model “medium risk” using their own judgment about what that means for their own data, and the inconsistency only surfaces when someone compares the two tiering decisions side by side.
The audit trail never consolidates. Each business unit can produce its own evidence on request, but nobody can produce a single enterprise-wide answer to “which models are running right now, and who owns each one,” because that answer lives in four different systems.
A short checklist: what every business unit needs from the enterprise governance layer
- A named accountable owner recorded in the one inventory the whole institution shares.
- The same risk-tiering criteria applied the same way, regardless of which business unit is scoring the model.
- A review and approval path with a published turnaround time, so business units have no reason to route around it.
- Monitoring evidence that rolls up to a single enterprise-wide view.
- A single answer, produced on demand, to which models are running across the institution right now and who owns each one.
An institution missing two or more of these is running several governance programs that happen to share a name.
How iTuring runs the same governance program the same way in every business unit
Whichever business unit deploys a model, the questions an examiner asks are identical: who owns it, what tier is it, what evidence exists, and when was it last reviewed. iTuring’s Model Governance module applies one classification standard and one approval workflow across every business unit’s models, so the answer does not depend on which team built the dashboard. The same Data Accelerator lineage that tracks a model’s data pulls in one business unit tracks it the same way in every other, which is what lets a governance council pull one enterprise-wide inventory without reconciling four local ones by hand.
The same underlying discipline supported the 116% improvement in collections recovery iTuring delivered for a leading NBFC in India, where governance did not sit apart from the model as a separate compliance exercise. It ran as part of how the model operated from day one.
Running one governance program across five business units is not five times the work of running one, if the two-layer structure above is in place before the fifth business unit builds its first model. Book a 15-minute discovery call to see how iTuring keeps one governance standard consistent across every business unit’s models.
Sources
- “Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management,” Board of Governors of the Federal Reserve System, 17 April 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
- iTuring.ai case study, “Improve Collections and Optimize Efforts.” https://ituring.ai/case-study/improve-collections-and-optimize-efforts/
- iTuring.ai, “Model Governance in Banking: Ownership, Approval, and Retirement.” https://ituring.ai/model-governance/
