Regulation & Accountability

Governance & Risk

Governance is not a brake on AI adoption — it is what makes sustainable adoption possible, especially under regulatory scrutiny.

Four Risk Domains

Model Risk

SR 11-7 applies to AI/ML models. LLMs introduce new challenges: probabilistic outputs, hallucination risk, and difficulty backtesting. Banks need an AI model inventory just like traditional risk models.

Data Risk

Training data bias creates discriminatory outputs. Employees using commercial LLMs may leak proprietary client data. Data residency rules create cross-border compliance exposure.

Regulatory Risk

EU AI Act classifies credit scoring, hiring, and fraud detection as high-risk AI. SEC, FINRA, OCC, and the Fed are increasing scrutiny on algorithmic decision-making in financial services.

Governance Structure

Who owns AI risk — CRO, CTO, or CAIO? Model validation must be independent. Boards need AI literacy. Governance gaps create liability at every organizational level.

Regulatory Landscape by Sector

Sector	Key Regulations & Obligations
Banks	SR 11-7 model risk · ECOA / Reg B adverse action · OCC model guidance · Fair lending · CRA · FDIC oversight
FinTech	CFPB supervision · AML / BSA · SEC / FINRA (investment tools) · State money transmission · EU AI Act (if global)
Universities	FERPA (student data) · IRB (research AI) · Accreditation standards · ADA compliance for AI tools
All Sectors	EU AI Act 2025 · NIST AI Risk Management Framework · SOC 2 / ISO 27001 · State privacy laws (CCPA, CDPA)

Governance Action Checklist

Build an AI Model Inventory

Document every AI model in production — inputs, outputs, risk tier, and owner.

Assign AI Risk Ownership

Designate CRO, CTO, or CAIO as accountable. Ambiguity creates liability.

Run a Bias Audit Before Deployment

Test credit, hiring, and admissions models for disparate impact before going live.

Define Human-in-the-Loop Thresholds

Which decisions can AI make alone? Lending, hiring, and academic outcomes require human review.

Write an AI Ethics Policy

Board-approved. Covers bias, explainability, privacy, and employee displacement obligations.

Validate Models Independently

Model development and validation teams must be separate — as required by SR 11-7.

Map Your Regulatory Exposure

Identify which regulations apply to each AI use case. EU AI Act enforcement begins 2025.

Educate Your Board

Board-level AI literacy is no longer optional. Directors need to ask the right questions.

Bonaparte AI Adoption

University of Colorado Denver · Yosef Bonaparte, Ph.D. · yosef.bonaparte@ucdenver.edu