Skip to content
NEWSQapitol partners with GenRocketRead →
Talk to QapitolRun Assessment
Qapitol Research
Edition · First edition
The libraryDeep Research · Field brief

The State of AI Governance in BFSI 2026

A board-ready assessment of where regulatory obligations, governance frameworks, and AI deployment risk intersect across the global financial sector — and what institutions must do before supervisory scrutiny intensifies.

The call
By late 2027, multi-jurisdictional BFSI institutions that have not operationalised the three examination pillars — senior accountability, continuous monitoring, and documented governance — will face materially elevated supervisory risk as MAS final guidelines, ongoing EU AI Act enforcement, and US SR 26-2 implementation converge simultaneously.
PublishedJuly 2026
EditionFirst edition
FormatDesigned PDF · 11 pages
AccessFree with email
Briefing · videoPDF
01The brief

Executive summary.

  1. 01The global regulatory environment for AI in financial services has shifted from observation to obligation. The EU AI Act — the world's first comprehensive legal framework for AI — is now in force with explicit extraterritorial reach and prescriptive requirements for high-risk use cases in banking and insurance, including credit scoring and underwriting. Singapore's MAS has issued proposed AI Risk Management Guidelines requiring board-level accountability and supervisory pre-approval for high-impact deployments, with final guidelines expected mid-2026 and compliance deadlines in the latter half of 2027. The US has revised its foundational model risk management guidance through SR 26-2 — a significant modernisation reflecting over fifteen years of supervisory experience — though it simultaneously carves out generative and agentic AI, creating a governance gap that institutions must bridge through separate, principles-based frameworks. Across jurisdictions, a convergence is visible around three control families: lifecycle model governance, customer protection and explainability, and operational resilience with third-party accountability.
  2. 02Against this regulatory acceleration, institutions are deploying AI at scale and speed. Average projected AI investment at US banking organisations reached $177 million in Q1 2026, up from $133 million just one quarter prior. Agentic AI — effectively absent from industry surveys two years ago — is now being piloted or deployed by more than half of respondents. Yet the governance infrastructure required to manage this deployment has not kept pace. Generative and agentic AI fall outside SR 26-2's formal scope, creating a voluntary, fragmented oversight landscape in the US. Data bias controls required by EU AI Act Article 10 go well beyond BCBS 239, demanding new processes that most institutions have not yet built. Third-party concentration across cloud, hardware, and foundation-model providers creates systemic vulnerabilities that standard vendor due diligence frameworks were not designed to assess. Boards and senior management teams that cannot demonstrate documented AI governance, senior accountability structures, and continuous monitoring capabilities face the highest supervisory risk in the coming examination cycle.
02Contents

Inside the report.

  • The global regulatory landscape: EU AI Act, US SR 26-2, UK approach, Singapore MAS guidelines, and key jurisdictional conflicts
  • Governance structure requirements: board and senior management accountability, role definitions, and proportionality by institution size
  • Model risk management evolution: SR 26-2's risk-tiered approach, the GenAI carve-out, and the emerging parallel governance layer
  • Use-case-specific governance obligations: credit underwriting, fraud detection, KYC, claims automation, and agentic AI deployment
  • Data governance and EU AI Act Article 10: bias detection, representativeness, and the gap beyond BCBS 239
  • Third-party and supply-chain risk: concentration vulnerabilities, FS AI RMF requirements, and vendor contract standards
  • Systemic and cyber risk: frontier AI threats, agentic system risk, and the transitional period of elevated exposure
Retrieve the file
File retrievalPDF · 11P
The State of AI Governance in BFSI 2026 — cover

Get “The State of AI Governance in BFSI 2026” — designed PDF, 11 pages

Free with your details. We’ll send the PDF to your inbox and tailor what we share next to your role.

No spam. We’ll only send research relevant to your role. Unsubscribe anytime.

0356 cited

References.

  1. [01]Supervision of artificial intelligence in finance (EN) — https://www.oecd.org/content/dam/oecd/en/publications/reports/2026/01/supervision-of-artificial-intelligence-in-finance_1295e5e2/92743dc1-en.pdf
  2. [02]Algorithmic governance in banking: a comparative analysis of risk-based and accountability-oriented oversight | Journal of Banking Regulation | Springer Nature Link — https://link.springer.com/article/10.1057/s41261-026-00320-6
  3. [03]AI in financial services: emerging global norms — https://www.thecityuk.com/media/mqbjoidq/irsg-ai-in-financial-services-emerging-global-norms.pdf
  4. [04]AI Act | Shaping Europe’s digital future — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  5. [05](PDF) Responsible AI Governance in Banking: Integrating Model Risk, Consumer Protection, and Operational Resilience Across the United States, European Union, United Kingdom, Singapore, and Hong Kong — https://www.academia.edu/165974896/Responsible_AI_Governance_in_Banking_Integrating_Model_Risk_Consumer_Protection_and_Operational_Resilience_Across_the_United_States_European_Union_United_Kingdom_Singapore_and_Hong_Kong
  6. [06]Upcoming AI Regulations 2026-2028: What Banks Must Prepare — https://corvair.ai/regulations/upcoming-regulations.html
  7. [07]AI Risk Management: Implementation Examples — https://www.mas.gov.sg/-/media/mas-media-library/schemes-and-initiatives/ftig/project-mindforge/mindforge-ai-risk-management-implementation-examples.pdf
  8. [08]Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  9. [09]Algorithmic governance in banking: a comparative analysis of risk-based and accountability-oriented oversight | Journal of Banking Regulation | Springer Nature Link — https://link.springer.com/article/10.1057/s41261-026-00320-6
  10. [10]AI Risk Management: Executive Handbook — https://www.mas.gov.sg/-/media/mas-media-library/schemes-and-initiatives/ftig/project-mindforge/mindforge-ai-risk-management-executive-handbook.pdf
  11. [11]Guideline E-23 – Model Risk Management (2027) - Office of the Superintendent of Financial Institutions — https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027
  12. [12]Responsible AI Governance in Banking: Integrating Model Risk, Consumer Protection, and Operational Resilience Across the United States, European Union, United Kingdom, Singapore, and Hong Kong | Zenodo — https://zenodo.org/records/19691023
  13. [13]FR/02/2026 Supervisory Toolkit for AI Use in Capital Markets — https://www.iosco.org/library/pubdocs/pdf/IOSCOPD823.pdf
  14. [14]Supervision of artificial intelligence in finance (EN) — https://www.oecd.org/content/dam/oecd/en/publications/reports/2026/01/supervision-of-artificial-intelligence-in-finance_1295e5e2/92743dc1-en.pdf
  15. [15]FINRA ANNUAL REGULATORY OVERSIGHT REPORT — https://www.finra.org/sites/default/files/2025-12/2026-annual-regulatory-oversight-report.pdf
  16. [16]Model Risk Management - Revised Guidance — https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13a.pdf
  17. [17]Speech by Vice Chair for Supervision Bowman on artificial intelligence in the financial system - Federal Reserve Board — https://www.federalreserve.gov/newsevents/speech/bowman20260501a.htm
  18. [18]Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  19. [19]Sound Practices for Financial Institutions' Responsible AI ... — https://www.fsb.org/uploads/P100626.pdf
  20. [20]Regulating AI in the financial sector: recent developments and main challenges — https://www.bis.org/fsi/publ/insights63.pdf
  21. [21]https://eba.europa.eu/sites/default/files/2025-11/d8b999ce-a1d9-4964-9606-971bbc2aaf89/AI%20Act%20implications%20for%20the%20EU%20banking%20sector.pdf
  22. [22]The Mills Review: AI and the future of retail financial services — https://www.fca.org.uk/publication/corporate/the-mills-review.pdf
  23. [23]KPMG Global AI in Finance 2026 — https://assets.kpmg.com/content/dam/kpmgsites/uk/pdf/2026/05/ai-in-finance-report.pdf.coredownload.inline.pdf
  24. [24]AI Quarterly Pulse Survey — https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2026/ai-quarterly-pulse-survey-banking-q1-2026.pdf
  25. [25]FRB: Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management -- April 17, 2026 — https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf
  26. [26]From SR 11-7 to SR 26-2: Managing model risk when models don't stand still — https://www.moodys.com/web/en/us/insights/banking/from-sr117-to-sr262-managing-model-risk-when-models-dont-stand-still.html
  27. [27]Financial Services Sector Coordinating Council (FSSCC) — https://fsscc.org/wp-content/uploads/2026/03/BPI-FSSCC-AI-Explainability-In-Finance-Challenges-Practices-and-Recommendations.pdf
  28. [28]Updated Interagency Guidance on Model Risk Management (SR 26-2) | Baker Tilly — https://www.bakertilly.com/insights/updated-interagency-guidance-on-model-risk-management
  29. [29]Executive summary — https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2026/from-compliance-value-navigating-transformation.pdf
  30. [30]Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  31. [31]The Financial Stability Implications of Artificial Intelligence — https://www.fsb.org/uploads/P14112024.pdf
  32. [32]Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector — https://www.fsb.org/uploads/P101025.pdf
  33. [33]37920 — https://www.govinfo.gov/content/pkg/FR-2023-06-09/pdf/2023-12340.pdf?bcs-agent-scanner=172c62f3-ec07-3745-a09e-621ee1d86a3e
  34. [34]AI Vendor Risk in Financial Services: How the FS AI RMF Changes Third-Party and Fourth-Party AI Oversight | Swept AI — https://www.swept.ai/post/ai-vendor-risk-financial-services-third-party-fourth-party-oversight
  35. [35]In data we trust? Emerging policy and supervisory approaches to AI data use in financial services — https://www.bis.org/fsi/publ/insights73.pdf
  36. [36]Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  37. [37]Article 10: Data and data governance | AI Act Service Desk — https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-10
  38. [38]EU AI Act Article 10 Explained: Data Quality, Lineage, and Pipeline Evidence for Financial Services Compliance | Ataccama — https://www.ataccama.com/blog/real-time-data-observability-is-the-missing-layer-in-eu-ai-act-compliance
  39. [39]AI Act for Financial Services Compliance — https://www.legalithm.com/en/blog/ai-act-financial-services-banking-insurance-compliance
  40. [40]AI Model Governance for Financial Institutions: MaRisk, EBA & AI Act | ADVISORI | ADVISORI Blog — https://www.advisori.de/en/blog/ai-model-governance-marisk-eba-egim-bcbs-239-ai-act
  41. [41]Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  42. [42]Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector — https://www.fsb.org/uploads/P101025.pdf
  43. [43]Artificial intelligence and systemic risk — https://www.esrb.europa.eu/pub/pdf/asc/esrb.ascreport202512_AIandsystemicrisk.en.pdf
  44. [44]FR/02/2026 Supervisory Toolkit for AI Use in Capital Markets — https://www.iosco.org/library/pubdocs/pdf/IOSCOPD823.pdf
  45. [45]Addressing frontier AI models with cyber capabilities from a financial stability perspective — https://www.esrb.europa.eu/pub/pdf/reports/esrb.report202607_AImodelscybercapabilites.en.pdf
  46. [46]Warning of the European Systemic Risk Board of 25 June 2026 on systemic cyber risks stemming from frontier artificial intelligence models (ESRB/2026/3) — https://www.esrb.europa.eu/pub/pdf/warnings/esrb.warning260625_on_systemic_cyber_risks_stemming_from_frontier_ai_models~ef424708cf.en.pdf
  47. [47]Sound Practices for Financial Institutions' Responsible AI ... — https://www.fsb.org/uploads/P100626.pdf
  48. [48]AG AI in Financial Services client publication - 6 May 2026(114146670.1) — https://www.addleshawgoddard.com/globalassets/insights/financial-services/ai-uk-financial-services.pdf
  49. [49]Model Risk Management - Revised Guidance — https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13a.pdf
  50. [50]FR/02/2026 Supervisory Toolkit for AI Use in Capital Markets — https://www.iosco.org/library/pubdocs/pdf/IOSCOPD823.pdf
  51. [51]Application Paper on the supervision of artificial intelligence — https://www.iais.org/uploads/2025/07/Application-Paper-on-the-supervision-of-artificial-intelligence.pdf
  52. [52]The Mills Review: AI and the future of retail financial services — https://www.fca.org.uk/publication/corporate/the-mills-review.pdf
  53. [53]EBA letter on outcome of EBA's EU AI Act mapping ... — https://finreg.aoshearman.com/eba-letter-on-outcome-of-ebas-eu-ai-act-mapping-exercise-against-eu-banking-and-payments-regulation
  54. [54]Article 10: Data and data governance | AI Act Service Desk — https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-10
  55. [55]AI Act | Article 10 - Data and data governance — https://www.aiact-info.eu/regulation/AIACT/article/10/data-and-data-governance
  56. [56]It’s complicated: The relationship of algorithmic fairness and the non‑discrimination provisions for high‑risk systems in the EU AI Act — https://arxiv.org/html/2501.12962v4
The library
From the field to your own ground

See your own AI exposure, not just the field’s.

This report maps the frontier. A Snapshot maps where your AI sits on it — start there, or talk to us about your specific situation.