AI is already sitting in credit, fraud, AML and reporting decisions. Governance has not caught up yet. These three questions show whether you have oversight or just exposure.
You cannot govern what you cannot see. Spreadsheets, vendor tools and the quiet AI features buried inside software you already pay for are all making calls. Start with a live model inventory: who owns it, what it does, what data it touches, how much risk it carries.
A model cannot be held accountable. A person can. Put a named human behind every material model, and give them the authority to challenge it, override it and switch it off. Telling a regulator that the algorithm decided has never worked as a defence.
Once a model is live it needs the same controls as any other risk. Watch it for drift, set thresholds that force a review, and test the kill switch before the day you need it. If you cannot explain a decision or pause the system, what you have is hope, not governance.
GRC Studio
All posts