AI governance: Emerging ECB supervisory expectations

Risk focus

Artificial Intelligence (AI) is rapidly becoming part of the banking industry operating model, as bank deploy AI across multiple use-cases and technology providers release ever more sophisticated models.

In recent months, however, public debate on AI has been dominated by the risks (including potential existential risk) of the technology. Leaders from the Financial Stability Board, Bank for International Settlements, ECB and US Federal Reserve have all warned of the potential risks associated with AI, highlighting in particular the risk that powerful AI models could amplify cyber threats and expose vulnerabilities in critical ICT systems. Reflecting these concerns, ECB banking supervision has heightened its focus on the risks of AI, and the governance and internal control frameworks needed to manage them effectively.

One important ECB initiative addresses the cyber security implications of AI. As we discuss in our parallel article, the ECB has required all banks under its supervision to assess the impact of AI-powered cyber threats and develop action plans to address this threat.

Alongside, the ECB has stepped up its scrutiny of banks’ AI adoption, their AI governance arrangements and the impact of AI on their business models. Over the summer, the ECB held a series of dedicated industry workshops to understand banks’ AI practices and examine specific use cases. It has also required significant banks to complete a detailed questionnaire on the place of AI in their business strategies, their governance and internal control frameworks and risk management.

Governance principles

The ECB has not published specific supervisory guidance on banks’ use of AI (and given its ongoing work to simplify existing supervisory guides, we do not expect that it will in the near term). Rather, ECB leaders have argued that existing principles of good governance should apply to AI, as we noted in a previous article. Notwithstanding that, we see the following key ECB expectations emerging:

banks have found a wide range of potential use-cases for AI in different areas of their business. This raises the question of how best to allocate scarce financial, human and technical resources among them. Banks should develop a clear strategy articulating which AI use-cases offer the greatest business benefits, as well as the risks associated with each, to allow coherent judgements on the appropriate investments to pursue.

a key challenge banks face is determining how AI governance should be structured. Some banks assign responsibility primarily to technology and ICT functions, while in others it is embedded within risk management structures. The ECB does not appear to favour a specific model, but does demand clarity on how responsibilities are allocated, how issues are escalated and challenged and where accountability for AI risk management lies.

AI governance should not develop in isolation, but be integrated into existing governance frameworks. AI related decisions require input from business, risk, compliance, legal and IT functions, and information must be consolidated and reported up to senior management. This ensures that bank leaderships can fully understand and articulate how decisions regarding AI are made, and what safeguards are in place against AI-related risks.

the complexity, business-criticality and risks of different AI applications vary significantly. Governance arrangements therefore need to distinguish between different AI applications and apply oversight, controls and escalation mechanisms proportionate to their potential impact. Factors such as materiality, criticality, complexity and risk profile may influence how AI systems are governed and challenged.

governance should not end once an AI use case is approved or implemented. Effective oversight depends on maintaining an up-to-date inventory of AI systems and monitoring their performance, risks, incidents and dependencies throughout their lifecycle. This places greater emphasis on data quality, KPIs, reporting capabilities and the ability to provide management with timely and reliable information.

Business benefits

As Claudia Buch noted in a September speech, the ECB recognizes the real business potential of AI and other cutting-edge technologies (she also highlighted the potential implications of quantum computing, a topic on which we expect further ECB communication in the coming months). Supervisors are closely monitoring how banks deploy the new technology and its impact on their business models: where AI enables them to offer new products and boost revenues or increase efficiency and cut costs. At the same time, they are clear that the risks of AI must be effectively managed.

Robust governance is thus an essential component of successful AI implementation – and hence one of the eight key steps in the KPMG roadmap for AI deployment in banks. Effective management oversight, proportionate risk controls and clear accountability will allow banks not only to satisfy regulatory requirements, but also to maintain public trust as they scale and innovate in their use of AI.