Two disciplines keep AI in finance defensible: audit trails (what happened, and who approved it) and model risk management (is the model fit for its use, and do we know its limits?).
Audit trail essentials
For every AI-assisted step that matters, keep:
- the inputs (documents, data extracts) or references to them
- the model, version and configuration or prompt used
- the output the AI produced
- what the human changed, and who approved it, when
- any exceptions, overrides and incidents
Make this a purchase requirement. A tool that cannot produce this evidence cannot sit inside a key control.
Model risk management
Banks have long managed "model risk": the risk of loss from models that are wrong or misused. Its core ideas apply to any finance AI:
- an inventory of models and AI uses
- validation proportional to risk, including independent challenge
- ongoing monitoring of performance and drift
- governance: owners, approvals, limits on use
A regulatory signal
In April 2026 the U.S. banking agencies replaced their long-standing model risk guidance (SR 11-7) with a revised, risk-based version, SR 26-2. Its scope note says generative AI and agentic AI models are "novel and rapidly evolving" and are not within the scope of the guidance, while adding that a bank's risk management and governance practices should still guide appropriate controls for tools and systems not covered. In other words: there is no ready-made rulebook for generative and agentic AI; firms must design their own controls.
For non-banks
You don't need a bank's model risk function. You do need an inventory, a proportional validation step before go-live, monitoring, and owners.