While financial services companies are accelerating AI adoption, governance maturity is lagging. Legacy frameworks around models, data, and technology were not designed for today’s AI landscape: probabilistic models, opaque third-party dependencies, and, increasingly, autonomous agentic systems. As a result, companies attempting to scale AI using traditional governance approaches may find themselves exposed to risks that are difficult to detect, quantify, or control.
Weak AI governance can directly translate into misinformed investment decisions, security vulnerabilities, and ultimately, financial and reputational losses. Conversely, companies that build effective governance frameworks can better align AI with business objectives, manage downside risks and create more sustainable competitive advantages.
To address this challenge, I propose a two-tier AI governance framework that integrates program-level oversight with use-case-specific controls. Like the complementary top-down and bottom-up approaches in investing, this structure enables both consistency in scale and precision in execution.
The programme-level component focuses on three main actions:
- discover To effectively control your AI assets
- to install Enterprise-level governance structures and mechanisms
- Center Enterprise-level administration over some critical domains
discover: A fundamental step is to establish a comprehensive list of AI assets, use cases, and agents. These will serve as building blocks for governance processes at both the program level and use case level and should be linked to enterprise-wide governance and risk management mechanisms and tools. As we look toward the future, it is becoming increasingly important to apply the same institutional and organizational processes to manage AI agents that we typically apply to managing people, which would be nearly impossible without these inventions.
to install: Oversight mechanisms fall into this category including policies and procedures, risk appetite statements, chain of command and escalation, and the creation of an enterprise AI literacy program. These elements define the “rules of the road” and serve as the first line of defense against the internal and external pressures that will inevitably arise during AI implementation.
Center: The rapid proliferation of AI governance frameworks and controls may lead to the perception that effective governance requires a “boil the ocean” approach. In practice, this is neither possible nor necessary. Instead, AI governance should be intentionally aligned with an organization’s specific risk profile, operating model, and strategic priorities. The aim is not perfection, but effectiveness.
