The Impact of AI in Bank Governance

The adoption of Artificial Intelligence (AI) in banking represents a qualitative leap in financial intermediaries’ digital transformation and exposes a governance gap between the speed of technological diffusion and the maturity of effective safeguards. This chapter examines how bank risk governance can evolve to internalise AI-specific vulnerabilities within the existing prudential architecture, situating AI risk governance within the CRD framework despite the absence of AI-specific provisions in recent amendments. Building on the premise that AI does not create a standalone category of regulated risk, but reshapes the intensity, channels of manifestation, and interconnections of established banking risks, the analysis adopts a two-level approach to AI risk governance, distinguishing between upstream “native” AI risk drivers—organised along the ICT, data, and model axes—and their downstream translation into prudential, legal/conduct, and operational risks. At the driver level, the chapter focuses on controls that make the AI asset governable across its lifecycle and on the interaction between prudential and operational resilience requirements (DORA), horizontal regimes (AI Act, GDPR), and supervisory expectations. At the impact level, it examines how AI use cases can be integrated into the Risk Appetite Framework (RAF) through materiality-based assessment, tiering, decision rights, and accountability across the management body and control functions.