Managing AI: How banks can stay ahead of compliance risk

As banks evaluate the use of artificial intelligence, including emerging generative AI tools, across multiple channels at their organizations, maintaining robust compliance controls is essential. Regulators have consistently emphasized that existing legal and regulatory frameworks apply to services or products offered, regardless of the technology used. AI introduces unique compliance risks related to transparency, bias, data privacy and third-party reliance, requiring thoughtful integration into established risk management programs..An effective AI strategy begins with a well-defined governance framework. Banks should maintain an inventory of AI use cases, assign clear ownership across business, compliance, legal and model risk teams, and implement risk-tiering to distinguish higher-risk applications—particularly those affecting customers. Governance should also include defined approval processes, performance monitoring and escalation protocols.Additionally, banks can manage risks by piloting AI tools in a controlled environment before full-scale implementation, either internally or externally. Further, the bank’s policies and procedures can support this framework by addressing acceptable use, data handling, documentation and incident response. Employees should understand when AI tools may be used and any limitations associated with them.Third-party risk management is particularly critical when leveraging external AI vendors. Consistent with the June 2023 Interagency Guidance on Third-Party Relationships, banks should conduct risk-based due diligence on model design, data sources and vendor controls, and ensure contractual protections related to confidentiality, data ownership and audit rights.Banks must also assess compliance risk across applicable regulatory regimes. Depending on the use case, AI may implicate fair lending requirements, unfair or deceptive practices standards, and consumer protection laws. Integrating AI into quality assurance reviews, compliance testing and internal audit programs is key to managing these risks.Finally, human involvement is essential to effective AI use in banking. Employees should validate AI-generated outputs, particularly in customer-facing contexts, to ensure factual accuracy and consistency with regulatory requirements.With thoughtful governance and controls, banks can responsibly leverage AI while meeting compliance expectations. Anton Moch leads the Community Banking practice at Winthrop & Weinstine, a business law firm of 185+ attorneys located in Minneapolis. Kristen Larson serves as Counsel in the firm’s Bank Regulatory and Community Banking practices. For more background on the authors or the firm’s Banking and Finance legal services, visit Winthrop.com.