Your Bank’s AI Ambitions Are Only as Strong as Your Governance
By Jessica Kendall, Contributor at The Financial Brand
Simple Subscribe
Subscribe Now!
AI is becoming deeply embedded in banking, but the governance needed to support that growth is developing at a slower pace.
Deloitte’s latest research, Banking on Trust: AI Governance for Growth, Resilience and Scale, finds that 63% of bank employees now use AI at least weekly, while only 13% of banks have reached the report’s highest level of governance maturity.
Key insight: The gap matters because the banks with the strongest governance are deploying AI most broadly. Optimized banks have nearly eight times as many fully implemented AI solutions across business areas as banks with ad hoc governance. Deloitte’s analysis also finds an association between stronger governance and higher revenue growth.
Need to Know:
- AI adoption is moving faster than governance. Weekly AI use among bank employees doubled to 63% in 2026 — up from 30% in 2025.
- 87% of banks have scope to materially strengthen AI governance.
- Organizational structure is the weakest governance pillar, while half of banks are at ad hoc or rudimentary maturity for people and skills.
- Governance maturity is associated with broader AI deployment. Banks with optimized governance average 5.5 fully implemented AI solutions across business areas, compared with 0.7 among banks at the ad hoc level.
- While 72% of banks apply mandatory governance controls during design, only 55% do so during monitoring, and 72% have less than half of their AI use cases recorded in a central register.
- 84% of consumers say they would switch financial providers if their data were mishandled.
AI Adoption Outpaces Governance
The pace of AI adoption has accelerated significantly. The share of employees using AI on a weekly basis has more than doubled in the past year. At the same time, a majority of global banks have fully implemented AI solutions across five business areas, including customer service, IT, marketing and sales, operations, and finance. And, they are trialing AI solutions across human resources and legal and compliance business areas.
But this rapid adoption is also changing the governance challenge for banks. As AI moves into more business processes, governance has to account for a growing number of decisions about where AI can be used, how it should operate, and who is responsible for its outcomes.
From optimized to ad hoc, Deloitte evaluates AI governance across five dimensions: principles and policy, organizational structure, procedures and controls, people and skills, and monitoring, reporting and evaluation.
Key insight: A majority of banks are not where they need to be. Only 13% currently achieve an optimized level while more than half are considered rudimentary or ad hoc.
Accountability Must Follow AI
The main gaps identified for AI governance are human and organizational, rather than procedural. Organizational structure is the weakest governance pillar, with 27% of banks at the ad hoc level. People and skills show a similar weakness: half of banks are classified as either ad hoc or rudimentary.
Procedures and controls are considerably more mature, with nearly a quarter of banks reaching the optimized level. Principles and policies, and monitoring, reporting, and evaluation, also perform relatively well.
This disparity offers an important clue about where governance efforts need to go next. Policies and controls can establish what a bank expects, but they do not determine how consistently those expectations are applied. That depends on whether responsibilities are clear, decision rights are understood, and employees have the skills to make appropriate choices when working with AI.
Key insight: Deloitte’s comparison of governance assessments also suggests that proximity to the work affects how maturity is perceived. Heads of AI governance rated their organizations more conservatively than the broader senior executive group. All of the AI governance leaders placed their banks in the middle two maturity categories, while senior executive assessments were distributed across all four.
That finding gives executives a useful way to pressure-test their own assessments. A governance framework can look comprehensive from the executive level while appearing much less mature to the people responsible for applying it.
Governance Can Enable Scale
Governance maturity also appears to shape how effectively banks can move AI from experimentation into broader deployment. Banks with optimized governance have more fully implemented AI solutions across business areas, compared to banks in the rudimentary or ad hoc stage.
Mature governance can provide the structure banks need to move beyond isolated experiments. When expectations, responsibilities, and controls are established, individual teams do not have to solve the same governance questions from scratch each time they want to deploy AI.
That becomes particularly valuable as AI adoption expands across business functions. A bank that treats every new application as a unique governance exercise may struggle to maintain consistency as use cases multiply. A bank with reusable standards and clearly defined decision rights can create a more repeatable path from evaluation to deployment.
Key insight: Deloitte’s revenue analysis finds that 10-point increase in its AI Governance Index is associated with a 10-percentage-point increase in revenue growth, after controlling for factors including AI use, workforce size, headquarters location, and years in operation.
While Deloitte explicitly cautions that the analysis demonstrates an association rather than causation, governance maturity and business performance appear to move together. For executives deciding where to invest in their AI operating model, that makes governance a business capability worth measuring rather than simply a control function to satisfy.
Governance Doesn’t End at Deployment
The final challenge is maintaining governance after an AI system has been approved and deployed. Deloitte finds that 72% of banks apply mandatory governance controls during the design stage, but only 55% do so during monitoring. At the same time, 72% of banks have less than half of their AI use cases recorded in a central register.
Those figures point to a lifecycle problem. Governance is relatively well established around the decision to build and deploy AI, but less consistently applied once systems are operating. That leaves banks with less visibility into how AI is performing, where it is being used, and whether the conditions surrounding a particular use case have changed.
The challenge becomes more pronounced with agentic AI. Only 44% of banks report having risk monitoring across the implementation lifecycle for agentic AI — compared with 61% for traditional AI and 59% for generative AI.
For banks adopting increasingly autonomous systems, ongoing monitoring needs to become part of the operating model rather than an occasional review. That includes maintaining an accurate inventory of AI use cases, establishing appropriate performance and risk measures, and giving accountable leaders a mechanism to intervene when conditions change.
Bottom line: The measure of mature governance should ultimately be whether it helps the organization deploy AI responsibly and consistently at scale. That means giving teams a clear path to move appropriate use cases forward while giving leaders the visibility and accountability they need to manage what happens after deployment.
