Governance guide
AI governance evidence for US banks and insurers
By Richard White · · Owner: Richard White · Next review: when the EU timetable changes, and by 2 December 2026 at the latest
Free, no form.
Abstract
A worked architecture addition links an invoice request to its identity, read authorization, sources, approval, execution result and protected evidence, including revoked access and uncertain write outcomes.
An eighteen-page guide to what a risk, compliance, model risk or audit reviewer needs to inspect before an AI capability is relied on at a US bank or insurer. It opens with the US expectations: for banks, SR 26-2 (which in April 2026 replaced SR 11-7 and left generative and agentic AI outside its scope), third-party guidance, Regulation B adverse action reasons and NYDFS Part 500; for insurers, the NAIC Model Bulletin, NYDFS Circular Letter 7 and Colorado’s AI governance regulation.
It then builds a working crosswalk from those requirements and the NIST AI RMF to delivery artifacts, defines the request trace an authorized reviewer needs, and covers evaluation, human oversight, suppliers, release decisions and incident reporting.
For firms with international operations, closing chapters cover EU AI Act classification and its 2026 timetable, DORA and the UK PRA’s model risk principles. It is a delivery and evidence guide, not a legal opinion, and it carries a sourced reference register.
Decision it supports
What your risk team, auditors or examiners will need to inspect before reliance.
What you will produce
An evidence index that reconstructs one allowed, one denied and one corrected request.
See it worked through in a guide
Claims package 1.1.0 · 26 October 2026. Synthetic worked example: team A, group disability, region 2. Read-only preparation of the assigned case; examiners retain every case decision. Hold candidate 1.0.0 after an unrelated employee’s claim is returned. In the synthetic decision, accept 1.1.0 for a monitored team A rollout only after prior-claims history is disabled and the remaining scope passes a fresh evaluation. All figures, evidence and sign-offs in that guide are invented; the paper provides the underlying method.
In the paper
Three passages, as published
The US gap
Because SR 26-2 leaves generative and agentic AI out of scope, a bank can run a mature model risk program and still have no governing route for an AI assistant.
Classification
Calling it read-only, or keeping a person in the workflow, does not settle classification.
Evaluation
A favorable average score cannot compensate for unauthorized disclosure.
Next step
Discuss this paper against your own program.
A free sixty-minute working session with Richard on your top gaps. You leave with a one-page summary within three business days, and three next questions.