AI Governance in Lending: What Institutions Must Own

As AI tools become more capable, financial institutions face a governance question that is not primarily about technology: who owns the decision when a machine informs it?

The answer, under every applicable regulatory framework, is the institution. AI-assisted outputs do not transfer credit authority to a model or a vendor. The institution retains the lender-of-record relationship, the credit decision, and the compliance obligations that attach to both.

This means that every machine-assisted step in a credit process must have a named human owner. Not a team. Not a department. A named individual with defined decision rights and documented accountability for the outcome. If the AI output is wrong, the institution must be able to demonstrate that a qualified human reviewed it, understood it, and made a decision.

Override procedures are not optional. When a human reviewer disagrees with an AI output, the institution must have a defined process for documenting the disagreement, recording the basis for the override, and escalating when appropriate. Regulators and examiners will ask for this evidence. Institutions that cannot produce it have a governance gap, not a technology gap.

Model risk governance applies to AI tools used in credit processes. This includes validation requirements, performance monitoring, periodic review, and documentation of the model's intended use, limitations, and known failure modes. Institutions that deploy AI without completing model risk governance are not ready to use it in a regulated credit process.

The governance requirements for AI in lending are not new. They are the same requirements that apply to any model used in a credit decision — applied to a new class of tools. Institutions that approach AI governance as an extension of existing model risk management will be better positioned than those that treat it as a separate compliance exercise.