Moody’s Identifies Four Key Standards for AI Governance in Financial Institutions
Moody’s has highlighted growing challenges facing financial institutions as generative and agentic artificial intelligence systems become more widely adopted, warning that traditional model risk management practices may not be sufficient to address the unique characteristics of advanced AI.
According to a Moody’s report on AI risk governance, generative and agentic AI systems can deliver capabilities and performance beyond conventional models in some applications. However, their increasing complexity creates new risks that require financial institutions to strengthen governance and oversight throughout the entire system lifecycle.
Banking Guidance Adopts a Risk-Based Approach
The report noted that the US Federal Reserve, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency issued updated model risk management guidance on April 17, 2026, replacing previous supervisory guidance under SR 11-7 and SR 21-8.
The updated framework adopts a risk-based approach that considers the nature, materiality, scale and complexity of model risks, with oversight requirements adjusted according to the potential level of exposure.
It also emphasizes the importance of objective assessments conducted by independent experts and updates principles governing different stages of the model lifecycle.
However, Moody’s noted that the guidance explicitly excludes generative and agentic AI systems because these technologies are new and rapidly evolving. Financial institutions are therefore expected to determine appropriate governance and oversight measures based on their own risk management practices.
Global Regulators Address AI Risks
The development comes amid broader international efforts to establish frameworks for managing artificial intelligence risks across the financial sector.
The European Union’s AI Act introduces documentation, testing, monitoring and transparency requirements for systems classified as high-risk.
In the United Kingdom, the Prudential Regulation Authority has established principles governing model risk management for banks under its supervision, while the European Banking Authority has addressed the use of machine learning within internal credit-risk classification models.
The US National Institute of Standards and Technology’s AI Risk Management Framework, together with its generative AI profile, also provides regulatory terminology and proposed risk-management measures.
Other organizations and regulators, including the Monetary Authority of Singapore, the Australian Prudential Regulation Authority, the Bank for International Settlements and the Financial Stability Board, have also published guidance, assessments and papers addressing AI-related risks within financial services.
AI Governance Must Cover the Entire System Lifecycle
Moody’s proposed framework begins with clearly identifying the complete system subject to governance.
This involves distinguishing between infrastructure supplied by external providers, such as a large language model, and components controlled by the financial institution, including prompts and mechanisms used to coordinate and execute tasks.
Despite this distinction, both components should be treated as a single system for which the financial institution remains responsible in terms of inventory, validation and risk management.
The framework also links the required level of governance to the degree of system autonomy. As an AI system gains greater ability to independently make decisions and execute tasks, more appropriate governance controls become necessary.
Four Standards for Effective AI Governance
Moody’s identifies four fundamental characteristics that governed AI systems should maintain: correctness, consistency, robustness and predictability.
To achieve and preserve these characteristics, the proposed governance lifecycle includes system design and the introduction of measurement and monitoring mechanisms, establishing baseline performance, operating the system and measuring results, escalating issues when necessary, and revalidating the system following any material changes.
The report also outlines nine key concepts distributed across five stages of the governance process. These are intended to help financial institutions determine appropriate controls for individual AI systems and establish continuous risk-نmanagement frameworks rather than relying solely on isolated tests that may fail to capture changes occurring during operation.