The AI Governance Gap: The Compliance Risk Banks Are Underpricing
Every bank deploying generative and agentic AI carries a quiet assumption: that oversight built for deterministic models still holds. It doesn't. SR 26-2, effective since April 2026, explicitly excludes generative and agentic systems from its scope, leaving a gap between what regulators require and what these systems actually do.
Building AI-speed governance costs three to four times a bank's current oversight budget, whether it holds 30 billion or 200 billion in assets. That expense still costs less than a single serious enforcement action: a consent order, remediation program, and lookback review. Smaller institutions face the strongest case for acting now, since governance takes 12 to 18 months to build and cannot be assembled once an examiner arrives. This session lays out the numbers for the board.