Summary:
Situation Overview: The 2025 American Bankers Association (ABA) Risk and Compliance Conference heavily focused on Artificial Intelligence (AI) in Banking – including top use cases and best practices in AI governance.
What: The banking industry, across firms of all sizes, is heavily focused on AI and how it should be utilized and governed to support strategic goals.
Who: All banks.
In Depth
In June 2025, the ABA held its annual Risk and Compliance Conference. The conference heavily focused on how banks are leveraging AI to support front-, middle-, and back-office functions. Conference participants noted that bank employees are likely already using AI, regardless of internal policies and procedures.
With the rapid evolution and adoption of AI, banks must focus on establishing and maintaining an appropriate and effective AI Risk Management Framework. Key elements of this framework should include:
A Firm-wide AI Policy
Each bank should adopt a policy which defines its AI Risk Management Framework, including roles and responsibilities of the first, second and third lines of defense, governance committees, and AI risk assessment processes and controls, including AI approval and monitoring protocols.
Consideration of AI within Existing Risk Management Frameworks
AI must also be integrated into existing risk management frameworks, particularly risk assessment practices, model risk management, third party risk management and change management.
- For Risk Assessment, identify the inherent risks, controls, and residual risks for each AI use case;
- For Model Risk Management, define the bank’s framework for the approval, review and ongoing monitoring of models which use AI. Some AI models may be prone to “drift”, and model performance monitoring may need to be more continuous rather than periodic;
- For Third Party Risk Management, the bank’s policies need to define the firm’s tolerance for vendors’ use of AI, and requirements for disclosure and monitoring reports. Many firms are now embedding AI-related clauses into vendor contracts, including prohibiting the use of AI to requiring third parties to disclose their use AI;
- For Change Management, particularly technology change management, banks need to define the data, processes, and procedures for implementing and adopting internal AI solutions. Best practices include defining testing scenarios, creating a “sandbox” to do parallel testing of the AI solution vs. legacy technology/manual solutions, and evaluating the accuracy rates of each.
Finally, ABA participants noted that AI will always need human involvement and oversight. AI cannot be implemented and left alone. Senior management should be familiar with what AI tools are used in their organization and how they are used, and should ask questions so they fully understand what the tools are and are not capable of. Ongoing, metric-based monitoring is critical to AI risk management.
Regulatory Position
The current federal regulatory posture is evolving, with remarks from senior regulators striking a balance between support for innovation and prudent risk management. As recently as April 2025[1], Acting Comptroller of the Currency Rodney Hood delivered remarks on the OCC’s commitment to deploying AI ethically and responsibly within the banking industry, and highlighted the OCC’s work to promote innovation in the banking system. The regulatory openness to innovation provides the industry with the opportunity to lead by example with thoughtfully designed AI risk management frameworks.
What Banks Should Do
Review the institution’s current use and plans for use in AI. Engage the Board and Senior Management in these discussions, and establish a formalized AI Risk Management Framework.
[1] According to SheppardMullin blog, Rodney Hood Remarks; here is the speech transcript: Rodney Hood speech
