Governed AI:
The Part Nobody Budgets For
By Dip Majumder | Founder & CEO, Performance AI
Governance is not what keeps enterprise AI from moving faster. Increasingly, it is what allows AI to move into production at all.
On April 17, 2026, the Federal Reserve, OCC, and FDIC retired SR 11-7, the model-risk guidance banks had operated under since 2011, and replaced it with SR 26-2. Fifteen years of practice changed in one letter.
But the part that caught my attention was buried in a footnote. The agencies called generative and agentic AI novel and rapidly evolving, left both outside the scope of the new guidance, and said banks should rely on their own risk-management and governance practices to determine the appropriate controls. A separate request for information on how banks are using generative and agentic AI is still expected.
In other words, nobody is handing banks a finished checklist. Institutions need to decide what responsible AI use looks like, put the controls around it and, eventually, be able to prove what happened.
That sounds like a compliance requirement. I think it is becoming something more important: a prerequisite for getting useful AI into production.
What happens when the examiner asks
Imagine a Thursday afternoon near month-end at a $40 billion regional bank. This is an illustrative example, not a client story. A mortgage closer has nineteen files that need to move before Friday.
She asks an AI assistant which conditions are still open on one of the loans. The assistant reads the approved loan record and document folder, identifies three outstanding conditions and links each one back to its source. It then drafts an email asking the borrower for the missing income documentation.
The system doesn’t send it. The closer reviews the draft, notices one date is wrong, fixes it and sends it herself. Nothing about that workflow is particularly dramatic.
Now move forward eleven months. An examiner asks how that borrower was notified, what information the AI relied on and who approved the communication.
If the system was governed properly, the answer is already there: source documents, generated draft, human edit, approval, send and timestamp. The question takes a minute to answer.
Without that record, somebody is reconstructing the event from email, system logs, employee memory and whatever else they can find.
That is the part of enterprise AI companies routinely underestimate. Not whether the model can produce an answer. Whether the organization can explain what happened after it did.
Two numbers bank boards should pay attention to
The first is 18%. Grant Thornton surveyed 950 executives this spring. Half of the banking leaders surveyed said governance and compliance barriers were already limiting what AI could deliver.
Only 18% said they were fully confident their AI controls could withstand an independent audit. Banks were also more likely than respondents in any other industry surveyed to describe those controls as untested. Just 32% reported revenue growth from AI.
The second number is 92%. IBM’s 2026 Cost of a Data Breach research covered 602 breached organizations. Among organizations where AI systems were attacked, 92% had not properly controlled access to those systems.
Shadow AI adds another complication. Employees are already using AI because it makes them faster, whether the sanctioned enterprise program is ready or not.
That creates an uncomfortable situation. The AI with the most oversight can become the AI that takes the longest to deploy, while the AI with almost no oversight spreads quietly through browser tabs.
The answer isn’t to stop AI. It is to make governed AI easier to put into production than ungoverned AI is to adopt.
What “governed” actually means
Governance can become an abstract word very quickly. A policy tells you what should happen. A governed system should be able to show you what actually happened.
For any meaningful AI-generated output, I think an organization should be able to answer five questions.
1. Who had access?
Access should follow the person’s role, department and workspace, ideally reflecting permissions already established in the underlying systems. The mortgage closer can see her pipeline. She doesn’t suddenly gain access to an entire servicing operation because AI sits between her and the data.
2. What information did the AI use?
Outputs should trace back to approved documents, records or data. Three open conditions should mean three sources a reviewer can inspect. Nobody should have to trust an answer simply because the software sounds confident.
3. What did the AI produce?
Administrators need visibility into relevant outputs. That becomes difficult when enterprise work is scattered across individual AI chat histories the organization cannot see or govern.
4. Where did a human make the decision?
Reading a document is different from changing a customer record. Drafting an email is different from sending one. The higher the consequence, the more important the approval boundary becomes. The software can draft the email. The employee sends it.
5. What happened, in order?
Users. Sources. Agents. Outputs. Approvals. Actions. That history needs to survive employee turnover as well. The institutional record cannot disappear when the person who built a workflow leaves.
Those five questions are not just about surviving an audit. They determine whether security, compliance and business owners are comfortable allowing the workflow to operate in the first place.
Governance is production infrastructure
This is where I think the enterprise AI conversation gets the issue backwards. Governance is often described as the thing slowing AI down. In regulated organizations, weak governance may be what prevents AI from moving at all.
McKinsey’s research on AI high performers found that the roughly 6% achieving the strongest results were much more likely to actively guard against unauthorized or unintended AI actions and to have a defined way of measuring AI’s impact. Grant Thornton’s banking research points in the same direction from another angle: immature governance keeps AI away from regulated, high-value workflows.
And there is an economic consequence. A pilot that cannot get through security, risk or compliance doesn’t create a return simply because the technology worked.
The organization has already spent employee time, implementation effort and management attention. If the workflow never reaches production, those investments do not turn into capacity, lower operating cost, faster decisions or revenue.
That is why I increasingly view governance as production infrastructure. It is the layer that gives an organization permission to use AI where the economic value is actually meaningful.
What I would do this quarter
Don’t begin with an enterprise-wide AI manifesto. Pick one recurring workflow that already consumes real employee time: open loan conditions, the exam-preparation binder, the month-end variance narrative or a board package.
Then put the business owner, IT and compliance in the same conversation and answer five questions before anyone starts building:
- Who should be able to see it?
- Which sources can the AI use?
- Where should the output go?
- Which actions require a human?
- What needs to be recorded?
If those answers are clear, the pilot has somewhere to go when it works. If nobody can answer them, that is worth knowing before spending three months building it.
The blank space regulators have left around generative and agentic AI does not have to mean waiting. It gives institutions an opportunity to establish their own operating model before somebody eventually asks to see it.
From pilot to production
Institutions need a practical way to use AI in important workflows without losing control of what it can see, what it can do and who remains accountable.
It is also the problem behind much of what we are building with Edge at Performance AI.
Because the interesting question is no longer whether an AI assistant can tell a mortgage closer which three conditions are still open. It can.
The more important question is whether the organization is comfortable letting that AI operate in the workflow—and whether, eleven months later, its compliance officer can explain exactly how it worked.
Governance is what makes that possible. And increasingly, it is what determines whether enterprise AI stays in a pilot or makes it into production.
Evaluating where governed AI could move from pilot to production in your organization? Ask us to walk through one workflow end to end.
