Board members keep asking: "How do we know our AI systems won't become a regulatory problem?" The Hong Kong Monetary Authority's ART framework (Accountability, Resilience, and Trust) offers a clear answer, but many banks are making the same mistakes they did with third-party risk management a decade ago.
These aren't theoretical errors. They're patterns that turn governance frameworks into compliance theater while leaving real AI risks unmanaged.
Why These Mistakes Keep Happening
Banks often treat AI governance as a paperwork exercise rather than a decision-making structure. Your team writes policies that sound impressive but don't answer key questions: Who can approve a new AI model? What testing happens before deployment? When does a model change require board notification?
The ART framework emphasizes clear ownership and decision-making authority, but implementation fails when writing about governance replaces actual governance.
Mistake 1: Delegating AI Accountability to Technology Teams
Why it happens: Your CIO or Chief Data Officer builds the AI systems, so you assume they should own the governance. It seems efficient.
Real consequence: Technology teams focus on performance and innovation. They're not positioned to assess whether an AI-driven credit decision creates fair lending exposure or if a chatbot's responses could trigger consumer protection violations. When regulators ask who's accountable for AI outcomes, pointing to your technology function shows you've missed the governance point entirely.
The fix: Establish a cross-functional AI governance committee with explicit decision rights. Your Chief Risk Officer should chair it. Include compliance, legal, internal audit, and business line leaders who own customer-facing processes. The committee approves AI use cases, sets risk tolerance for specific applications, and defines escalation thresholds. Document these decisions in meeting minutes, not just policy statements.
Mistake 2: Applying Existing IT Risk Controls Without Modification
Why it happens: You already have change management, system development lifecycle controls, and vendor management processes. Extending them to AI seems practical.
Real consequence: Traditional IT controls don't address model drift, training data bias, or explainability requirements. Your standard change control process won't catch when a fraud detection model starts flagging legitimate transactions at twice the historical rate because market conditions shifted. The ART framework's resilience pillar specifically calls for AI systems that "operate safely, fail safely, and recover effectively," which demands different controls than your ERP upgrade process.
The fix: Build AI-specific control requirements into your existing processes. Add mandatory steps: bias testing before production deployment, ongoing model performance monitoring with defined variance thresholds, and documented explainability assessments for any AI system that affects customer outcomes. Your internal audit team should validate these controls exist and function before the first audit finding forces retroactive implementation.
Mistake 3: Treating Transparency as a Communications Problem
Why it happens: Your team interprets "transparency" as writing clear disclosures about AI use. You draft customer notices and employee communications, check the box, and move on.
Real consequence: The ART framework's trust pillar requires transparency that enables validation, not just notification. When your audit committee asks how a specific AI recommendation was generated, "the algorithm said so" isn't an answer. When a customer disputes an AI-driven decision, your frontline staff can't explain the logic. You've created transparency documents without transparent processes.
The fix: Implement decision logging for material AI outputs. For any AI system that affects credit, pricing, hiring, or risk assessment, capture: input variables used, decision thresholds applied, and override history. Your compliance team should be able to reconstruct why the system produced a specific outcome six months later. This isn't about explaining neural network mathematics; it's about documenting business logic that humans can verify.
Mistake 4: Ignoring AI Risk in Your Enterprise Risk Framework
Why it happens: You add "AI risk" as a line item in your risk register but don't integrate it into existing risk categories. It sits separately, often owned by innovation or digital transformation teams.
Real consequence: AI amplifies your existing risks rather than creating entirely new ones. An AI system that processes loan applications carries credit risk, fair lending risk, and third-party risk if you're using an external model. By isolating AI risk, you fragment ownership and miss the cumulative exposure. Your Enterprise Risk Oversight process can't function when AI risks hide in a separate category.
The fix: Map AI systems to your existing risk taxonomy. Every AI application should appear in relevant risk assessments: operational risk for process automation, compliance risk for regulatory-facing systems, reputational risk for customer-facing tools. Your risk owners must explicitly consider AI when updating risk and control matrices. This integration surfaces when AI changes your risk profile in ways a standalone "AI risk" category never will.
Mistake 5: Building Governance Without Enforcement Mechanisms
Why it happens: You establish AI governance policies, assign roles, and communicate expectations. You assume compliance will follow because the framework exists.
Real consequence: Business units deploy AI tools without governance review because there's no consequence for skipping the process. Your procurement team doesn't know to flag AI-enabled software purchases. Shadow AI proliferates while your governance committee reviews only the systems someone voluntarily disclosed. The accountability pillar of the ART framework becomes meaningless without enforcement.
The fix: Integrate AI governance into existing control points that already have teeth. Require AI system disclosure in your vendor risk assessment process; procurement can't issue a PO without it. Add AI governance compliance to internal audit's annual plan with specific testing procedures. Include AI governance adherence in executive performance objectives. Make the governance committee a required approver in your project management workflow for any initiative tagged as AI-enabled.
Prevention Checklist
Before your next board meeting, verify you can answer these questions:
- Can you name the individual accountable for each AI system in production?
- Do you have documented evidence that someone tested your AI systems for bias in the past 12 months?
- Can your compliance team explain how a specific AI-driven decision was reached?
- Does your enterprise risk register show which existing risks are amplified by AI systems?
- Have you updated vendor management procedures to address AI-specific risks?
- Can internal audit independently verify AI governance controls are functioning?
- Do you have a process to detect AI deployments that bypassed governance review?
- Has your board received training on AI governance expectations and their oversight role?
The ART framework gives you the structure. These fixes provide the implementation path that actually works.
