by Arkatechture, on September 22, 2026
You're already using AI. Your vendors are embedding it everywhere. Your team is using ChatGPT or Claude. Right-click AI features exist in most software you use.
The question isn't whether to use AI. It's whether you're using it responsibly. For financial institutions under federal oversight, this distinction matters.
Advisory vs. Agentic AI
Most AI use is advisory. You ask a question. You decide what to do. You're in control.
Agentic AI is different. You tell the system to do something and it does it, without explicit approval for each decision. You send a campaign targeting specific members. The system identifies the audience, writes messaging, optimizes timing, and executes, all on its own.
One is AI advising you. The other is AI acting for you.
Automation requires different governance.
The Human-in-the-Loop Reality
Many institutions say they want "human in the loop." What they actually do is build automation, then add review afterward. That's not governance.
Real human-in-the-loop means two things:
1. Humans can override the system. If you review AI decisions but have no authority to reject them, you're watching, not deciding.
2. Human decisions matter. Your objection has to actually stop the process. Otherwise, your input is meaningless.
If both aren't true, you don't have human in the loop. You have observation.
Automation Bias
Research documents what's called automation bias: we over-trust confident-sounding computer outputs. AI intensifies this as it generates answers with conviction, often wrongly.
When you automate, the problem compounds. You're not trusting one response. You're trusting a chain of decisions, each probabilistic, each potentially amplifying error.
AI sounds certain. That certainty is often unwarranted. Automation amplifies that risk.
Three Governance Questions
The Federal Reserve's guidance (SR 26) boils down to three questions:
- Who decides? Not who implements. If you don't know, you don't have governance.
- Who's accountable? When the AI produces a wrong outcome, who takes responsibility? If everyone is accountable, nobody is. Clarity must come from senior management.
- How do we know? Who monitors? Who audits? Can you trace decisions back to data and assumptions? Without observation, you have no governance.
Three Core Actions
1. Use NIST and Triad Frameworks
NIST has a downloadable AI Risk Management Framework. Triad asks three questions for every AI project: What's the business value? How does it fit our firm? How will we govern it?
Most projects fail on the third question. Design governance in from the start.
2. Ask Vendors Hard Questions
Don't assume bought software is low-risk. Ask for model documentation, training data sources, validation results, and error rates. If they can't answer clearly, you're taking on unquantified risk.
3. Put Someone in Real Control
Not every decision needs review. But critical ones do. Someone senior needs real authority to say no. Use Claude Code? Approve before every commit. Deploying an AI hiring tool? Someone can kill it if it discriminates.
This costs speed. That's the governance trade-off.
The Vendor Risk
Most of your software is bought, not built. Vendors are embedding AI everywhere: Excel Copilot, Tableau Pulse, CRM intelligence.
Here's the problem: Just because you bought it doesn't mean it's not your risk. Licensing agreements often protect vendors through indemnification clauses.
Before using vendor AI in automated decisions, ask for:
- Model documentation and training data sources
- Validation results and error rates
- Known limitations and trade-offs
If they can't answer confidently, you're accepting unquantified risk.
Final Thoughts
You have an advantage: Financial services has 30 years of AI experience through credit scoring and risk models. You have Federal Reserve guidance (SR 26). You have compliance frameworks.
Use them. They exist for this moment.
The work isn't inventing new governance. It's adapting what you have to agentic AI.
Use AI. But do it responsibly.
Meet ArkaIQ
ArkaIQ is an AI-powered analyst trained on your institution’s data, governed to your standards.
