Banks already use machine learning for fraud checks, credit scoring, document review and customer service. As those systems enter more consequential workflows, the central question changes from whether a model performs well to whether the institution can prove it is controlled.
Taiwan’s E.SUN Bank and IBM Consulting have created an AI governance framework for banking, accompanied by a white paper. The work adapts principles from the European Union’s AI Act and ISO/IEC 42001 to the practical demands of financial services.
Its purpose is to create repeatable rules for reviewing models before launch, monitoring them in production, governing data and assigning responsibility across teams.
Risk begins with the purpose of the model
Not every banking system carries the same consequence. An assistant that drafts a response for an employee differs from a model that influences credit approval or flags a customer for possible fraud. A useful governance programme classifies systems by risk and applies stronger scrutiny where an error could directly affect money, access or legal rights.
The E.SUN and IBM framework addresses pre-deployment review as well as ongoing monitoring. Before launch, teams need to understand the training data, expected behaviour, limitations and human controls. After launch, they must watch for performance changes and unintended outcomes rather than treating approval as permanent.
Data governance sits underneath both stages. Banks need records of where information came from, whether its use is permitted and how it shaped an output. Accuracy alone cannot answer whether a decision process is fair, explainable or compliant.
Clear ownership closes another gap. Developers, business leaders, compliance specialists and risk teams each see a different part of the system. The framework assigns duties across those groups so accountability does not disappear between technical and operational boundaries.
Global rules need a banking translation
The EU AI Act establishes obligations for high-risk AI, including risk assessment, documentation and post-deployment monitoring. ISO/IEC 42001 provides a broader management-system structure for overseeing AI across an organisation.
Neither standard by itself explains every decision a bank must make during a lending, payment or fraud workflow. E.SUN and IBM’s contribution is to translate global principles into procedures that financial teams can apply day to day.
That translation matters as banks move beyond isolated pilots. A small experiment can rely on close supervision from its creators. Enterprise deployment requires controls that remain consistent across departments, models and time.
The source cites widespread interest: a 2024 Nvidia report found that 91% of financial-services firms were assessing or using AI, while Deloitte research indicated that more than 70% planned to increase investment. Compliance monitoring and risk analysis are among the areas attracting spending.
Rapid adoption increases the cost of governing each model as a special case. A common framework allows the bank to maintain an inventory, compare risk levels and reuse approval and monitoring practices.
Governance can accelerate responsible adoption
Controls are often described as friction, but uncertainty can delay deployment more than a clear review process. When teams know what evidence is required, who signs off and how production behaviour will be monitored, they can design for those expectations from the beginning.
Governance also gives regulators and customers a more credible basis for trust. A bank should be able to explain not just that a model was accurate during testing, but how it is supervised now, how incidents are handled and who is accountable for the final decision.
The E.SUN and IBM project does not eliminate the possibility of error or bias. Frameworks only work when institutions maintain them, investigate warning signs and give oversight teams enough authority to intervene.
Its significance lies in treating AI as an enduring management responsibility. Models change, data shifts and business uses expand. A one-time technical review cannot govern that lifecycle.
As AI moves into core financial operations, the strongest institutions will not necessarily deploy the most models. They will know which systems they operate, why each one is permitted to act and how to stop it when reality departs from the assumptions under which it was approved.
