E.SUN Bank and IBM build AI governance framework for banking

E.SUN Bank and IBM build AI governance framework for banking

E.SUN Bank is working with IBM to build clearer AI governance rules for how artificial intelligence can be used inside a bank. The effort reflects a wider shift in finance. Many firms already use AI for fraud checks and credit scoring, and some also use it to handle customer service queries. The new challenge is how to manage these systems in a way that meets legal and risk rules.

Banks face a growing list of questions as they deploy AI. How should a model be tested before it goes live? Who is responsible if it makes a wrong call? And how can firms prove to regulators that their systems are fair and safe?

To address those issues, E.SUN Bank and IBM Consulting have created an AI governance framework for banking. The project also includes an AI governance white paper that sets out how financial firms can build internal controls around AI systems. According to the companies’ press release, the work adapts global standards such as the EU AI Act and ISO/IEC 42001 for financial services.

The framework sets out how banks can review AI models before they are deployed. It also explains how those models should be monitored after they enter production. It includes rules for how data is used and how risk reviews should take place.

E.SUN Bank said the framework is intended to help financial institutions introduce AI systems while maintaining governance and regulatory oversight. Many firms already run limited AI tools. The next step is to scale those systems across core operations such as lending and payments while staying within regulatory limits.

Banks try to manage AI risk

Financial firms have strong reasons to place guardrails around AI systems. Banking relies on trust, and regulators require firms to track how decisions are made. AI models often act as “black boxes,” meaning it can be hard to explain how they arrive at a result. That can create problems in areas such as credit decisions or fraud checks. Regulators in many regions have started to focus on these risks.

The European Union’s AI Act, adopted in 2024, places strict rules on AI systems used in high-risk sectors such as finance. The law requires firms to assess risks and document training data. It also requires them to monitor how AI models behave after deployment.

Global standards are also taking shape. ISO/IEC 42001, published in 2023, sets out how organisations can build management systems for AI. The standard focuses on oversight and model monitoring. It also addresses how organisations should manage AI data. The aim is to give firms a structured way to manage AI across an entire company rather than treating each model as a separate tool.

E.SUN Bank’s project with IBM draws from both frameworks. It is meant to show how these rules could work in daily banking operations.

From AI pilots to enterprise systems

Banks have used machine learning for years, mainly in risk analysis and fraud detection. Newer AI models are expanding how banks use the technology. Many now apply it in customer service and document review. Some also use it in internal knowledge systems.

That expansion brings new governance needs. A system that suggests answers to customer queries may seem low risk. But a model that helps approve loans or detect fraud can have direct financial effects.

The governance framework created by E.SUN Bank and IBM sets out a process to track those risks. Models are reviewed before they go live, and teams monitor their output after deployment. The framework also assigns responsibility across teams, from developers to compliance staff. The project also produced a white paper that explains the steps in more detail. It outlines how banks can classify AI systems by risk level and apply different levels of oversight.