Banks may have no AI-specific supervisory playbook yet, but that is not a reason to leave consequential systems unguided. Flagright co-founder and CTO Madhu Nadig argues that financial institutions should apply existing risk controls now, with the strength of oversight matched to what an AI system can access and do.
Watch Desk analysis
What happened
In a Forbes Technology Council essay published on 9 November, Nadig says new US model-risk guidance excludes generative and agentic AI because those technologies are changing rapidly, while directing banks to use existing risk-management practices to determine appropriate controls. That is Nadig’s account of the guidance and its implications, not a substitute for the underlying regulatory text.
His practical recommendations are more specific than “keep a human in the loop”. He calls for classifying each use by factors such as data sensitivity, customer impact and autonomy; keeping records of the model version, inputs, sources, permissions and human review; and giving reviewers the authority and evidence needed to challenge an output. For agentic systems, he argues for defined permissions, limits, escalation routes and a way to stop execution.
Why it matters
A tool summarising public guidance and an agent acting on transaction data do not present the same stakes. Nadig’s point is that controls should follow the system’s actual reach, not merely the label on the model. That offers banks a way to govern useful experiments without pretending either that every use is equally risky or that a fluent explanation proves a decision was sound.
The advice also makes accountability harder to outsource. Nadig says buying a third-party AI product does not transfer responsibility from the institution using it. Banks still need enough evidence to assess performance in their own workflows and to reconstruct what happened when a decision is questioned. “A human approved it” is a thin defence if the human was handed no sources, no time and a large button.
Our read
This is an industry practitioner’s argument, not a new regulator-issued AI rule. Its useful contribution is a workable governance checklist: classify the use, record the evidence and permissions, test the whole workflow, and make sure a person can genuinely intervene. Banks should check the underlying guidance before treating Nadig’s description as definitive; the operational questions are worth asking either way.
What to watch
- How the relevant regulators describe the scope of the new model-risk guidance.
- Whether banks put use-case classification and traceable evidence into routine AI approval processes.
- What visibility and change-notification terms financial institutions demand from AI vendors.
Discussion spark: Should banks be allowed to experiment with AI under existing controls, or should regulators set dedicated rules before these systems influence consequential decisions?
Sources and evidence
- There's No Rulebook For AI In Compliance Yet-That's Not Permission To Skip Explainability – Forbes (9 November 2026, 12:30 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.