Do Banks Still Need to Validate GenAI Models?

Why It Matters

Skipping formal validation may accelerate AI adoption but exposes banks to operational, compliance, and reputational risks that regulators are likely to codify soon. Early adopters of a robust GenAI governance framework will gain a competitive edge and avoid future supervisory penalties.

Key Takeaways

• Bank of America and Goldman Sachs already validate GenAI models
• Citi’s Sharma proposes a six‑pillar governance framework for GenAI
• SR 26‑2 removes GenAI from mandatory validation but may be temporary
• Human‑in‑the‑loop remains the most critical control for hallucinations
• Regulators expected to issue dedicated GenAI guidance within years

Pulse Analysis

The rush to embed generative AI like Microsoft Copilot into banking workflows has outpaced traditional risk controls. By labeling these tools as simple productivity aids, banks sidestepped SR 11‑7’s rigorous back‑testing and conceptual soundness checks, allowing rapid deployment but also creating blind spots around model behavior. The regulator’s pivot to SR 26‑2, which deliberately omits GenAI from its scope, reflects a pragmatic pause while supervisory bodies grapple with the technology’s opacity.

Industry voices, however, warn that exemption is not a permanent shield. Citi’s senior risk executive Krishan Kumar Sharma outlined a six‑pillar framework that treats foundation models and their downstream applications as formal models, subjecting them to real‑time testing, prompt libraries, and human‑in‑the‑loop oversight. Early adopters such as Bank of America and Goldman Sachs have already instituted internal validation pipelines, signaling that disciplined governance can coexist with speed. These efforts aim to surface hallucinations, bias, and data leakage before they affect credit decisions or customer interactions.

Looking ahead, banks that ignore validation risk falling behind emerging supervisory expectations. Historically, regulators have allowed industry practice to mature before codifying standards—as seen with the transition from SR 11‑7 to SR 26‑2. Anticipating a dedicated GenAI rulebook, institutions should embed scalable validation controls now, balancing innovation with risk mitigation. Those that master this balance will not only satisfy future regulators but also build trust with clients wary of AI‑driven errors.