Mid-Size US Banks • CRI FS AI RMF
AI Governance Banking Gaps, Found Stakeholder by Stakeholder
AI governance banking programs rarely fail on the framework. They fail on discovery: nobody asked the board what falls outside appetite, nobody asked model risk which AI sits outside the model inventory, and nobody asked procurement which vendors ship AI features the bank never evaluated. The Elevate AI Governance Intake Questionnaire for Banks is the instrument that asks. 136 questions, ten stakeholder groups, thirteen control domains, each anchored to a CRI FS AI RMF control objective.
136
10
13
No-cost
WHY IT MATTERS NOW
Why AI governance banking programs stall before they start
Generative AI sits outside model risk guidance
The revised interagency model risk management guidance issued in April 2026 states that generative AI and agentic AI models are not within its scope. The assistants, agents and embedded vendor features most banks actually run therefore sit outside the one model governance letter the agencies have published, while examiners still expect them governed. That gap closes with documented internal governance or it does not close at all.
230 control objectives, four adoption stages
The CRI FS AI RMF scales obligations to a documented AI adoption stage rather than applying one control set to every institution. The stage your bank documents decides how much of the 230 objective set applies to it, and that single decision moves the size of the program more than any other choice in the build. The workbook produces the evidence that decision rests on.
Ten stakeholder groups
Programs written from a framework document rather than from discovery produce controls nobody operates. The board, model risk and procurement each hold part of the picture and none of them holds all of it.
Inventory before governance
Generative features arrive through vendor releases rather than through an AI project. The inventory domain exists because the bank usually finds more AI than it expected to find.
WHAT IS INSIDE
Thirteen AI governance control domains, and the stakeholder who owns each one
These are the thirteen domains of Elevate’s Enterprise AI Governance and Risk Management Framework. Every control statement in the Framework carries a domain, an owner, a frequency, the evidence it produces, and its anchor in the CRI FS AI RMF. The workbook asks the questions that show where your coverage sits in each one.
GOV
Governance and accountability
Risk appetite, prohibited use categories, committee structure and decision rights, including AI FinOps considerations. The largest domain in the workbook, because overlapping AI bodies with unclear authority are the most common structural finding.
INV
Inventory and classification
What AI the bank actually runs, including features embedded in procured systems that entered through a purchase nobody flagged as an AI decision.
RSK
Risk and impact assessment
Risk to the bank and impact on customers, treated as separate assessments because they answer different questions and examiners test them differently.
DAT
Data governance
Training data provenance, quality, retention and the lineage a model risk reviewer will ask to trace.
DEV
Development, testing and evaluation
How models are built, validated and challenged before they reach a customer-facing decision.
DEP
Deployment and human oversight
Where a human remains in the loop, where one does not, and whether that distinction is documented or assumed.
MON
Monitoring and performance
Drift, degradation, and the thresholds that trigger action rather than a report.
TPR
Third-party and supply chain
Vendor AI, embedded features, and the contractual terms that determine what the bank can actually verify.
SEC
AI security
Adversarial exposure, prompt injection, model and data protection, and where AI systems sit relative to the bank’s security perimeter.
PRV
Privacy and transparency
Customer disclosure, consent where it applies, and what the bank can explain about an automated decision.
INC
Incident management
What counts as an AI incident, who declares it, and how it connects to the existing incident process rather than running beside it.
TRN
Training and literacy
Role-based competence for the people who operate and oversee AI, which is a named obligation in several regimes.
AUD
Assurance and audit
Whether internal audit can test the AI program, and whether the evidence exists to be tested.
Three steps to a defensible AI governance program
Enter your work email and we send the Excel workbook: a How to Use tab, the 136 question register, and a domain coverage matrix that shows which stakeholder owns each domain.
Download the workbook
Five areas, three bands. Check only what you can demonstrate with documentation, not what you believe informally to be true. The honest version is the useful one.
Run it stakeholder by stakeholder
Bring your completed register. We read it against the CRI FS AI RMF and hand back the framework, standards and policies your program needs, in build order.
Book the no-cost review
Get the workbook
Find your AI governance gaps before an examiner asks who owns them.
Enter your work email and we will send the Elevate AI Governance Intake Questionnaire for Banks: 136 questions, 10 stakeholder groups, 13 control domains, each anchored to a CRI FS AI RMF control objective.
- 136 questions with their CRI FS AI RMF anchors
- A domain coverage matrix showing who owns what
- Response, evidence and owner columns built in
- A no-cost 30 minute review of your completed register
THE REVIEW
What your no-cost AI governance review covers
Thirty minutes with the team that builds these programs for banking institutions. Bring the completed register, or bring it half finished. The review works either way, because a partial register already shows where the picture breaks.
A gap assessment against your current implementation
We mark where your institution has an operating control, where a document describes an intent but nothing operates behind it, and where nothing exists at all. That distinction, not the question count, sets the size of the build.
The adoption stage you should be scoped to
We tell you which CRI FS AI RMF adoption stage your institution should document against and what that means for the control objectives that apply. You do not have to reconcile framework versions or control counts yourself. We track them and we bring the current position to the call.
The build order for framework, standards and policies
You leave with the list of documents your program needs and the sequence to build them in, including which of your existing policies, committees and assessment cycles already carry part of the load.
Who you meet. The review is run by Elevate’s AI governance practice, led by Angela Polania. The same practice works across GLBA, FFIEC examination readiness, the CRI Profile, SWIFT CSP and FedLine, so the AI conversation stays inside the examination cycle your institution already runs.
BUILT FROM THE RULESET
AI governance built for banks, not adapted to them
The Cyber Risk Institute published the Financial Services AI Risk Management Framework in February 2026 with the Financial Services Sector Coordinating Council, the U.S. Treasury, and more than a hundred institutions. It scales obligations to a documented adoption stage rather than applying one control set to every firm, which is why it fits a mid-size bank better than a generic AI framework does.
Elevate’s Enterprise AI Governance and Risk Management Framework is the build that follows this workbook. Every control statement in it carries a domain, an owner, a frequency, the evidence it produces, and its anchor in the CRI FS AI RMF, so the program is testable by internal audit rather than described in a policy. Where an institution already runs the CRI Profile, version 2.2 includes a mapping to the FS AI RMF, so AI risk enters the control set your institution already assesses instead of standing beside it.
136
13
+18
100%
AUDIENCE
Who this AI governance workbook is for
Chief Risk Officers and risk committees
The appetite statement is the first thing the workbook asks about, because if AI is absent from it every downstream control rests on an assumption nobody approved.
Model Risk Management
AI that sits outside the model inventory is the gap this instrument was built to find, and the April 2026 guidance put generative and agentic systems outside model risk scope entirely. Model risk holds the methodology; it rarely holds the full picture.
CISOs and technology leaders
Inventory, AI security and third-party domains concentrate here, and they are where shadow adoption surfaces.
Legal, compliance and internal audit
Privacy, transparency, assurance and audit domains, plus the question of whether the program can be tested at all.
AI governance banking gaps do not close themselves
Run the register, bring us the result, and we map it against the CRI FS AI RMF and outline the framework, standards and policies required to close it. If you already know where your gaps are, skip the workbook and take the review.
QUESTIONS
AI governance for banks: frequently asked questions
What is the CRI FS AI RMF?
The Financial Services AI Risk Management Framework, published by the Cyber Risk Institute in February 2026 with the Financial Services Sector Coordinating Council, the U.S. Treasury, and more than a hundred institutions. It is built on the NIST AI Risk Management Framework structure and designed as a supplement to existing risk functions rather than a parallel program. It carries 230 control objectives and scales them to a documented AI adoption stage, so a bank beginning its AI journey is not held to the same control set as one with AI in production across business lines.
Who should fill out this questionnaire?
Ten stakeholder groups, and that distribution is the point. Board and risk committee, technology, information security, model risk management, third-party risk, enterprise and operational risk, legal and compliance, data governance, automation, and business operations. No single function holds the full picture, which is why programs built from one group’s view develop blind spots.
How long does the workbook take to complete?
Most institutions run it as a series of short interviews rather than one sitting. Each stakeholder group has its own filtered section, and the sections can run in parallel because they do not depend on each other. Circulating the questions in advance produces documents and inventories rather than recollections, which is the difference between a discovery record and a meeting summary.
Is the workbook the framework itself?
No, it is the discovery step into it. Elevate’s Enterprise AI Governance and Risk Management Framework is built on these thirteen control domains, and every control statement in it carries a domain, an owner, a frequency, the evidence it produces, and its CRI FS AI RMF anchor. The workbook establishes where your institution already has documented coverage, where existing documents describe an intent but not yet an operating control, and where nothing exists. That distinction determines how much of the Framework you actually need built, and it is what the review reads back to you.
Does this replace our model risk management program?
No, and the distinction now carries supervisory weight. The revised interagency model risk management guidance issued in April 2026 states that generative AI and agentic AI models are not within its scope. Model risk management governs the models the bank has identified as models. This workbook asks the broader question: what AI is running across the institution, including generative features in procured systems that were never routed through model risk because nobody classified them as models. Several domains connect directly into an existing model risk program rather than duplicating it.
What does Minimal mean in the CRI FS AI RMF?
It is one of four documented adoption stages in the framework, sitting above Initial and below Evolving and Embedded. The framework scales its 230 control objectives across those stages, so the stage an institution documents decides how many objectives apply to it. Most mid-size banks building a formal AI governance program sit between Minimal and Evolving, and that step is the most consequential scoping decision in the build. The workbook produces the evidence that decision needs, and Elevate confirms the current counts and thresholds with you in the review.
What happens after we complete it?
Book the no-cost 30 minute review. Bring the completed register and we walk the gaps with you, mark which items are operating controls rather than documented intent, tell you which adoption stage your institution should be scoped to, and hand back the framework, standards and policies your program needs in build order. Where the institution already runs the CRI Profile, version 2.2 includes a mapping to the FS AI RMF, so AI risk can enter the control set and assessment cycle you already maintain.