Financial institutions currently deploying AI are answering this question: how much decision making authority does the tool actually have.
The first wave of AI adoption across banking and financial services did not force this question very hard. Generative tools optimized for workflow automation, document handling, and drafting sped up work that a person was still going to review. A faster first draft of a trade confirmation is still a draft. An automated summary of a settlement instruction is still checked against the underlying documentation before anyone acts on it. The human stayed in the loop by default, because the tools were not built to act without one.
That default is eroding. AI agents, multimodal analysis systems, and increasingly autonomous decisioning tools are shifting the conversation from workflow efficiency toward something closer to delegated judgment. The industry has not caught up to what that shift actually requires.
From Data Synthesis to Decision Synthesis
The immediate value institutions are finding in newer AI capability sits in data synthesis, not automation. A system that combines transaction history, bureau data, alternative data sources, and market signals into a single view is doing something a human analyst could theoretically do, only slower and with far less consistency across portfolios and business lines. Institutions are right to see genuine value here, and competitive pressure makes that value more urgent rather than less. Risk is harder to price when the underlying signals arrive from a dozen disconnected systems.
The risk question is not whether this synthesis is useful. It clearly is. The risk question is what happens once synthesized outputs stop being an input to a human decision and start functioning as the decision itself. Credit and counterparty assessment is where this line gets crossed fastest, because dynamic, AI generated exposure scoring is exactly the kind of tool that accelerates lending and counterparty decisions enough to become load bearing. A faster credit assessment that an underwriter still reviews line by line is an efficiency gain. The same assessment feeding directly into an automated limit or approval decision is a different animal entirely, and it deserves a different governance conversation.
Increasing autonomy requires increasing assurance, not increasing trust in the tool.
A Question the Industry Has Faced Before
This is where model risk management’s longer history actually transfers, more than most people expect. Institutions spent years working through a version of this same question for algorithmic trading and automated credit decisioning: at what point does a tool cross from decision support into decision making, and what controls does that crossing require.
The answer the industry eventually settled on was not a single line but a graduated one. Systems that inform a human judgment call require validation and monitoring. Systems that make a decision within defined limits, with a human able to intervene, require tighter controls and clearer override authority. Systems that act with no human check at all, which remain rare even in the most automated corners of financial services, require a different category of assurance altogether, closer to what an institution would expect of any irreversible financial action.
Every business line now adopting AI, from underwriting to fraud monitoring to wealth advisory to claims processing, is heading toward that same graduated structure whether it builds it deliberately or not. The internal conversation about how much autonomy to grant an AI system for account approval or claims settlement is, underneath the technology framing, a conversation about where each specific use case sits on that spectrum, and whether the controls around it match.
Building the Control That Matches the Autonomy
A practical way to think about this, drawn directly from model risk management practice, is to separate three questions for every AI tool in use, regardless of how it is marketed.
First, what decision is this tool actually influencing, and how far downstream from a human check does that influence travel. A tool drafting a credit memo for review sits in a different place than one issuing an approval decision automatically.
Second, what happens when the tool is wrong. Multimodal systems synthesizing transaction, external, and behavioral data will occasionally synthesize confidently from bad inputs, and a risk assessment built on that synthesis inherits the error silently. The institutions managing this well have built explicit checks for exactly this failure mode, rather than assuming synthesis quality is stable over time.
Third, who can override the system, how quickly, and whether that override authority has actually been tested rather than just documented. An autonomy framework that exists only on paper provides no more protection than no framework at all.
Increasing autonomy requires increasing assurance. Governance has to match the stage, not the technology label.
The Years Ahead
The institutions that get real value from this next wave of AI, without also absorbing its risk, will be the ones treating autonomy as something to be granted deliberately and in proportion to the controls built around it, rather than something that simply accumulates as tools get more capable. That discipline is not new. It is the same discipline model risk management built over the last two decades for automated decisioning generally, applied now to a set of tools that is moving faster than that discipline originally anticipated.
The question worth asking of any AI tool now in use across the institution is not whether it works. Most of them do. The question is how much authority it has quietly accumulated, and whether the controls around it have kept pace.
This article reflects the author’s independent professional judgment and does not constitute legal, regulatory, or compliance advice. Readers should consult qualified legal and compliance counsel for their specific circumstances. © 2026 Chimayo Consulting LLC. All rights reserved.