FFIEC AI Governance Checklist

Checklist focus

A useful checklist should help teams identify AI use, assign owners, review vendors, assess data and security controls, track issues, and prepare evidence. It should connect AI governance to the same operating disciplines examiners already expect: board oversight, management accountability, risk assessment, third-party risk management, information security, change management, incident response, and auditability.

• Governance: AI policy, approval paths, risk appetite, committee reporting, and owner assignments.
• Third-party risk: vendor AI disclosure, diligence evidence, contract protections, and ongoing monitoring.
• Security and operations: data access, logging, change control, resilience, incidents, and exception handling.
• Evidence: inventory, approvals, monitoring records, issue remediation, and board or management reports.

Use it as a planning tool

The AegisAI assessment is an educational self-assessment and planning tool, not legal, regulatory, audit, or supervisory advice. Use the checklist to find gaps before an audit, exam, board meeting, or vendor review, then assign remediation owners and due dates.

Practical review sequence

Start with AI visibility, then move to risk tiering and evidence. If the team cannot name the AI use cases, it cannot reliably answer questions about vendors, model risk, consumer impact, or monitoring. Once the inventory is stable, prioritize customer-impacting, critical operations, security-sensitive, and high-risk vendor tools.

• Inventory known AI use across business lines, vendors, analytics, security, and employee tools.
• Mark data sensitivity, customer impact, operational criticality, and model-risk relevance.
• Request vendor and internal evidence for the highest-risk uses first.
• Report unresolved gaps through management, audit, or board channels based on severity.