Artificial Intelligence as a New Institutional Risk: Implications for Governance and Risk Oversight

This article assesses how fiduciaries—particularly corporate boards—must redesign governance to manage generative and agentic AI. The authors argue that AI represents a novel class of institutional risk because its opacity, stochastic outputs, emergent behaviors, and dependence on external platforms create intertwined and cross-cutting risks, including model, IT/security, and third-party risks, that outstrip traditional oversight approaches. With a focus on banking, the authors adapt established board duties (risk appetite setting, risk identification oversight, policy approval, performance monitoring, and resourcing) to AI and recommend clarifying the board’s own roles and responsibilities for AI oversight, having independent directors with AI expertise, conducting frequent board training, and establishing focused KRIs to avoid information overload. In doing so, the article highlights how AI challenges traditional risk taxonomies and governance structures used by financial institutions. A central challenge is to provide scalable oversight, which will increasingly require <italic>AI to govern AI</italic> while preserving meaningful human judgment. However, there are limits to humans’ ability to provide effective oversight arising from cognitive outsourcing, vigilance decay, and skill erosion; humans alone cannot scale effective surveillance of AI at deployment speeds. By framing AI governance as an emerging risk management problem rather than solely a technology issue, the article contributes to the growing literature on novel operational and governance risks facing financial institutions. Banks serve as a test case given their heavy reliance on models and systemic importance.