Treasury's AI risk framework: what it means for financial services controls

TL;DR: KonaSense says the U.S. Treasury's new AI Lexicon and FS AI RMF push financial institutions to prove they can govern AI consistently across business, compliance, and technical functions, with inventory, runtime policy, and audit evidence becoming the practical control stack. The shift is from AI permissioning to AI governance that can be demonstrated, not merely described.

Editorial analysis by NHI Mgmt Group, based on content published by KonaSense: “Treasury just raised the bar on AI risk. Here is the practical playbook.”.

Key questions

Q: How should financial institutions govern AI-assisted development without slowing delivery?

A: They should move verification into the development workflow so every change is analysed before merge or release.

Q: What breaks when AI policy is written but not enforced through IAM?

A: Policy breaks down when users can still access sensitive data or complete AI-assisted work outside approved boundaries.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.

Practitioner guidance

• Build an AI inventory around real workflows Record use cases, owners, data classes, model or vendor source, and downstream decision paths so shadow AI and personal accounts are not missed.
• Enforce policy at the point of use Use runtime controls that can allow, block, redact, or coach when employees interact with AI tools, rather than relying on static policy documents.
• Define evidence fields for every AI interaction Capture who used the system, when, what data category was involved, what control decision occurred, and whether anything was redacted or blocked.

Bottom line: Financial services AI governance now depends on whether institutions can standardise definitions, inventory actual usage, and prove controls at the point of interaction.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →