Who owns the institution's meaning?
Data has owners. Models have validators. The definitions, rules and precedent that tell AI how a financial institution thinks usually have neither, and that gap is becoming a governance question.
By Penomic Research · Published · 7 minute read
Download the PDFThe ownership gap
Financial institutions have mature governance for data quality and for models. Data owners and stewards are accountable for records. Model risk teams validate models before use, in the US under supervisory guidance on model risk management that has shaped practice for over a decade.
The knowledge that connects the two, how the institution defines its concepts, which rules apply and what precedent says, often has no single owner. It is spread across policy teams, business lines and experienced individuals.
Why it matters now
As AI moves from drafting to acting, regulators and boards ask how outputs can be explained and controlled. In the EU, the AI Act treats certain financial uses, such as creditworthiness assessment of individuals, as high-risk and expects documentation, oversight and traceability. Supervisors elsewhere are asking similar questions through existing frameworks.
An institution that cannot show which definition, rule and evidence an AI output relied on will struggle to answer those questions, however good its data and model governance.
A workable ownership model
Treating institutional knowledge as a governed asset does not require a new bureaucracy. It requires clear roles and a few controls.
- Business owners for each domain of definitions and rules, with authority to change them.
- Stewards who maintain quality, resolve conflicts and keep versions current.
- Change control, so updates are reviewed and their downstream effects are visible.
- Provenance on outputs, linking every AI-assisted result to the knowledge it used.
- Periodic review alongside model validation, not separate from it.
The board-level question
Boards are asking management how AI is governed. A sharper question is who owns what the AI is told about the institution, and how that knowledge is kept accurate as policy, markets and people change. Institutions with a clear answer will be able to expand AI use faster, because each new use case builds on governed knowledge rather than starting from scratch.