Boards, AI, and Decisions That Matter

In the Toyota production system, Jidoka, or “autonomation”, allows machines to stop automatically when an abnormality is detected. Workers do not need to monitor every machine continuously, but when something goes wrong, a call button alerts a leader and stops work until the issue is resolved. The system is designed around a simple principle: decisions can be automated, but there must be clear points for human intervention when something falls outside expectations.

Similarly, board of directors don't need to approve every decision their institution makes, but they should be able to explain how the decisions that matter most are made. This is becoming more important as community financial institutions (CFIs) introduce more automation and artificial intelligence (AI) into lending, fraud detection, customer service, compliance, and other areas. Board members don't need to master every algorithm or technology, but they do need visibility into the policies, controls, risk thresholds, and human oversight shaping the outcomes. 

This makes decision governance key to the evolution of enterprise risk management (ERM). The objective is to give leadership visibility into where important decisions happen, how they align with the institution's risk appetite and strategy, and what happens when something goes wrong.

Traditionally, board leadership might focus on the outcome of a decision: the quality of the loan portfolio, liquidity position, fraud losses, or customer complaints. As more decisions become automated, understanding the pathway to those outcomes becomes increasingly important. For example, a credit decision may involve policy rules, an underwriting model, third-party data, and automated workflows before a human reviews the application. Similarly, fraud detection may rely on AI alone to identify patterns across large volumes of transactions.

Board members need sufficient visibility to know what decisions are being automated, what policies govern them, where the risks are, what triggers escalation, and how management knows whether the process is producing the intended outcome. While these are familiar ERM concerns, the difference now is that decision-making itself is becoming an increasingly important part of the risk landscape.

Reuters reported in June that US banking regulators are asking banks to map how they use AI in higher-risk areas such as lending, know-your-customer checks, and sanctions screening. Supervisors are also examining governance frameworks, human oversight, third-party risk, data access, contingency plans, and even whether institutions have mechanisms to shut down AI systems when necessary.

Importantly, regulators are not approaching AI as an entirely separate risk category. They are using existing frameworks, including model risk management, third-party risk oversight, and consumer protection requirements, to assess how banks are managing the technology. So, the question for CFIs is whether AI-enabled decisions are incorporated into the institution’s broader risk-management framework.

Recent guidance from the US Treasury and Financial Services Sector Coordinating Council (FSSCC) points in the same direction. The FSSCC’s Financial Services AI Risk Management Framework is designed to complement existing frameworks and provide a scalable approach for assessing AI risks, identifying gaps, and prioritizing controls. What’s more, it explicitly aims to support innovation and efficiency alongside responsible AI use.

This is particularly important for CFIs, which have significant opportunities to use AI and automation to improve efficiency, strengthen fraud detection, enhance customer service, and expand their ability to serve customers. 

Stronger governance should not mean adding so many controls that innovation becomes impossible. Quite the opposite; Effective decision governance and AI oversight can enable sustainable revenue growth. For example, a board of directors that understands the controls around an AI-enabled lending process is better positioned to support its expansion. Directors can challenge management on data quality, model performance, exceptions, human oversight, and escalation — and, if those controls are appropriate, have greater confidence in scaling the technology.

The FSSCC’s work on AI explainability reinforces this point. It identifies governance and risk management, data governance, guardrails, assurance and testing, and ongoing risk monitoring as key disciplines for improving explainability. The goal is not simply to make AI understandable, but to provide the transparency and control needed to use it effectively.

Here are three practical questions board members should be able to answer.

1. Where are our most important decisions being made? Management should be able to identify the major decision pathways across lending, liquidity, payments, fraud, customer service, and other material activities — including where automated systems, models, or AI are involved.

2. What happens when a decision falls outside expectations? Every important automated process should have defined thresholds, exception procedures, and escalation routes. Board directors should understand where human judgment enters the process, who has authority to intervene, and what happens if a system fails.

3. How do we know the process is working? Board members should receive appropriate reporting on performance, exceptions, emerging risks, and control effectiveness. This is particularly important where systems change over time, rely on third-party providers, or have access to sensitive customer data.

As AI moves deeper into lending, payments, fraud, and operations, executive leadership and board members need visibility into the decisions that matter most — not every decision, but the pathways that drive risk, revenue, and customer outcomes.

Virginia Robbins, EVP, Chief Solutions Officer for PCBB, sums it up: “For CFIs, good governance isn’t about putting the board in the middle of every decision. It’s about giving directors a clear line of sight into the decision pathways that drive risk and revenue. By mapping automated and AI-enabled decisions into the enterprise risk framework, board members can see how credit, liquidity, and customer outcomes connect to risk appetite and strategy. That gives bankers room to balance risk and reward while giving directors confidence that the institution has the policies, controls, and culture to scale that judgment responsibly.”