The governed finance playbook.

Every other sector can ship an AI system and apologize later. Banking cannot. A credit decision, a fraud call, a risk model — each can be challenged by a regulator years after the fact, and "the model said so" is not a defense. This is why most bank AI never leaves the pilot.

The institutions getting past that wall share one move: they stopped treating governance as the thing that slows AI down and started treating it as the thing that lets AI ship at all. Governed, evidenced, sovereign — in that order.

Principle 1 — Defensible beats fast

A fast decision you cannot defend to the regulator is a liability, not an asset. The winners make every consequential call reconstructable from a ledger before they make it faster. Speed without defensibility is how pilots die in compliance review.

Principle 2 — Sovereign is non-negotiable

For a regulated bank, where the data lives is not a deployment preference — it is a license condition. The institutions that move fastest assumed in-country, residency-aware, often air-gapped from the first design decision, rather than retrofitting it after a regulator asked.

Principle 3 — Beneath the core, not instead of it

The banks that succeed do not rip out core systems to "do AI." They put a governed layer beneath what already runs — so the core stays untouched, the risk stays bounded, and the value shows up in the decisions, not the migration.