Operationalising AI risk governance at scale

Report - June 2026

In early 2024, we published a report exploring the risk management and use of generative AI (GenAI) across the financial services industry, covering key risks, governance approaches, stakeholders, policies, training, guidance and training, controls and availability of GenAI tools.

We have since built on this through discussions with our LeadersConnect community, and analysis of AI’s impact on cyber risk with the ORX Cyber Community.

In early 2026 we conducted a follow-up study and a series of meetings with the ORX Data Science Community, the Cyber Community and the Insurance Service Governing Committee focusing on governance frameworks, use case assessments, inventory and tooling, and risk appetite.

This report draws on survey responses from over 30 financial institutions and discussions with 160 risk professionals across 66 firms. It provides a snapshot of current developments in establishing AI risk governance with focus on GenAI including agentic AI.

Firms can use this report to:

• Understand current practices in the financial industry
• Identify gaps in establishing risk governance, accountability, appetite and metrics
• Support building a phased roadmap from foundational controls to scalable governance

This report is available to all ORX members and ORX Cyber subscribers.

Contacts: