The Governance Gap That Closed Faster Than Expected
Evident's annual AI index, which tracks the 50 largest global financial firms, found that all but one of those banks now has responsible AI principles formally in place, up from just 16 banks in 2023. That is a near total reversal in three years, in an industry that moves slowly on governance by design. More than two thirds of the surveyed banks have gone further, adding detailed controls such as checks on model inputs and outputs, limits on which tools an AI system can invoke, and ongoing oversight once a system is live in production.
Alexandra Mousavizadeh, co-founder and co-CEO of Evident, described what separates the leaders from the pack: they "define standardized guardrails, permissions, evaluation protocols" rather than leaving governance to be improvised project by project. That framing is the right one for any CIO building an AI governance program from scratch. The banks that moved fastest did not treat governance as a compliance afterthought bolted onto finished projects, they built the guardrails as a standing capability that every new use case plugs into.
Speed Without Proportional Oversight Is the Real Risk
The index also found that banks advanced their AI use roughly three times faster last year than across the previous three years combined, with the 50 banks citing more than 1,100 distinct AI use cases since 2021. That acceleration is exactly where governance frameworks get tested, because the controls that worked fine for a handful of pilot projects often buckle once use cases multiply across business lines simultaneously. Mousavizadeh was direct about the stakes in a regulated, customer facing industry: "errors can therefore translate directly into financial loss, customer harm, regulatory breaches."
That risk profile is generic to any enterprise scaling AI faster than it scales oversight, well beyond banking specifically. Accenture data cited alongside the index found more than half of banking IT executives now expect AI agents to be fully embedded in risk, compliance, audit, fraud detection, and transaction monitoring functions. Embedding agents into the functions that are themselves supposed to catch AI related errors raises the stakes on getting the oversight model right before that embedding happens, while the design choices are still easy to change.
The Leaderboard Shows Compounding Advantage, Not a Level Field
Evident's maturity ranking puts JPMorgan Chase first, followed by Capital One, Royal Bank of Canada, and CommBank. These are not newcomers to the list; they are banks that invested early and are now compounding that investment into a widening lead over peers still building out basic governance structures. For a CIO at a mid sized regional bank or a PE-backed fintech, the lesson is that the leaders are converting an early governance investment into a durable advantage in how fast they can deploy new use cases safely, well ahead of governance becoming table stakes everywhere else.
That compounding effect is the part of the story easiest to miss if you only look at the headline statistic that nearly every bank now has formal AI principles. Having a policy document and having an organization that can actually operationalize that policy across a thousand use cases are different achievements, and the index's maturity ranking is measuring the second one. Catching up on paper governance is achievable in a budget cycle. Catching up on operational maturity is not.
ROI Still Lags the Governance Investment
Despite the governance progress, only 12 of the 50 banks report measurable return on investment from their AI projects, up modestly from 8 the prior year. That gap between governance maturity and financial return is worth sitting with. It suggests that the industry has gotten reasonably good at making AI deployment safe, but is still struggling to make it demonstrably profitable at the scale the investment implies, even among institutions that have done the governance work seriously.
For CIOs outside banking watching this from PE-backed SaaS or retail, that gap is a useful calibration point. If the most governance mature, best resourced financial institutions in the world are still proving ROI on fewer than a quarter of their AI projects, a modernization plan that assumes AI initiatives will self fund quickly is optimistic. Budget governance capability as a prerequisite for scale, not as a cost center to minimize once scale is already underway.
What This Means for Non Banking CIOs
The 33 percent year over year growth in AI governance talent across these 50 banks is a hiring signal worth tracking even if you do not run a bank. Dedicated AI governance roles, spanning model risk, evaluation design, and oversight operations, are becoming a distinct talent category with its own hiring market, and banks are currently the most aggressive buyers in that market. If you wait to build this function until your AI footprint forces the issue, you will be competing for the same talent pool against institutions that started three years ago.
The practical takeaway is to treat governance infrastructure as something you build ahead of use case growth, not behind it. Banking's experience suggests the organizations that establish standardized guardrails, permissions, and evaluation protocols before scaling AI use cases end up both safer and faster than those that scale first and retrofit governance under pressure. That sequencing decision, more than any specific tool or policy, is what separated this year's leaderboard from everyone else on it.
