If AI Gets It Wrong, Could You Evidence Your Oversight?

Expert commentary — 4 min read

AI oversight is often discussed as if the central question were whether an institution has an AI policy, an AI committee or an AI inventory.

Those elements matter. But they are not the end point.

For a management board, the relevant question is whether oversight can be evidenced in practice. This is consistent with the ECB’s current supervisory direction on AI. The ECB’s 2026 supervisory priorities state that banks using new technologies, particularly AI, should have strategies that reflect both opportunities and risks and should establish robust governance and risk controls.

The ECB’s 2024 draft guide on governance and risk culture also used a good-practice and red-flag structure for governance assessment. In June 2026, the ECB announced that this draft guide will be replaced by a good-practices report planned for the first quarter of 2027. The useful point for this briefing is therefore not the legal status of the draft guide, but the management logic: governance must be visible in practice, not only described in policy.

This matters because AI changes the evidence standard.

In a conventional technology process, a board may ask whether a system is approved, whether controls exist and whether the relevant function owns the process. In an AI-supported process, the same questions are no longer enough. The board also needs to understand what the AI system is doing, what decision or workflow it supports, where human judgement remains required, who is competent to review the output and whether exceptions are visible.

That is why “this sits with IT” is not a board-grade answer.

Technology may manage the platform. But the decision impact sits where the use case changes work, judgement, communication, control or client interaction. If an AI tool supports a credit process, fraud process, investment-service process, control review, legal assessment or customer communication, ownership cannot be reduced to system administration.

ESMA has made the same point for investment services. In its public statement on AI and investment services, ESMA says that firms using AI when providing investment services should comply with MiFID II organisational, conduct and best-interest obligations.

This is the practical logic behind the RAG panel.

A GREEN answer is not strong because it uses sophisticated language. It is strong because it is concrete.

• It can show the use cases.
• It can name the owners.
• It can explain the decision impact.
• It can evidence human oversight.
• It can show role-based AI literacy.
• It can demonstrate monitoring.
• It can produce logs, dashboards and decision records.

An AMBER answer may be directionally correct but not yet reliable for board reliance. The institution may have an inventory, but it may not include embedded AI in third-party tools. It may have training, but not by role. It may have a policy, but no exception log. It may have use-case approval, but no clear decision rule for scaling or stopping the use case.

A RED answer is different. It is not necessarily false. It is simply not enough.

• “We have a policy” does not evidence oversight.
• “The provider is responsible” does not evidence internal accountability.
• “It is only a copilot” does not explain data exposure, decision impact or human reliance.
• “Training has been completed” does not show whether the right people have the right competence for the right use case.

This distinction is particularly important under the EU AI Act. The European Commission explains that Article 4 entered into application on 2 February 2025 and that the supervision and enforcement rules apply from 3 August 2026 onwards.

The governance conclusion is straightforward. AI oversight is not a document.
It is an accountability chain.

That chain starts with inventory and classification. It continues through ownership, data governance, human review, literacy, monitoring, exceptions and decision rights. It ends with board-level evidence that the institution can explain how AI is used and how it remains controlled.

The right board question is therefore not whether AI is being used. It is whether the board can rely on the answer it receives. And reliance requires evidence.