Beyond Basel at #RISK London: why AI governance must run at machine speed, plus five board questions. Read now.
London, November 2026: How do you stay in control when decisions move faster than your oversight? That was the question we kept coming back to on the BFSI Stage. Basel set the baseline for capital. What comes next is governing decisions that AI and models now make faster than any committee can meet.
I was delighted to share the stage with Chris Brown of Capgemini Invent, who moderated, and Oliver Greenslade, Chief Risk Officer at Channel Capital Advisors.
The session at a glance
- Event: #RISK Europe, ExCeL London
- Date: Tuesday, 10 November 2026
- Session: Beyond Basel: next-generation risk management for BFSI leaders
- Stage: BFSI Stage
- Moderator: Chris Brown, Capgemini Invent
- Panel: Oliver Greenslade, Channel Capital Advisors; Andrew McIntyre, CRISAM®
What did the room tell us?
Halfway through, we asked everyone to stand up, then sit down as soon as their honest answer was “no”:
- Your organisation uses AI or models to make or support decisions.
- You could list every decision AI or models make in your organisation today.
- Every one of those decisions has a named owner who knows they own it.
- Those decisions are checked against your risk appetite before they are made, not after.
- If a model breached appetite at 9am today, your board would know by 9.15.
Almost the whole room stood for the first question. By the fifth, very few were still on their feet.
That is not a sign that these organisations lack governance. Most have policies, committees and monitoring in place. The point is that governance was built for periodic, human decision making, and it is not yet connected to decisions at the speed they now happen.
Why is quarterly governance no longer enough?
Most boards still see risk once a quarter: a risk map, a green dashboard, perhaps some quantitative analysis of what a risk would cost if it happened. That rhythm worked when decisions moved at human speed.
AI is not going away. It is already built into how our businesses run, and increasingly into the products and services our third-party vendors provide to us. A risk and control self-assessment sent out once a quarter cannot keep up with that. Neither can an audit team checking once a year that everything is still as it was.
We do not need to start from scratch. We already live by frameworks. Regulators check them, and audit teams test against them. What has to change is that those frameworks become live: watched continuously, with a human in the loop who is alerted the moment an AI system moves outside the tolerances that have been set, and who has the authority to step in.
“We can’t wait for regulation to help us. We can’t wait for the assurance teams to assure. We need a framework that lets you see AI live.”
What we discussed on stage
Together with Chris and Oliver, we looked at the question from several angles: the view from the CRO’s seat, how AI guardrails are set and kept up to date, and who stays accountable when a model makes the call.
My own view: human judgement should not sit at the end of the process, reviewing decisions after they are made. At machine speed, thousands more have gone through by the time anyone looks. Judgement belongs at the front, setting and owning the boundaries, and at the edges, handling the exceptions that fall outside them.
AI and ethics: where does the board’s duty of care sit?
Some of the sharpest questions came from the floor, and several of them were about ethics.
Some companies have taken AI as a reason to cut roles such as paralegals or compliance officers, only to bring people back months later because the guardrails those people provided were missing. Efficiency is a legitimate goal. But boards also carry a duty of care to the people whose careers built the business, and that balance belongs on the board agenda, not only in the business case.
Recruitment shows how close this already is. Graduates now send applications by the thousand, and many of those CVs are screened by AI before a person ever reads them. That raises questions every board should be able to answer:
- Fairness: Who taught the system what a fair decision looks like?
- Accountability: Who is accountable when it gets one wrong?
- Visibility: How would the board know it had happened?
The answer is not to fight the change. It is to govern it, so that ethical boundaries are set, owned and monitored like any other risk.
How can boards decide without loss data?
Another question went to the heart of it: how can a board delegate authority over AI when it may lack the expertise itself, and when it is used to a quarterly operating rhythm?
Insurance shows how hard this is. Imagine a travel policy that covers skiing. If insurers had no data on how many skiers get injured, they would stop covering it. That is where much of the insurance market now stands with AI: without loss data, insurers are reluctant to underwrite the risk.
Boards are in the same position. There is no history to price the risk against yet. What a board can do is make sure the right expertise sits in the business, set clear boundaries for what AI may decide, and see live whether those boundaries hold.
AI governance, not another AI-powered platform
Many GRC tools now advertise AI features. That answers a different question. A risk team does not mainly need more AI. It needs to prove that the AI already running across the business, its own and its vendors’, is under control.
That is the gap CRISAM® addresses. CRISAM® has worked in governance, risk and compliance for 25 years, in highly regulated industries. We have built a framework for governing AI and the software to run it. It brings together:
- AI signals
- Tolerance levels
- Named owners
- Risk appetite
- Risk dashboard
- Board report
It does not replace a firm’s models, data platforms or monitoring. It connects them to the risks, controls and owners that make each decision defensible.
What does this mean for risk leaders?
The room confirmed what the wider market is saying. In the FERMA and PwC Global Risk Manager Survey 2026, 46% of risk managers named AI use as the risk they treat least adequately, ten points more than any other risk (PwC).
I have helped industries through this kind of shift before. Aviation did not respond to busier skies by making aircraft slower. It built air traffic control, so every flight is visible, kept within approved boundaries and can be interrupted by a person with the authority to act. Speed was never the enemy. Uncontrolled speed was.
That is what we mean at CRISAM® by machine speed governance. Every material AI-enabled decision is identified, given an approved purpose and boundaries, watched as it happens and recorded, with an authorised human always able to step in. Firms that do this can show a regulator where their AI models are, what they do, how they are controlled, who is responsible and how they can be stopped in time. And they are in a far better position to create value from AI, rather than simply carry its risk.
Five questions to take to your board
- Could the board explain why a material AI-enabled decision was permitted?
- Can it show which risks, obligations and controls applied?
- Is the supporting evidence current and traceable?
- Is there a named person with tested authority to pause or stop the decision?
- Could these answers be produced without a manual reconciliation exercise?
If any of those answers is uncertain, that is where the conversation starts.
My thanks to Chris and Oliver for a lively and honest discussion, to everyone who asked such sharp questions from the floor, and to the #RISK team for hosting us. Whether you were in the room or not, I would welcome your view: who in your organisation is accountable for governing AI-enabled decisions at the speed they are now made?
Andrew McIntyre, Director of Sales, UK, Nordics & Benelux, CRISAM®
Frequently asked questions
What was the Beyond Basel panel at #RISK London about?
The panel on 10 November 2026 on the BFSI Stage discussed how risk management in banking and financial services has to change when AI and models make decisions faster than committees meet. Chris Brown of Capgemini Invent moderated; Oliver Greenslade of Channel Capital Advisors and Andrew McIntyre of CRISAM® were on the panel.
What does machine speed governance mean?
Every material AI-enabled decision is identified, given an approved purpose and boundaries, watched as it happens and recorded, with an authorised human always able to step in. Governance runs continuously instead of once a quarter.
Does CRISAM® replace existing AI models or monitoring tools?
No. CRISAM® does not replace a firm’s models, data platforms or monitoring. It connects them to the risks, controls and owners that make each decision defensible.
Why is AI a governance topic for the board?
Accountability does not move to the machine. In the FERMA and PwC Global Risk Manager Survey 2026, 46% of risk managers named AI use as the risk they treat least adequately. Boards need to be able to show who owns each AI-enabled decision and how it can be stopped.
Would you like to get to know us?
