Every financial institution deploying AI eventually meets the same question from an examiner: show me how this model reached that decision. The institutions that can answer cleanly keep moving. The ones that cannot spend the next eighteen months in remediation.
Explainability is a requirement, not a feature
Under existing fair-lending law, a lender must be able to state the specific, principal reasons for an adverse action. A model that cannot produce those reasons is not merely opaque, it is non-compliant. This is why traceable, attribution-based models matter more than raw predictive accuracy in a regulated context.
- Adverse-action reasons that map to real, disclosable factors
- SHAP-style attribution so each decision carries its own explanation
- Disparate-impact testing run continuously, not annually
- Immutable audit trails on every model version and every override
Governance the board can defend
Model risk management guidance, SR 11-7 remains the reference point, expects documented development, independent validation, and ongoing monitoring. AI does not change these obligations; it raises the stakes because models retrain and drift. A static validation from two years ago describes a model that no longer exists.
The safest AI program is one where a regulator, a rating agency, and a borrower would each get the same honest answer to the question: why?
The build-versus-buy calculus
Most community institutions cannot staff a dedicated model-risk function. That is a strong argument for shared, pre-validated infrastructure where the compliance scaffolding (audit logging, attribution, access control, disparate-impact monitoring) is built into the platform rather than bolted on by each institution independently.
Compliance done well is not a tax on innovation. It is the thing that lets a small institution adopt AI at all without betting its charter on it.
