AI Governance at Scale: Navigating Risk, Regulation, and Geopolitics

Watch the full keynote video at the bottom of this article.

At this year's Yields Innovate, Ratul Ahmed, Group Head of Model Risk Management & Validation at Commerzbank, took the stage to address one of the most pressing challenges facing the financial sector today: scaling AI safely. During her presentation, titled "AI Governance at Scale: Navigating Risk, Regulation, and Geopolitics in a Rapidly Changing World," Ratul challenged the traditional view of model risk management and argued for a fundamental shift in how organizations handle artificial intelligence.

Instead of merely discussing the democratization of AI, Ratul passionately advocated for the democratization of AI governance. For organizations to truly harness AI's potential, she argued, the responsibility of governance must extend far beyond the isolated silos of risk management teams.

‍

The AI Race is a Sovereignty Story

Ratul emphasized that the global rush toward AI is no longer just a technology story; it is increasingly a "sovereignty story" heavily influenced by geopolitics. She highlighted the stark contrast between global AI strategies:

• The United States is currently defined by hyperscaler dominance and initiatives like the CHIPS Act.
• China relies on highly effective, state-directed AI development at an immense scale.
• Europe has responded with the EU AI Act, which Ratul described as the most comprehensive regulatory framework on earth.

While the EU AI Act sets a gold standard for safety, Ratul warned that Europe faces the very real risk of becoming both the most governed and the least competitive region simultaneously.

The AI Adoption Gap and the Cost of "Ungoverned AI"

Despite massive financial investments, enterprise AI adoption is hitting a wall. Citing a Gartner study, Ratul noted that while the average company invested $1.9 million in generative AI projects in 2024, fewer than 30% of CEOs were actually satisfied with the returns.

Companies are eagerly throwing money at AI solutions without having the necessary infrastructure in place to deploy them safely, accountably, or at scale. This has led to two distinct enterprise challenges:

• Institutions that build fast and loose are accumulating significant "AI debt" and relying heavily on ungoverned AI, which will inevitably conflict with incoming regulations.
• Institutions that govern too slowly suffer from paralysis regarding AI use cases and risk watching their competitors rapidly pull ahead.

The Commerzbank Blueprint: The "AI Mesh"

Ratul shared practical insights from Commerzbank’s own journey, detailing how they launched a generative AI avatar for retail clients in 2024, making them a first mover among European banks. To navigate the regulatory and reputational risks of such an undertaking, Commerzbank relies on an "AI mesh" framework.

This mesh establishes loose but widespread control and awareness across various departments, including HR, ICT, and the business lines, ensuring everyone understands upcoming regulations like the EU AI Act. By educating product owners on regulatory compliance and classification, accountability is pushed back to the first line of defense rather than being bottlenecked at the validation stage.

During the Q&A, Ratul also touched on the importance of practical stress-testing. She noted that they actively introduce their workforce to "white hacking" events, encouraging employees to creatively prompt and attempt to break the bank's AI systems to uncover vulnerabilities before deployment.

From Checkpoint Masters to Co-Creators

A central theme of the keynote was the cultural perception of model risk managers, who often feel like the "tail wagging the dog" within their organizations. AI governance is frequently treated as a taboo subject by executives who hope it will simply happen seamlessly in the background.

To fix this, Ratul insisted that validation teams must evolve their mindsets. If incentive structures only reward risk teams for catching failures at the very end of a project, validators will inevitably act as permanent blockers to innovation. Instead, Ratul urges risk professionals to shift into advisory roles.

Validators need to be brought to the table early on, transitioning from being reviewers who say "no" to partners who say, "yes, this is how we can do it safely". They must transform from checkpoint masters into true co-creators.

Conclusion

Ratul closed her keynote with a stark warning for organizational leaders: the adoption gap is growing rapidly. The question is no longer whether your organization will eventually take AI governance seriously, but rather whether you will choose to do it proactively or wait until something goes terribly wrong.

You can watch the full keynote here: