Good AI Governance Is Measured at the Counter, Not the Board
By Professor Ashley Braganza
A bank can hold impeccable AI principles and still fail to convince the customer standing at the counter about the bank’s AI adoption. The distance between a governance framework written for regulators and a customer's simple question, is this safe, is where trust in AI is won or lost. In financial services that distance is the whole game, because a bank's stock in trade is not money, it is trust. Govern AI as a compliance document and you protect the committee. Govern it as an operational discipline and you protect the customer. The financial services companies that grasp this are not writing better principles, they are wiring governance into the places where customers actually meet staff and the technology.
My guest on The AI Adoption Podcast is Dr Paul Dongha, Head of Responsible AI and AI Strategy at NatWest Group, who holds a PhD in agentic AI and once co-chaired the AI ethics board at Lloyds. He spends his days on the machinery that turns AI principles into practice inside Nat West. Three of his choices repay close attention, and each pulls governance out of the strategy deck and into the working day.
One standard everywhere beats a standard per jurisdiction
NatWest holds its AI systems to the EU AI Act wherever they operate, in the UK, the EU and North America. Paul is candid that this is a deliberate simplification. The EU AI Act sorts AI into four tiers, from prohibited through high, medium and low risk, and its reach is extraterritorial: a bank domiciled anywhere must comply once any of its customers are EU citizens. A firm could, in principle, run a different risk regime in each territory. Paul's judgement is that doing so multiplies the work and the room for error. Hold each system to a single demanding standard, and a model built in the UK can move into the EU with nothing further to prove. Banks that keep different regimes in different places must repeat the risk assessment every time a system crosses a border, and track precisely where each one runs. The saving is not glamorous, it is operational, and it compounds. A bank forced to reprove the same system in three jurisdictions is spending on duplication what it could spend on the systems themselves. One high bar, applied once, is the more disciplined choice, and it is a choice more banks will face as their AI agents spreads across borders.
The ethics that matter cannot be computed
The second choice is an Ethics Panel that argues and debates AI designs and deployments. Paul chairs a group drawn from across NatWest whose task is to challenge each AI use case while it is being designed, probe it for hidden bias or exclusion, and recommend controls before anything is deployed. The panel is advisory, and it works alongside the risk teams daily rather than sitting in judgement above them. Its authority comes from the mix of people in the room, each reading a use case for the way it might harm a customer the designers never pictured, whether through bias, exclusion, or service that does not fit a vulnerable person's needs. The power of the panel, Paul says, is in that diversity, a range of people drawn from across the bank, each bringing a different vantage on where a use case might go wrong. Here is the complication Paul does not dodge. This is deliberately not a formula. Trade-offs between customers, staff, shareholders and regulators are settled by reasoned debate against the bank's stated values, and in his words the decisions are "not computational. You can't apply a formula." That is a strength when the questions are hard and have no clean answer. It is also a constraint. Reasoned debate depends on who is in the room, it takes time, and it does not obviously scale as AI use cases multiply. A panel that argues each case well is a real safeguard; on its own, it is not a mechanism that keeps pace with volume, and Paul is honest that these questions have no clear-cut answers.
Governance is proved at the front line
The third choice reaches the people furthest from the model. Persona-based training runs across the bank, tailored to the role: a data scientist learns the tools that test a system for unfair bias before it ships, a legal colleague learns to spot a hallucination, and a branch colleague who may never open an AI tool learns enough to answer a customer who asks how the bank uses AI. That last case is the one that decides trust. A customer's confidence is built or broken in an ordinary exchange at the counter, not in a governance document they will never read. Literacy of this kind is practical, not abstract: staff learn to be critical of what an AI returns, and not to put confidential data into a large language model. This is also where the technology claim deserves scrutiny. Paul describes agentic AI as able to run complex, multi-step workflows with autonomy, kept in check by human-in-the-loop oversight and guardrails that block toxic output and data leaks. Whether human oversight can meaningfully supervise an agent that plans and acts across many steps faster than a person can follow, rather than merely approving what it has already done, is an open question. Persona training raises the floor of literacy across a bank, and that is worth doing on its own terms. It does not, on its own, settle whether the humans in the loop are governing the agents or watching them.
Trust is the asset a bank actually sells
Strip away the products and a bank's real inventory is trust, the customer's confidence that their money and their financial life are in safe hands. Paul is direct that this is what AI governance exists to protect. AI can deepen that trust through more personal service, and it can corrode it through a single visible failure, a leaked record or a decision no one can explain. The practical implication for leaders is that governance cannot live only in the risk function. It must be visible to the customer, legible to the branch colleague, and defensible in plain language. A bank that publishes an AI code of conduct, trains its people to speak to it, and can name who is accountable when a system errs, is doing something a policy document alone cannot. Trust, on this reading, is not a communications exercise laid over the technology; it is the outcome of governance a customer could see if they looked. On this evidence, the institutions that treat AI governance as a customer-facing discipline, not an internal control, are the ones whose trust will survive the technology's mistakes. That is the standard I put to the boards and senior teams I work with: not whether your AI is governed, but whether your customer would believe it.
The harder test comes as autonomous agents take on more of the work. Governance that depends on a human reading each decision, a panel debating each case, and a colleague explaining each system is coherent while the volume is human scale. As agents multiply, each of those safeguards meets a question of pace. A person can read a decision; an agent can generate far more of them than any person can read in the same time. The bank that can still explain to a customer at the counter, who is accountable when an agent acts, is the one that will keep the trust the others lose.
Listen to the full conversation
The AI Adoption Podcast with Professor Ashley Braganza.
Comments