AI Governance for LatAm Banks: What EBA 2026 Actually Requires

The EBA Guidelines on Internal Governance (EBA/GL/2021/05) were updated in January 2026 to include explicit requirements for AI risk management in credit institutions. The guidelines are formally a European instrument — they bind EBA member states directly. Their relevance to LatAm banks is indirect but significant: they define the operational standard that globally-minded boards, international investors, and correspondent banking counterparties now use as a reference when evaluating AI governance maturity.

What EBA 2026 actually requires

The January 2026 EBA guidelines added three new provisions to the existing internal governance framework specifically addressing AI systems used in material decisions — defined as decisions that affect credit access, fraud detection, pricing, or customer eligibility. The provisions are organized around five requirements:

Article 76a — Model inventory. Institutions must maintain a comprehensive inventory of all AI models used in material decision processes, including: the model's purpose, the data it was trained on, its last validation date, its governance owner, and its risk tier. The inventory must be accessible to the board's risk committee and updated whenever a new model is deployed or a material change is made to an existing one.

Article 76b — Risk tiering. Models must be classified into risk tiers — EBA uses a three-tier framework: Tier 1 (high-risk: credit decisions, fraud scoring for amounts above a threshold, regulatory capital models), Tier 2 (medium-risk: customer segmentation, product recommendations, collections scoring), Tier 3 (low-risk: internal process automation, back-office models). Tier 1 models require annual independent validation, board approval for deployment, and a documented fallback procedure. Tier 2 requires annual internal review. Tier 3 requires periodic review with no mandatory frequency.

Article 76c — Governance body. Material AI deployments must be approved by a designated governance body — not the technology team alone. EBA specifies that the governance body must include the CRO or equivalent, must have access to model documentation, and must explicitly approve the model's intended use case and its risk tier assignment before production deployment.

Article 76d — Monitoring protocol. Deployed models must be monitored for performance drift, bias, and data quality degradation on a defined schedule. Tier 1 models require monthly monitoring reports with predefined alert thresholds. When an alert threshold is crossed — for example, model accuracy drops by more than 5 percentage points versus baseline — an automatic escalation is triggered and the model enters enhanced review until resolved.

Article 76e — Incident reporting. Material AI incidents — model failures that result in erroneous credit decisions, fraud losses attributable to model failure, or regulatory findings related to AI use — must be reported to the board risk committee within 72 hours and to the regulator within 15 business days. EBA defines "material" as any incident affecting more than 1,000 customers or involving a financial impact exceeding a defined threshold.

How this translates to LatAm

LatAm regulators have not adopted the EBA guidelines verbatim. But three of the five elements have direct equivalents in existing local frameworks, and the other two are on regulators' stated agendas for 2026.

The model inventory (76a) is implicitly required by CNBV's model risk management framework (Circular Única Bancaria, Título 1, Capítulo VIII) and by BCB Resolution 4.557 for models used in credit risk. CNBV has not specified a format, which means many banks have model inventories that are incomplete, inconsistently maintained, or inaccessible to the board. EBA 76a provides a concrete format that satisfies both local requirements and international standards.

Risk tiering (76b) is not explicitly required by CNBV, BCB, or SFC Colombia in AI-specific terms. However, CNBV's Disposiciones de Carácter General Aplicables a las Entidades de Ahorro y Crédito Popular (2023 update) requires risk categorization for credit models, which is the functional equivalent for the most material use case. The EBA three-tier framework can be implemented in a LatAm bank as a voluntary internal standard that simultaneously satisfies local requirements for credit models and prepares the institution for likely regulatory expansion.

The governance body requirement (76c) is where most LatAm banks are furthest behind. Technology teams routinely deploy AI models in production without CRO sign-off or formal board notification. This is not a compliance gap yet — but it is a governance gap, and it is the gap most likely to generate a regulatory finding when AI-specific guidance arrives. The AI Governance Framework for Banks includes a board-ready governance policy document and RACI matrix that closes this gap with a single board resolution.

The five minimum elements for a LatAm AI governance framework

Based on the EBA 2026 requirements, existing LatAm regulatory frameworks, and the BCBS principles on model risk management (2011, updated 2022), the minimum AI governance framework for a LatAm bank consists of five elements:

The 90-day implementation roadmap

A bank starting from a governance gap — no formal AI risk committee, incomplete model inventory, no board policy — can reach a defensible governance posture in 90 days. The sequence matters because element 3 (governance body) must exist before elements 4 and 5 can be properly owned.

At day 90, the bank has: a board-approved AI risk policy, a functioning governance body, a complete model inventory, monitoring plans for material models, and a tested incident response procedure. This is the foundation that satisfies EBA 2026 elements, fulfills LatAm regulatory requirements for model risk management, and gives the board a defensible answer to "how do we govern AI?"

The AI Governance Framework for Banks provides the policy document, model inventory template, RACI matrix, board report template, and Q&A prep for the board questions that follow — specifically the EU AI Act, BCBS, and EBA questions that internationally-informed directors will ask. The AI Adoption Scorecard v2 provides the self-assessment tool that allows the bank to measure its current AI maturity against the governance framework requirements before the first board presentation.

The question that will be asked

The question that every board will eventually receive — and that many have already started receiving from audit committees, international correspondents, and regulators — is: "Who approved the AI model you are using to make credit decisions, and what oversight does the board have over its performance?"

The answer that satisfies a well-informed board is not "the technology team approved it" and not "we use a vendor model and they are responsible." The answer is: "The AI Model Risk Committee approved the model under our board-approved Risk Tier Policy. It is classified as Tier 1, validated annually, monitored monthly against defined performance thresholds, and any material incident would be reported to this committee within 72 hours." That answer requires the five elements above to be in place. It does not require them to have been in place for years — only that they exist, are functional, and can be demonstrated.