The second line of defense is the independent risk oversight function: the group that sets the standards the first line must meet, challenges its judgments, decides what may proceed and on what conditions, monitors the portfolio, and reports honestly to executive management and the board.
In credit, market, and operational risk that mandate is well understood and decades old, and the second line typically knows the discipline better than the business does. AI inverts that knowledge gradient. The first line often understands the system better than the second line, because they built it, ran the evals, and know where it is fragile.
If the second line cannot engage at that level, independent challenge becomes ceremonial: people nod, sign the form, and carry on. Technical depth in a second-line AI function is therefore not a nice-to-have but the precondition for the line existing at all.
Most organizations are inventing this mandate in real time, with no rulebook to inherit, and this article is about constructing it deliberately rather than letting it accrete by accident.
Why the Existing Model Risk Rulebook Does Not Simply Transfer
For fifteen years, model risk management in financial services was shaped by supervisory guidance built around a particular conception of a model: a statistical or mathematical construct with defined inputs, a specified methodology, and measurable outputs, which could be validated by testing conceptual soundness, verifying implementation, and monitoring ongoing performance. That framework was well designed for what it governed.
Generative and agentic systems break several of its foundational assumptions:
1. They are general-purpose rather than task-specific
A traditional model has one job. A foundation model has as many jobs as people can think of prompts for. Validating it for one use tells you very little about another.
2. They are non-deterministic
Identical inputs may produce different outputs. Validation cannot rest on reproducibility in the way it once did.
3. The specification is often absent
There is frequently no documented methodology to assess for conceptual soundness: the behavior emerged from training rather than being designed.
4. They are frequently third-party and opaque
The organization does not own the weights, the training data, or the release schedule. The model can change beneath a validated application.
5. Agentic systems act
This is the decisive break. A traditional model produces a number that a human then uses. An agent takes actions in the world: calling tools, writing to systems, sending communications, triggering downstream effects. Governing an output is a fundamentally different problem from governing an action.
For institutions supervised in the United States, this gap became explicit rather than theoretical when the supervisory guidance that had governed model risk since 2011 was superseded in April 2026 by new guidance that does not bring generative and agentic AI within its scope.Elsewhere, the European framework sequences differently, with transparency obligations covering AI-generated content taking effect in August 2026 while the substantive high-risk obligations sit further out. State-level activity in the United States continues to move independently, and no federal preemption has been enacted.
The practical consequence is the same in every jurisdiction: the rules are arriving more slowly than the technology. An organization that waits for a rulebook will deploy for years without one. The second line's first act of leadership is therefore to author the internal standard: a defensible, documented framework that anticipates where regulation is heading rather than trailing it.
The Mandate Outside Banking
A great deal of AI governance writing assumes a bank and therefore assumes a prudential supervisor whose expectations organize the whole program. Most organizations deploying AI are not banks and have no such supervisor.
The mandate has to be justified on different grounds, and those grounds are not weaker, in several respects they bite harder:
1. Client contractual assurance
Enterprise clients increasingly require documented AI governance as a condition of doing business. The framework is what makes the contractual representation true, and the diligence questionnaire answerable.
2. Transparency obligations on AI-generated content
Where content is produced or materially assisted by AI, disclosure requirements now apply in major jurisdictions. This is an operational obligation requiring provenance tracking, not merely a policy statement.
3. Accuracy as an existential brand risk
For any organization whose product is information (data, news, analytics, research), the accuracy of what goes out the door is the franchise. A fluent, confident, wrong answer at scale is not an embarrassment; it is a direct threat to the reason clients pay.
4. Intellectual property and litigation exposure
Training data provenance, output similarity to protected works, and contractual indemnities create legal risk that no prudential regulator needs to raise for it to be real.
5. Employment, privacy, and consumer-facing obligations that apply to AI-assisted decisions regardless of industry
Employment, privacy, and consumer protection law attach to the decision and its effect on a person, not to the technology used or the industry applying it. An AI system that screens candidates, processes personal data, or determines what an individual is offered carries those obligations whether or not any supervisor is watching.
Framing the mandate around these drivers rather than around examiner expectations produces a program that is better fitted to the actual risk.It also makes the case to executives in terms they already care about, revenue, contracts, franchise, and litigation, rather than in terms of compliance for its own sake.
The Six Components of the Mandate
A second-line AI risk mandate needs six components, each explicitly granted and documented. Ambiguity in any of them is where programs fail.
1. Standard-setting authority
The second line owns the enterprise AI risk policy, the tiering rubric, the minimum control requirements per tier, and the definitions. If the first line can negotiate the standard case by case, there is no standard.
2. Independent challenge
The right and the obligation to question the first line's risk assessments, evaluation results, and control design, with access to the underlying evidence rather than a summary of it.
3. Approval and veto authority
The power to decide that a system may not proceed or may proceed only on conditions. A function that can advise but not decide is a consultancy, not a control.
4. Portfolio monitoring
Continuous visibility across every registered AI system: coverage, tier distribution, condition compliance, incidents, drift, and concentration.
5. Escalation rights
A defined, unobstructed path to a risk committee and ultimately the board, which the first line cannot block or filter.
6. Independent reporting
A reporting line that does not run through the business whose work is being challenged.
Independence Is Structural, Not Behavioral
Independence is often discussed as a quality of character. It is better understood as a property of structure. Four tests reveal whether it genuinely exists.
1. The reporting line test
Does the head of AI risk report through the chief risk officer, or through the technology or product organization whose work is under review? If a person's compensation and promotion depend on the executive whose initiative they must sometimes block, independence is nominal.
2. The budget test
Is the function resourced independently, or from the delivery budget of the programs it oversees?
3. The veto test
Has the function actually stopped or materially conditioned something significant? A function that has never said no has either governed nothing consequential or has been quietly overruled.
4. The access test
Can it obtain evaluation results, logs, and system documentation directly, or only what the first line elects to share?
5. The credibility test
This is a subtler test that matters specifically for AI: A second line that cannot read an evaluation report, interrogate a retrieval pipeline, or reason about what an agent's tool permissions actually allow will be politely briefed and comprehensively bypassed. Technical depth is not a nice-to-have in this function; it is a precondition of the challenge being effective. Governance without technical credibility gets routed around.
The Two Failure Modes
Programs fail in one of two directions, and the second line must hold a position between them.
1. Enablement without teeth
The function educates, advises, publishes guidance, and runs an intake process, but has never conditioned or blocked anything. It is popular, and it provides no assurance whatsoever. When an incident occurs, the documentation will show that everything was reviewed and nothing was ever challenged.
2. Control without credibility
The function issues policy from a distance, treats every use case as high risk, and cannot engage with technical detail. The business responds by routing around it: building in unregistered corners, describing systems in terms that avoid triggering review, or simply not asking. The perimeter looks well governed and describes a shrinking fraction of reality.
The Middle Position
The middle position is a function that is technically fluent enough to be respected, independent enough to be trusted, and proportionate enough that the business brings it problems early rather than late. Proportionality is what makes that possible:if every use case receives the same scrutiny, the scrutiny is either too heavy for low-risk work or too light for high-risk work. Tiering, the subject of the next article, is the mechanism that makes proportionality operational.
Establishing the Mandate in Practice
A new second-line AI function should sequence its first months around building the mandate rather than exercising it prematurely.
1. Establish visibility first
Before setting standards, find out what exists. An inventory built through amnesty rather than enforcement produces a truer picture than one built through mandate.
2. Publish the standard and the tiering rubric
Make the rules knowable and stable so the first line can design against them rather than guess.
3. Stand up the gate for high-tier systems only
Begin where the risk concentrates. Extending scope downward later is straightforward; recovering credibility after an early reputation for indiscriminate obstruction is not.
4. Instrument the program
Define the indicators, coverage, tier distribution, condition compliance, incidents, from the beginning, because the mandate will eventually have to be justified with evidence of its own effectiveness.
5. Establish the escalation path and use it once, early
An escalation route that has never been exercised is untested. The first genuine escalation defines whether the function is real.
The mandate, in the end, rests on a single proposition: that someone independent of delivery must be able to look at an AI system and say not yet, and here is the bar. Everything else, the rubric, the gate, the monitoring, the reporting, exists to make that sentence credible, evidenced, and enforceable. The next article turns to the foundation it all depends on: knowing what you actually have.
Explore more: Start Here · Topics · Archive · About