As AI systems take on greater decision-making roles, financial institutions face mounting pressure to redefine accountability, governance, and risk frameworks. Gerry Kounadis warns that boards cannot delegate responsibility, even as regulators move to tre
As artificial intelligence systems
evolve from analytical tools into active decision-makers, financial
institutions are facing a fundamental shift in governance and accountability.
According to Gerry Kounadis, Director
of Data Privacy, Tech and ESG Compliance Advisory at National Bank of Greece,
the rise of agentic AI is forcing boards and executives to confront the limits
of delegation.
Speaking ahead of CeFPro’s Vendor
Risk Europe event in June, Kounadis said: “Ultimate accountability must remain
with the board and senior management. “Fiduciary duties of oversight and
judgment are non-delegable and cannot be transferred to an AI vendor.”
This position comes at a time when
many organizations are increasingly reliant on third-party AI providers, often
deploying proprietary systems that operate as opaque decision engines.
While vendors may carry legal
responsibility for defects or failures under evolving regulatory frameworks,
Kounadis emphasized that accountability for deployment decisions remains firmly
with the institution.
“The company bears primary
responsibility for deployment decisions, while the vendor carries significant
responsibility for the model's integrity and compliance,” he said, noting that
the boundaries between the two are likely to be tested as regulation matures.
The growing reliance on a single AI
provider also introduces a new form of concentration risk, particularly in
highly regulated sectors such as financial services. Kounadis warned that
dependence on proprietary “black box” models can undermine transparency and
resilience if not properly governed.
“If an organisation cannot explain,
challenge, or replace a model, it should not rely on it for strategic
decision-making,” he said, outlining a principle that is rapidly gaining
traction among regulators.
To mitigate these risks, boards must
implement robust oversight mechanisms, including independent validation of AI
models, contractual rights to audit vendors, and clear documentation of
decision outputs.
Just as critical is the ability to
exit or substitute a provider if needed, ensuring that institutions are not
locked into systems they cannot control.
The question of where to draw the
line between decision support and decision replacement is becoming increasingly
urgent. Under European corporate law, the distinction is not merely theoretical
but carries legal implications.
