As AI evolves from a passive tool into increasingly autonomous systems, banks must move beyond AI literacy to develop genuine AI fluency. Chris Smigielski argues that people, governance and continuous learning will determine whether institutions can innovate responsibly while managing the emerging risks of agentic AI.
As artificial intelligence becomes
embedded across financial services, competitive advantage will depend less on
access to technology than on the ability of people to use it responsibly.
AI literacy alone is no longer
sufficient. Institutions must develop genuine AI fluency across all three lines
of defense if they are to govern increasingly autonomous systems, manage
emerging risks and ensure innovation strengthens rather than undermines
resilience.
That was the central argument
presented by Chris Smigielski, Model Risk Director at Arvest Bank and CeFPro
Advisory Board Member, who urged delegates at CeFPro’s 2026 Risk Americas
conference to treat AI capability as a people challenge rather than simply a
technology initiative.
Smigielski described AI as a
transformational force that is evolving too quickly for organizations to rely
on traditional governance alone.
While AI has dominated industry
discussion over the past two years, he argued that the conversation must now
move beyond deployment and focus on ensuring employees possess the knowledge
required to oversee increasingly sophisticated systems.
"Transition breeds opportunity,
innovation," he said. "When things are changing, that's our
opportunity to step in and make a contribution."
His presentation stemmed from two
observations. First, he recalled a previous conference discussion where a
speaker described "a well-trained user" as the strongest control
available against emerging threats.
Second, he pointed to CeFPro's Global
Risk Outlook survey, where AI and emerging technology ranked among respondents'
top concerns, yet talent and skills achieved even greater consensus as a
critical risk.
The combination led him to a simple
conclusion: organizations cannot govern AI effectively without investing in
people first.
Smigielski argued that the rapid
evolution from prompt-based large language models to autonomous AI agents
fundamentally changes the risk landscape.
Traditional generative AI responds to
user instructions, but agentic AI increasingly executes multi-step workflows
independently.
That introduces new risks including
cascading failures, goal misalignment, reward hacking and autonomous behavior
occurring at machine speed rather than human speed.
Illustrating the point, he described
how a flawed AI agent could propagate errors throughout connected systems
before anyone realizes a problem exists.
"The risk of that compared to
the single ChatGPT is that you can have rogue agents, cascading failures, and
the error propagation is in nanoseconds," he said.
Rather than viewing these
developments as reasons to slow innovation, Smigielski encouraged institutions
to strengthen governance using existing frameworks adapted for the AI era.
He highlighted updated model risk
guidance while acknowledging that traditional model governance is not always
the best fit for generative and agentic AI.
Instead, he advocated complementing
model risk management with the NIST AI Risk Management Framework, built around
mapping AI inventories, measuring risk, implementing controls and establishing
clear governance responsibilities.
Importantly, he rejected the notion
that AI governance belongs to a single department.
"It's a team sport now," he
said, describing collaboration across compliance, model risk, information
security, technology and other business functions as essential to managing AI
responsibly.
