--- title: "AI Strategic initiative series: Building an AI Governance Framework - Key Takeaways from the NYC Workshop" description: The FINOS community’s answer is the open‑source AI Governance Framework (AIGF)—a vendor‑agnostic, collaboratively maintained set of risks and controls that any FSI can plug into its existing three‑lines‑of‑defence model. image: https://www.finos.org/hubfs/Community%20Blog/2025-05-23%20-%20Building%20an%20AI%20Governance%20Framework%20%E2%80%93%20Key%20Takeaways%20from%20the%20NYC%20Workshop-2.png --- [![FINOS](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/finos-logo.png?width=543&height=126&name=finos-logo.png "FINOS")](https://finos.org) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) ![Community Blog](https://www.finos.org/hubfs/10.04.19.FINOS_WebsiteBanners_3.png) # Community Blog # AI Strategic initiative series: Building an AI Governance Framework - Key Takeaways from the NYC Workshop May 23, 2025 [Luca Borella](https://www.finos.org/blog/author/luca-borella) ### **Setting the Scene – From Washington to Wall Street** In our previous instalment, we followed FINOS Technical Project Advocate **Karl Moll** to the U.S. [SEC’s AI Roundtable](https://www.finos.org/blog/navigating-the-ai-frontier-in-finance-insights-from-the-sec-roundtable) in Washington, D.C. The consensus there was clear: **robust, risk‑based AI governance is now a board‑level imperative** for every financial‑services institution (FSI).  ![2025-05-23 - Building an AI Governance Framework – Key Takeaways from the NYC Workshop-2](https://www.finos.org/hs-fs/hubfs/Community%20Blog/2025-05-23%20-%20Building%20an%20AI%20Governance%20Framework%20%E2%80%93%20Key%20Takeaways%20from%20the%20NYC%20Workshop-2.png?width=452&height=253&name=2025-05-23%20-%20Building%20an%20AI%20Governance%20Framework%20%E2%80%93%20Key%20Takeaways%20from%20the%20NYC%20Workshop-2.png) Banks, brokers and asset managers are all wrestling with three deceptively simple questions: 1. **What do we mean by “AI”?** 2. **Who is accountable when models misbehave?** 3. **How can existing risk frameworks be extended to cover AI‑specific threats such as hallucinations, data leakage or model drift?** The FINOS community’s answer is the **open‑source** [**AI Governance Framework (AIGF)**](https://air-governance-framework.finos.org/)—a vendor‑agnostic, collaboratively maintained set of risks and controls that any FSI can plug into its existing three‑lines‑of‑defence model.  ### **Inside the New York Workshop** On **13 May 2025** FINOS convened a hybridworkshop at Barclay’s Rise offices in New York City. More than **30** practitioners from various organisations spent the day: - Stress‑testing the **AIGF Draft Release** ([launched at OSFF NY in October 2024](https://www.finos.org/press/ai-governance-framework-release)). - Mapping **18 top‑level risk categories** (e.g. model bias, privacy leakage, operational failures) to **17 implementable controls** aligned to existing frameworks such as NIST RMF and OWASP. - Brainstorming on the **Common Controls for AI Services (CC4AI) initiative**: a common **evidence artefact format** so cloud providers and AI vendors can attest once, and every consuming FSI can inherit assurance. Deliverables from the session will feed into **AIGF v1.0**, scheduled for **public review at** [**OSFF London**](https://events.linuxfoundation.org/open-source-finance-forum-london/) **(24th June 2025)**. AIGF v1.0 aims to create a standard that fills the current regulatory uncertainty. ### **Regulatory Landscape – Diverging Paths?** **United States: Deregulation First** Since his inauguration in January 2025, President Trump has taken a deregulatory stance on AI by: - **Revoking Executive Order 14110** on “Safe, Secure and Trustworthy AI”. - **Issuing Executive Order 14179**  “Removing Barriers to American Leadership in AI”, which instructs agencies to roll back any measures that could “hamper innovation.” - Proposing a **ten‑year federal pre‑emption of state‑level AI laws**. While the direction is pro‑innovation, it leaves U.S (Global) FSIs with *even greater* uncertainty: without clear federal rules, supervisory expectations will likely be set through enforcement rather than guidance. **European Union: The AI Act Rulebook** Across the pond, the EU’s AI Act entered into force on August 1, 2024, as **the world's first comprehensive regulation for AI**, introducing risk-based rules that will be implemented in phases until August 2, 2027, and determine what kinds of AI systems and GenAI models can be placed on the EU market and how.  The regulation includes **limited exemptions for** AI systems and general-purpose AI (GPAI) **models** that are released **under a “free and open-source license”** (see the Foundation’s [guidance](https://linuxfoundation.eu/newsroom/ai-act-explainer?hss_channel=lcp-89681306)). On February 2, 2025, prohibitions for AI systems that pose unacceptable risk, such as those used for harmful deception or social scoring, began to apply. The next major date is **August 2, 2025, when obligations for providers of GPAI models will begin to apply**.  Earlier this year I chatted with Dr. Cailean Osborne, a Senior Researcher at Linux Foundation Research. He explained that the providers of GPAI models may demonstrate compliance with their obligations through voluntary adherence to the GPAI Code of Practice, which has been drafted by over 1,000 experts and was due to be published on May 2, 2025.  However,[**due to pushback from the US government**](https://www.mlex.com/mlex/articles/2331619/how-the-us-government-wants-to-rewrite-eu-s-code-of-practice-for-ai-models) **for being too prescriptive and misaligned with the AI Act,** among others, **the** [**Code of Practice was not published on May 2**](https://www.politico.eu/article/eu-deadline-artificial-intelligence-models-lobbying/) **and an adjusted version is likely to be released at a later date.** In any case, the obligations of providers of GPAI models, including ones released under free and open source licenses, will apply on August 2 with or without the Code of Practice.   The divergence creates friction for global banks: a single model may face *zero* mandated controls in New York but *hundreds* in Frankfurt! ### **On a positive Note: GenAI becomes *insurable*** “Risk comes from not knowing what you’re doing.” – Warren Buffett. The insurance market has noticed: - **Armilla's AI Chatbot Error Coverage**: [Armilla](https://www.armilla.ai/), a Y Combinator-backed startup, has introduced an insurance product underwritten by **Lloyd's of London** insurers. This policy covers companies for losses resulting from errors or malfunctions caused by AI chatbots, including legal costs and damages if a business faces claims due to underperforming AI tools. Notably, incidents like Air Canada’s chatbot inventing a discount highlight the potential for reputational and financial harm ([source](https://www.ft.com/content/1d35759f-f2a9-46c4-904b-4a78ccc027df?utm_source=chatgpt.com)) - **Munich Re’s aiSure™**: [Munich Re offers aiSure™](https://www.munichre.com/en/solutions/for-industry-clients/insure-ai.html#:~:text=What%20is%20Munich%20Re's%20aiSure,Contractual%20liabilities), a product that guarantees the performance of AI tools. If an AI system fails to deliver as promised, Munich Re backs the performance guarantee and compensates customers for financial losses. This coverage is available for various AI applications, including generative AI and large language models ([source](https://www.munichre.com/en/solutions/for-industry-clients/insure-ai.html?utm_source=chatgpt.com)) These offerings are early signals that quantifiable AI governance is maturing—exactly the gap the AIGF aims to fill. ### **Call to Action** Whether you are a risk officer, engineer, vendor or regulator: - **Review** the [current draft](https://air-governance-framework.finos.org/) and share your feedback by **raising** [**issues**](https://github.com/finos/ai-governance-framework/issues) or **propose** [**pull requests**](https://github.com/finos/ai-governance-framework/pulls). - **Not sure where to start?** Tackle these **“**[**good first issues**](https://www.finos.org/e3t/Ctc/RE+113/chmM804/VWBNV_86ZwjXW7SpzYZ3LSNhzW4YmM-15wkHy-N8XrLGM3qgyTW95jsWP6lZ3k_W2PWk9-48m_k-W3t6YpS279yh9W17QWfc6MwjLqW946Ws-21Lj5mW7dcngk3QdF1vW2rMlqq4b8xHlV3rGGy2h9FjnN96T-2FRhx3SW3sYRnN7tB22PVr1b673tJTM7W6Zxfcs81VKpkW2c6Xx172xZqNW38GZs0262wqBW3gHmj21Q9p61W4-2bVn2Dv_xLW6TP65m382nYxW52SDMJ1j2pB9W42Np8g3zv5vDW47rc8z7pdMFyW2N0_XR7LcP9cW1z5-P-4ZKQdXW5gxCSP8bhMw-W5sDXfm6jmK7XVk7bzx1PdXxfW96jTSD7NptgnVkHQ6W9dnrfFW4G7DXd63vHRhW5WYg0h13Dp53W7YkZCr83j30WW8CsQKQ5FGqw5f7KxH6d04)**”** - **Join** the next virtual AIGF working‑group call on [**4 June 2025**.](https://calendar.finos.org/) Together we can turn regulatory uncertainty into a *shared, open standard* for trustworthy AI in financial services.   *Author: Luca Borella, Program Manager, AI Strategic Initiative, FINOS*   **Interested in FINOS open source projects? Click the link below to see how to get involved in the FINOS Community.** [![Get Involved](https://no-cache.hubspot.com/cta/default/2419532/89037a0a-24fa-4ef5-bbf8-34d9a45ea1d3.png)](https://cta-redirect.hubspot.com/cta/redirect/2419532/89037a0a-24fa-4ef5-bbf8-34d9a45ea1d3)   [**FINOS Good First Issues**](https://github.com/search?q=org%3Afinos+is%3Aopen+label%3A%22good+first+issue%22&unscoped_q=is%3Aopen+label%3A%22good+first+issue%22) - Looking for a place to contribute? Take a look at good first issues across FINOS projects and get your feet wet in the FINOS community. [State of Open Source in Financial Services Report 2024](https://www.finos.org/state-of-open-source-in-financial-services-2024) - Learn about what is really happening around open source in FSI. [**This Week at FINOS Blog**](https://finos.org/this-week-at-finos?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See what is happening at FINOS each week. [**FINOS Landscape**](https://landscape.finos.org/?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See our landscape of FINOS open source and open standard projects. [**Community Calendar**](https://calendar.finos.org)- Scroll through the calendar to find a meeting to join. [**FINOS Slack Channels**](https://finos.org/blog/finos-announces-new-community-slack?utm_campaign=20210428%20-%20FINOS%20All%20Community%20Call%20-%20Q2%202021&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - The FINOS Slack provides our Community another public channel to discuss work in FINOS and open source in finance more generally. [**Project Status Dashboard**](https://metrics.finos.org/goto/7bfcb03f027a1406c997d731d4715ea7?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See a live snapshot of our community contributors and activity. [**Events**](https://finos.org/news-and-events?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - Check out our upcoming events or email [**marketing@finos.org**](mailto:marketing@finos.org) if you'd like to partner with us or have an event idea. [**FINOS Open Source in Finance Podcasts**](https://anchor.fm/finos) - Listen and subscribe to the first open source in fintech and banking podcasts for deeper dives on our virtual "meetup" and other topics.   ### Share this: - [Tweet](https://twitter.com/share) [← OS in Finance Webinar - The Unexpected Risks of AI in Finance: What You’re Not Watching Could Cost You featuring Sonatype & NVIDIA](https://www.finos.org/blog/os-in-finance-webinar-the-unexpected-risks-of-ai-in-finance-what-youre-not-watching-could-cost-you) [CDM New Horizons: Welcoming the First Sell-side Maintainer →](https://www.finos.org/blog/cdm-new-horizons-welcoming-the-first-sell-side-maintainer) [![FINOS Logo](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/FINOS_Icon_Wordmark_White.png?width=689&height=971&name=FINOS_Icon_Wordmark_White.png "FINOS Logo")](https://www.finos.org/) [![Twitter logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/twitter-blue-social-panel.png)](https://twitter.com/finosfoundation) [![GitHub logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/github-black-social-panel.png)](https://finos.github.io) [![LinkedIn logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/linkedin-blue-social-panel.png)](https://www.linkedin.com/company/finosfoundation) [![SlideShare logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/slideshare-logo.png)](https://www.slideshare.net/finosfoundation) [![YouTube logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/youtube_logo-1.png)](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q) [Contact Us](https://www.finos.org/contact-us) [info@finos.org](mailto:info@finos.org) +1 (650) 665-9773 [Privacy |](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple)