Quick Read
- BSP AI governance rests on a memorandum that calls its principles both “minimum supervisory expectations” and voluntary, with no deadline, reporting requirement, or penalty in the text.
- The memo expects a centralized AI inventory, validation by people independent of the developers, board challenge, and BSP access to review how AI systems are built and deployed.
- Larger banks already hold model risk and compliance controls, a Philippine Institute for Development Studies fellow said, so the build-out cost falls on smaller institutions.
- The memo’s scope extends to AI vendors under a shared responsibility model, so the documentation a bank can show depends on what its vendor can supply.
- The memo calls the model risk management framework forthcoming, and BSP’s June 2025 draft gave institutions two years to comply after it takes effect.
BSP AI governance rests on a document that calls itself both a minimum and optional. BSP Memorandum No. M-2026-031, signed by Deputy Governor Lyn I. Javier and dated June 24, 2026, describes its AI governance principles as “minimum supervisory expectations for AI adoption” and, in the same paragraph, as “non-binding” with compliance “voluntary in nature.”
That wording costs little for institutions that already built the controls. It costs more for smaller institutions that run AI through vendors and may have to buy validation and documentation from outside.
BSP AI Governance Sets a Floor Without a Deadline
The memo recommends that institutions formally develop their own AI governance framework, proportionate to the nature, extent, scale, complexity, and materiality of their AI systems. It sets no deadline, no reporting requirement, and no penalty. With nothing in the text marking where optional ends and expected begins, that line is drawn by whoever supervises the institution, not by the document.
What the memo asks for is specific. A centralized AI inventory, kept current. Documentation detailed enough for an outside party to audit how a system was designed and how errors were handled. Oversight and effective challenge from the board of directors. Validation by a team independent of the developers. And a line under accountability that expects institutions to enable BSP to monitor, oversee, and review how AI is developed and deployed.
| Expectation | What the memo says | Binding status |
|---|---|---|
| AI inventory | Maintain and update a centralized inventory | Voluntary under the memo |
| Independent validation | Validate through a team separate from the developers | Voluntary under the memo |
| Board challenge | Board oversight with effective challenge | Voluntary under the memo |
| Vendor coverage | Principles extend to outsourced providers | Voluntary under the memo, existing outsourcing circulars still apply |
| BSP access | Enable BSP to monitor, oversee, and review AI | Voluntary under the memo |
Existing Circulars Already Reach AI Systems
The voluntary label in BSP AI governance covers only the AI-specific layer. The memo states that emerging technologies are already covered by BSP’s IT risk management framework, which addresses information security, outsourcing, and project management. It points to existing circulars on IT risk, operational risk, and risk governance as reference points for the AI lifecycle, and says it is to be implemented without prejudice to existing laws and regulations.
An institution cannot opt out of the base and treat only the top as optional. The rules on technology risk and outsourcing already apply to its AI systems, and the memo describes in detail what BSP expects on top of them.
Smaller Institutions Buy What Larger Banks Already Have
The cost of BSP AI governance lands unevenly. John Paolo R. Rivera, a senior research fellow at the Philippine Institute for Development Studies, said larger banks already have measures against model risk, cybersecurity, data privacy, and compliance, while smaller lenders may need to improve their AI inventory, documentation, and independent validation. He noted that banks already use AI for credit scoring, fraud detection, customer service, compliance, and risk management.
A bank with a model risk unit adds its AI systems to a process it already runs. A bank without one has to hire, contract, or hold back the AI use it would otherwise adopt. Independent validation is the sharpest cost. For a bank running a vendor’s tool, the developers sit outside the institution, so independent validation means either relying on the vendor’s own testing or paying for a separate review.
Vendors Inherit Duties Through Shared Responsibility
The memo says its principles extend to vendors and outsourced service providers that support a supervised institution’s AI activities, under a shared responsibility model based on what each can control. Transparency expectations apply to those providers too, through documentation or system performance reports.
A bank that wants to show an inventory and validation records will need inputs from its vendors. Vendors behind uses such as credit scoring and fraud detection fall inside that scope. Those that can document how a model was built and tested are better placed to keep bank clients. Those that cannot will be asked for records they do not have.
A Model Risk Rule Would Turn Expectation Into Obligation
The memo describes the model risk management framework as forthcoming and says it will address algorithmic fairness and model risk across the model lifecycle. BSP posted a draft circular on model risk management in June 2025. That draft defined a model to include artificial intelligence and machine learning, covered models built in-house, bought from vendors, or embedded in third-party systems, and expected institutions to categorize models in an inventory by risk exposure. It gave them two years from the circular’s effectivity to comply.
The memo itself closes by saying BSP will keep monitoring and issue regulations or policies whenever necessary. If a final circular follows that draft, expectations the memo leaves optional would carry a compliance clock. Institutions that began building under the memo start ahead. Those waiting for a rule start from zero.
BSP has shown it can make a requirement mandatory by circular. Circular No. 1232, dated April 27, requires banks and other supervised institutions to regularly evaluate their own cybersecurity safeguards. For BSP AI governance, the instrument is a memorandum.
BSP AI governance costs the least where controls already exist, which means larger banks. Smaller institutions carry the cost of finding out where the line between expected and required falls, and the vendors behind their models are next to be asked for proof. What shifts first is the documentation request, which runs from BSP to the bank to the vendor.
Track more regulatory shifts that affect your business in Policy & Regulation section of Hemos PH.
