Three supervisors, one question, and only one of them has written the answer down

THE OPERATOR'S MAP · Chapter: The AI Boardroom · Episode 2 · 28 August 2026. The five chapters advance together each week — agent controls (Ship AI), the open-source stack (Sovereign Stack), governance (The AI Boardroom), evaluation (Beyond the Benchmark), physical AI (Twin & Machine). This chapter's Episode 1, and every other chapter's Episode 2, are linked at the foot of the piece.

The Operator's Map is a weekly series for the people who have to run AI rather than admire it. This chapter teaches AI governance. On Tuesday: who supervises the AI you bought. Today: what an examination of it actually asks, and which supervisor has already published the question list.

An examiner does not open with a philosophy. An examiner opens with a list, and the list comes from an instrument published before the visit. So the useful question for a board this quarter is narrow: across the markets you operate in, which supervisor has actually published a list, and what is on it?

The answer is uncomfortable for anyone reading only Washington. Across the United States, the Gulf and India, exactly one supervisor has published an in-force instrument that puts artificial intelligence inside its scope by name, tells an institution what to produce, and attaches mandatory calendar deadlines to it. It is not the one your team reads newsletters about, and it never uses the phrase "AI governance."

The US supervisor named the four things it does not yet know how to examine

Three weeks after the banking agencies put generative and agentic AI outside the scope of their revised model risk guidance, the Comptroller's own risk report said what the difficulty is. In the Semiannual Risk Perspective for Spring 2026, published on 7 May 2026, the OCC writes that it "recognizes there are unique challenges related to the use of genAI and agentic AI such as lack of explainability, data privacy and data poisoning issues, cybersecurity threats, and validation challenges where industry approaches are evolving."

Read that as an examination preview, because that is what it is. Four named difficulties, published by the agency that sends the examiner, in a document that binds nobody. If a US examiner asks your team an AI question in the next two quarters, it lands inside one of those four.

The same report is direct about where the exposure is heading. It observes that use cases today are "primarily productivity and customer experience enhancement tools," then says banks "may consider expanding their use of genAI and agentic AI for material financial decisions." A supervisor describing the climb up the risk ladder in the same paragraphs where it declines to specify the rungs.

The rule was promised. That report says the agencies "plan to issue in the near future a request for information that addresses model risk management generally."

It has not been filed. A Federal Register query across the OCC, the Federal Reserve and the FDIC for "artificial intelligence," restricted to publications since the April guidance and re-run on 26 August 2026, returns two documents: an anti-money-laundering proposed rule and a payment-system-risk notice. Neither is the request for information. The query sits in the link; run it yourself.

The interval falls out of the two published dates. The revised guidance is dated 17 April 2026, which is 131 days ago, and the parallel Federal Reserve designation is SR 26-2. The "near future" promise is dated 7 May 2026, which is 111 days ago. Nothing about that is scandalous. It is simply longer than most deployment plans assume.

The examination that reaches your AI vendor never mentions AI

No AI framework does not mean no examination. It means the examination arrives under a different heading.

The instrument most likely to reach an agentic deployment in a US examination this year is the Interagency Guidance on Third-Party Relationships: Risk Management, issued as OCC Bulletin 2023-17 on 6 June 2023 by the OCC, the Federal Reserve Board and the FDIC. Its scope sentence runs one line: "This guidance applies to all banks with third-party relationships."

Search that document for "artificial intelligence" and it is not there. That is not an exemption. The scope test is the relationship, not the technology. A model you rent from a frontier provider, through a reseller, inside a platform you also rent, is three third-party relationships wearing one logo.

The list exists, it is in force, and it is in the Gulf

The Central Bank of the UAE publishes an in-force instrument called the Model Management Standards, fifty-six pages, public classification, carrying a version date of November 2022 and circulated as an attachment to CBUAE Notice 5052/2022. Its scope article, 2.4.1, reads: "The MMS applies to all types of models employed by institutions to support decision-making."

The difference from the US carve-out is not strictness. It is category. The US instrument asks what kind of model is this, finds generative and agentic systems novel, and steps back. The UAE instrument asks does this thing support a decision, and if so, it is in.

The Standards do not leave AI to inference either. Table 1, the list of the most commonly employed model types in UAE institutions, names Artificial Intelligence outright, under the field Business management.

Then it attaches dates. Every row below is transcribed from the appendix of that same PDF, the table the document titles "Numerical thresholds included in the MMS." The status word in the right-hand column is the document's own.

Three articles matter more than the calendar, because they survive translation into a world of agents.

On vendors. Article 3.1.10: "Institutions can use third parties to support the design, implementation and management of models. However, institutions must take responsibility for all modelling decisions, model outputs and related financial consequences, even if third parties are involved." (The source's spelling is preserved in that quotation.) That is the sentence a US board spent last quarter deriving from first principles, written down and in force since before the current generation of models shipped.

On independence. Article 3.1.12: "One of the key elements to manage Model Risk is a robust process for model review and challenge. Such review must be independent to be effective."

On who may not mark the homework. Article 3.1.9 puts internal audit inside model governance and then draws a hard line through it: internal audit "must assess the regulatory compliance and the overall effectiveness of the model management framework," but "must not be involved in the validation of specific models." Assurance over the system, never over the individual case. Most AI governance decks in circulation have this backward.

India has the principles, not yet the arithmetic

The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology on 5 November 2025, are built in four parts. The government's own portal describes Part 3 as covering "capacity building, risk classification, voluntary commitments, and refinement of legal and regulatory measures as technologies evolve," and Part 4 as guidance to "encourage responsible AI practices, promote self-regulation, and ensure transparent and proportionate oversight."

Voluntary commitments. Self-regulation. Proportionate oversight. Good governance words, none of them a date. The detail is expected from the sectoral regulators, by design, which means the arithmetic your Gulf subsidiary already runs on is arithmetic your Indian entity will eventually be handed, drafted against whatever practice the market has already built.

The three instruments, side by side

The five moves, in order

1. Inventory by decision, not by model. Apply the Gulf scope test and the inventory changes shape: retrieval, routing and the agent that files the ticket all become entries.
2. Name a committee and give it a calendar. Quarterly, minuted, with the life-cycle on the agenda. An oversight body that met once, at launch, is a launch.
3. Start a remediation clock. Twelve months is the mandatory outer bound in the Gulf instrument for a high-severity finding. Adopt the clock, then argue about the number.
4. Separate build from clearance. Independence is what turns a review into effective challenge, and internal audit stays on the framework rather than the individual case.
5. Write down that vendor outputs are yours. One supervisor has already put it in a sentence you can lift.

The strongest objection

The sharpest pushback is that the Gulf instrument is not an AI instrument at all, and dressing it as one is a retrofit. That objection is largely right, and it deserves to be stated at full strength. The Standards carry a version date of November 2022, never use the words "generative" or "agentic," and grew out of scorecards and value-at-risk. Two of their articles do not survive contact with an agent: an annual rating frequency and a fixed monitoring cadence both assume a system that holds still between reviews, and a tool-calling agent whose behavior differs between two Tuesdays does not hold still. Anyone claiming the UAE has regulated agentic AI is overstating it, and this page does not.

A retrofit is exactly what your examiner will do. An examiner arrives with the procedures that exist, not the ones that ought to. When a supervisor with no AI framework opens a file on your agent, they reach for model risk, third-party risk and operational resilience, applied by analogy, by a person with a deadline. The retrofit is not a flaw in the argument. It is a forecast of the exam.

The clock the deployment is running on

One number sets the pace against which all of this is late. On 26 August 2026, NVIDIA reported revenue of 96.2 billion dollars for the quarter ended 26 July 2026, up 106 percent from a year earlier, with data center revenue of 89.0 billion dollars, up 117 percent, and guided the current quarter to 108.0 billion dollars. The chief executive's own line in that release is "AI has reached its inflection point. It's doing useful work. Its tokens are productive and profitable. Now, compute is revenue."

Take the vendor's framing at face value and read what it implies for governance. The infrastructure underneath enterprise AI is compounding at better than double a year while the examination framework in the largest of these three markets remains unwritten. The gap between deployment and supervision is not holding steady.

What to ask your team

1. If an examiner asked for our AI inventory tomorrow, what would we hand over, and who is the named owner on each line?
2. Which of our AI systems support a decision rather than assist a person, and are those the ones on the inventory?
3. When did our AI oversight body last meet, and what did it change?
4. What is our maximum time to close a high-severity AI finding, and where is that written?
5. Do the people who validate our AI systems report anywhere other than into the people who built them?
6. Which of our group entities already operates under a published model management regime, and what did that entity learn that the rest of us have not asked for?

Cut in verification, and why

• The Reserve Bank of India's FREE-AI committee report. Every RBI-hosted URL attempted returned a bot-protection interstitial rather than the document, so no regulator-hosted primary could be confirmed. Cut rather than cited to a secondary.
• A 21 December 2022 publication date for the CBUAE Standards, and the June 2023 filing deadline that follows from it. Both appear in law-firm commentary; neither is on the face of the document, which carries only a November 2022 version date and the rule that it takes effect one day after publication. Cut, and the paragraph rebuilt on what the instrument says about itself.
• Any claim that a US examiner has already asked an AI question in a live examination. Trade commentary asserts it; no supervisory primary was found. Cut.
• Saudi and Qatari supervisory instruments. Not fetched in this pass, so not claimed.

This is Episode 2 of The Operator's Map, five chapters advancing together. Next week, this chapter teaches what an examiner does with the answer you gave: how a finding is graded, and what turns one into a matter requiring attention.