AI Control in financial services has a shape.
It must be "deep", and it must be "wide".
The industry has largely seen AI through the prism of frontier model developers — the software that dominates the press. But AI extends far beyond the software in the headlines.
It runs "Deep": from agentic applications and models down through computing, data centers and power. And it reaches "Wide": across every external party that builds, operates and supports AI on the institution’s behalf. Control must run in both directions at once.
THE INSTRUMENT.
One instrument. Deep across the stack. Wide across the chain.
Deep and wide cannot be asserted. They have to be measured. The 5×5 AI Control Matrix™ measures both — cell by cell, against evidence, not policy.
Deep — down the stack.
The Matrix’s five rows are the five ecosystems of the Institutional AI Stack™: Power, Computing, Data Centers, Models and Agentic Applications. Each is read against five pillars of control: Jurisdictional, Logical, Technical, Operational and Contractual. Twenty-five intersections, each read on its own evidence and never reduced to a single score. The result shows exactly which layers are evidenced, and which are only assumed.
Wide — across the chain.
The same Matrix is then applied to every party that operates AI on the institution’s behalf: asset managers, asset servicers, technology and model providers, and beyond. One standard, applied consistently, so every relationship can be read and compared like for like. Execution is delegated; accountability is not.
Governance is policy. Control is evidence.
THE Sectors.
Asset Owners — The Stewards of Capital
Asset owners’ fiduciary obligations make AI control imperative, not optional. Entrusted with workers’ retirement security, the wealth of nations, and promises to beneficiaries and citizens, they sit at the apex of institutional finance. Their ability to control AI will shape how capital is allocated across economies and generations.
Asset Managers — The Allocators of Capital
Asset managers transform capital into investment decisions, standing between asset owners and markets. As AI becomes embedded in research, portfolio construction, and operations, the question is no longer whether they will use it, but whether they can demonstrate control over the systems shaping investment decisions and fiduciary outcomes.
Asset Servicers — The Operational Backbone of Capital
Asset servicers underpin the operational integrity of institutional finance. They safeguard assets, maintain records, administer funds, and enable the movement and accounting of capital. As AI becomes embedded in these critical functions, their ability to demonstrate control is essential to the trust and reliability on which global finance depends.
Banks — The Engines of Financial Intermediation
Banks occupy a critical position in institutional finance. They facilitate payments, create credit, manage liquidity, and sustain the broader economy. As AI becomes embedded across these functions, control is no longer simply a technology issue; it is fundamental to safety, soundness, and systemic resilience. Banks must demonstrate control over AI deep across the stack and wide across the parties operating it on their behalf. The stability of modern finance depends on it.
Wealth Managers — The Custodians of Advice
Wealth managers guide individuals, families, and institutions through decisions that shape their financial futures. As AI becomes embedded in planning, research, and client engagement, control is no longer optional; it is fundamental to fiduciary responsibility and client trust. Wealth managers must demonstrate control over the AI influencing their advice and serving their clients. Their clients’ financial futures depend on it.
Retirement Providers — The Guardians of Long-Term Security
Retirement providers help safeguard the long-term financial well-being of millions of individuals and families. As AI becomes embedded in recordkeeping, advice, operations, and participant engagement, control is fundamental to fiduciary responsibility and trust. Retirement providers must demonstrate control over the AI shaping retirement decisions and outcomes. The financial security of participants depends on it.
Private Equity Firms — The Owners and Builders of Enterprise
Private equity firms do more than allocate capital; they own businesses, influence management, and shape enterprise strategy. As AI becomes a driver of productivity and value creation, control over AI becomes critical to controlling risk and realizing value across their portfolios. Their ability to govern AI will increasingly shape the performance and competitiveness of the companies they own.
Insurance Companies — The Protectors of Risk
Insurers promise protection against risk. As underwriters, claims payers, and long-term investors, they help safeguard individuals, businesses, and economies. As AI increasingly shapes how risk is priced, transferred, and managed, insurers must demonstrate control over the systems making these decisions. The trust underpinning the insurance industry depends on it.
THE EVIDENCE.
8 SECTORS · 80 INSTITUTIONS · ONE 5×5 CONTROL MATRIX™
Institutional AI reviewed the publicly available disclosures of eighty of the world's leading financial institutions. The public record indicates that AI adoption is widespread, while publicly demonstrable Institutional AI Control—both deep across the AI Stack™ and wide across the institutional operating ecosystem—remains limited.
Where evidence is publicly disclosed, it is concentrated primarily at the model layer. Beyond models—into autonomous agents above and the power, compute, and data-center ecosystems beneath—publicly demonstrable control becomes markedly less evident.
For boards, executive teams, and risk leaders, the implication is straightforward: AI governance and Institutional AI Control are not the same. As artificial intelligence becomes increasingly embedded in institutional decision-making, understanding where demonstrable control exists—and where it does not—is becoming a defining question of institutional oversight.
REQUEST THE AI CONTROL RESEARCH
Insights from 8 sectors and 80 leading institutions.
All engagements and discussions are conducted under confidentiality protections, including non-disclosure agreements where applicable. Control Tiers represent Institutional AI’s analytical interpretation of the depth, specificity, and visibility of publicly disclosed AI control information and are not assessments, audits, certifications, or determinations of any institution’s actual control environment, governance practices, or operatio
AI is a given. Control is not.™
WHAT WE DO.
The Institutional AI Stack™ — the architecture.
Deep control begins with the Institutional AI Stack™ — the five ecosystems institutional AI runs on: Power, Compute, Data Centers, Models, and Agents. Most institutions see AI at the top of the stack — the models and agents in the headlines. But those run on data centers, compute, and power an institution rarely owns and often cannot see.
Deep AI control reaches through every layer, owned or rented, to the lowest one an institution can account for. What you rent, you are still accountable for.
The 5×5 AI Control Matrix™ — the INSTRUMENT.
The 5×5 AI Control Matrix™ is the instrument that measures how much control an institution can demonstrate over the AI it depends on. It reads the five ecosystems of the Institutional AI Stack™ — Power, Compute, Data Centers, Models, and Agents — against five pillars of control: Jurisdictional, Logical, Technical, Operational, and Contractual. Twenty-five intersections, evaluated cell by cell rather than collapsed into a single score — because an institution can command its models while renting the data centers beneath them, and a single number would hide exactly that.
The Matrix documents where control is evidenced, where it is assumed, and where it is absent. It is applied through the AI Control Assessment™, which runs it in two directions — deep within the institution, and wide across every material relationship in its delegation chain.
The AI Control Assessment™ — the diagnostic.
The Assessment is where the instrument is applied. It runs the 5×5 Control Matrix™ across an institution's full AI footprint, in two directions.
Deep — the institution's own matrix. For an asset owner such as a public pension fund, this is one 5×5 reading its demonstrable control over the AI it operates directly, from power to agents.
Wide — a matrix for every material relationship in its chain. A pension fund does not operate most of the AI it depends on: it runs inside the asset managers it appoints, the asset servicers that custody and administer its assets, and the technology, infrastructure, and model providers beneath them. The Assessment maps that chain and runs the Matrix on each node — a distinct 5×5 per relationship. The same provider reads differently for every institution, because control lives in the contract and the reach it grants, not in the vendor.
The AI Control Assessment™ establishes the institution's demonstrable control position — deep, and wide across the chain — and sets the priorities to close the gaps: where control is evidenced, where it is assumed, where it is absent, and where the duty extends further than the institution can currently reach.
The output is not a policy binder. It is a control position a steward of capital can stand behind — before the board, the regulator, and the client.
OLTAIX™ — THE Control Fabric.
Independent by design. You can delegate work to a hyperscaler, model provider or platform vendor. You cannot delegate fiduciary duty. Control outsourced is not control.
Built to your institution. Every institution carries a different fiduciary footprint. You build OLTAIX in your own environment, on your terms, and you own it.
5×5×N. One 5×5 AI Control Matrix™ for your institution, which is deep. One for every material partner, which is wide. Together they show where control is evidenced, assumed or absent across the chain your capital depends on.
Anything less is not AI control. Lock what you run. Verify what you don’t.
Disclosed to qualifying institutions under NDA.
.png/:/rs=w:600,cg:true,m)
How It Fits Together.
Institutional AI Control is not four separate ideas — it is one.
- The Institutional AI Stack™ is the architecture: the five ecosystems every institution's AI runs on, from power to agents.
- The 5×5 Control Matrix™ measures control across it — five ecosystems by five pillars, twenty-five intersections, read cell by cell rather than reduced to a single score.
- The AI Control Assessment™ reads that Matrix and defines the program.
- And OLTAIX™ operates the Stack under continuous control.
The architecture, the measure, the diagnosis, and the means to hold it — one system, deep across the stack and wide across the chain.
Questions Every Board Should Answer.
The pattern of answers is the finding.
A board that asks these three questions and records honest answers will produce, in a single sitting, the most accurate picture of its real AI control posture it has ever held.
- The "Depth" question. "Our AI runs on five layers — the agents that act, the models that decide, the data centers that hold it, the compute it runs on, the power beneath. We may have examined one or two. Controlling the top layer while renting the four below is not control. Which layers have we verified, and which are we assuming?"
- The "Reach" question. "The numbers we book, the valuations we rely on, the decisions we answer for — more and more are produced by AI running inside the managers and servicers we delegate to, not inside us. We hold the fiduciary duty. They hold the AI. Have we verified their control, or delegated the work, kept the liability, and hoped?"
- The "Trust" question. "The firms that build these models run red teams whose job is to make them misbehave — and ship anyway, knowing they can. If the maker does not fully trust its own model, on what basis do we treat its output as reliable?"
Governance is policy. Control is evidence. These three questions separate the two. A board that can get them answered with technical proof — not provider assurance — has control. One that cannot has just found its exposure.
And these are only the beginning.