Jos Gheerardyn

Jos Gheerardyn's public commentary centers on a single conviction: AI risk management is an operational and governance problem before it is a technical one, and most organizations are still treating it as the latter. Across his talks and posts he keeps returning to the gap between how AI systems are actually used, agentic, fast-moving, embedded in every customer touchpoint, and how governance frameworks were built for a slower, more static world. He argues that automating model validation "faces operational rather than technical challenges," because different model types demand different standardization approaches that are hard to align across an organization ¹⁰. His proposed fix is multi-governance model risk management with better domain modeling, decomposing redundant model-usage combinations to cut unit costs and maintenance effort ¹⁰. This is not an abstract preference for elegant frameworks; it is a repeated, practical argument that governance complexity scales with AI use cases, driven by multiple contexts for a single system and increasingly customizable tools ¹⁰.

That operational lens carries directly into his sharpest and most consistent public argument: the build-versus-buy debate for MRM platforms. He acknowledges, without hedging, that AI coding tools have genuinely changed the economics of building in-house, teams really can build faster now . But he insists this only addresses half the equation. "The build was never the expensive part. Maintenance is." He walks through why: model inventories keep growing, validation cycles keep tightening, regulators keep raising the bar on documentation, monitoring and lineage, and every new model type, GenAI included, becomes a maintenance ticket on a tool the team now owns forever . His conclusion is blunt about the trade-off: "the build option in 2026 has a slightly lower initial cost. But the project risk has gone up, not down." He even preempts the natural objection, that model risk is idiosyncratic enough to justify a bespoke build, by citing SR 26-2's own language about practices being bank-specific, then pointing out what he thinks people miss: "Frameworks keep changing, and a model risk platform has to keep up with all of them. That ability to adapt is not bank-specific." The economic logic he offers is that a vendor spreads the cost of continuous adaptation across many institutions, while a self-built tool leaves that cost concentrated on one team indefinitely .

A second recurring thread is his insistence that regulatory pauses or postponements do not equal risk pauses. Commenting on the EU AI Act, he states plainly that "the fact that part of the EU AI Act is postponed does not mean that magically the risks related to deploying and using AI systems are paused," and reminds readers that "the purpose of AI risk management is to manage all risks, not just compliance risk." This is consistent with a talk in which he uses the Wolf of Wall Street as a reference point to explain what regulation actually does economically: it brings forward the cost of excessive risk-taking, converting a low-probability catastrophic event into a high-probability compliance fine, so that companies ignoring AI risk lose their short-term commercial edge once rules catch up . He is not arguing that regulation eliminates risk-taking incentives; he is arguing it changes the timing and certainty of the penalty.

On the human-versus-machine question, Gheerardyn is consistent across sources in rejecting both extremes, full automation and purely manual oversight. Reacting to UN Secretary-General Guterres's Geneva remarks, he highlights the line "Machines can inform, but humans must decide" and frames the real challenge as implementation: "the concept of Human in the Loop is present in every AI governance framework," but making it effective under agentic AI is "non-trivial," requiring runtime controls and a proper risk-based oversight framework, not just a stated principle . In interviews he extends this into a specific role for AI within governance itself: AI should assist rather than replace human decision-making in model validation, helping surface documentation weaknesses and enabling real-time monitoring, because traditional periodic review cycles are too slow for AI systems that get built quickly ¹². The throughline is that oversight has to be engineered into the system's runtime behavior, not bolted on as a policy statement.

His commentary on a Belgian insurance ombudsman report shows how he applies these abstractions to a concrete case. Chatbots giving policyholders wrong information appeared for the first time in an official annual report, and he singles out the insurers' response as the right instinct: they took responsibility and fixed it for the customer rather than deflecting to the bot . But he uses the episode to name a governance blind spot he sees repeatedly: "Een chatbot is een model," yet many companies still treat it as IT or customer service rather than something falling under model governance . This is the same argument in miniature as his broader thesis: the boundary of what counts as a "model" needing formal oversight is expanding faster than most organizations' governance categories have caught up to, and liability for what an AI system says or does sits with the deploying organization regardless of how that system is internally classified .

Taken together, the throughline across his statements is that AI governance in 2026 requires scale and differentiation rather than uniform, manual, periodic processes, because the volume and variety of AI use cases has outgrown that model ¹². His concrete takeaways for practitioners are consistent and specific: treat every customer-facing AI system, including chatbots, as a governed model regardless of which department owns it ; do not assume regulatory delay removes underlying risk ; and before deciding to build an MRM platform in-house, price in the perpetual maintenance burden of keeping pace with evolving frameworks, not just the one-time build cost that AI coding tools have made cheaper . Underneath all of it is a data-quality foundation he laid out earlier in his public speaking: models learn from data, and incomplete or incorrect data produces unexpected behavior, so managing data quality is not a peripheral concern but a major component of operating models sustainably ¹¹.