Ping An Bank’s board approved internal AI management rules on Sept. 30, giving the bank a formal policy for overseeing its use of the technology. Other Chinese banks are working to implement regulatory guidance, according to Cailian Press, but that does not establish that they have adopted policies like Ping An’s.
The bank told Cailian Press that its measures are intended to implement guidance issued in June by China’s National Financial Regulatory Administration, which oversees banking and insurance institutions. Ping An has described the areas its policy covers, but has not published the full text.
That gap matters when assessing both the bank’s safeguards and whether other lenders might follow. Cailian Press reported that several unnamed banks were working on the regulator’s guidance. It did not report that they had approved comparable policies.
What has Ping An Bank changed?
Ping An has placed AI management under a board-approved internal policy. In the bank’s account to Cailian Press, its board strategy committee coordinates the work, while oversight extends across the development and use of AI.
The bank also described controls for data security, risks associated with algorithms, and ethics, along with a system for classifying AI uses by risk and tracing responsibility. Those are the bank’s descriptions, not provisions that can be checked against a published policy. Its precise requirements, exceptions and enforcement mechanisms remain unavailable for scrutiny.
Cailian Press described Ping An as the first listed mainland bank to publicly disclose such measures. That is a disclosure milestone, not evidence that no other bank has internal AI controls.
Ping An said it had more than 450 large-model application scenarios by the end of June, including uses in marketing, investment advice, compliance, risk control and office support. The scenario count comes from the bank; the available reporting does not independently verify it or assess how those applications perform.
What does the regulator’s guidance cover?
The National Financial Regulatory Administration published guidance on June 18 containing 32 recommendations across seven areas. They address governance, AI development and application, data governance, computing infrastructure, risk management, capability building and oversight for banking and insurance institutions.
The guidance calls on institutions to incorporate AI risks into their overall risk management and maintain oversight throughout an AI system’s use. It also recommends classifying applications by risk, with approval and human oversight for high-risk uses.
Ping An said its policy implements that guidance. Its public summary describes some of the same concerns, but without the policy text, it is not possible to establish exactly how the bank applies the regulator’s recommendations. The available reporting also does not establish a specific effect of Ping An’s policy on customers or workers.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
What is known about other banks’ plans?
Cailian Press reported that several banks said they were working to implement the regulator’s guidance and that similar internal policy documents were expected later. The banks were not named in the available account, and no approval dates were specified. The report supports a narrower conclusion than widespread adoption: work is under way at unnamed institutions.
The sector-wide guidance gives banks beyond Ping An a reason to review their AI practices. But a shared regulatory starting point does not establish that their eventual policies will match Ping An’s, or when any will be approved.
Cailian Press counted 42 A-share-listed banks whose interim reports mentioned AI. That indicates how widely the technology appeared in those reports; it is not a count of banks with formal AI governance policies.
The clearest next evidence of wider uptake would be other banks disclosing approved measures. Ping An’s own unpublished policy leaves a separate question: what its controls require in practice, particularly for higher-risk applications.