At J.P. Morgan Chase, the term 'fortress balance sheet' is a guiding principle. It means maintaining a financial position so strong it can withstand any crisis. This philosophy extends beyond capital reserves and into technology. When it comes to Artificial Intelligence, especially in the Corporate & Investment Bank (CIB), every new model is treated as a structural component of that fortress. It must be sound, tested, and resilient.

This isn't about stifling innovation. It’s about ensuring that powerful tools like Large Language Models (LLMs) are deployed in a way that protects the firm, its clients, and the financial system. To achieve this, JPMC employs a structured risk management approach known as the Three Lines of Defense.

This model clarifies who is responsible for what, creating a system of checks and balances for AI governance.

First Line: Business and Product Teams These are the owners of the risk because they are the ones creating and using the AI models. If a CIB trading desk wants to use an LLM to summarize research reports, that team is the first line. They are responsible for the day-to-day management of the model, including identifying risks, implementing controls, and ensuring it performs as expected. They have the most intimate knowledge of the model's purpose and behavior.

Second Line: Independent Oversight This line provides independent oversight and challenge to the first line. It consists of specialized functions like Risk Management and Compliance. They don’t build the models, but they set the rules and monitor adherence. They establish the firm-wide policies and frameworks, like the NIST AI Risk Management Framework, that all AI projects must follow. A crucial group in this line is the Model Risk Governance (MRG) team. The MRG is the gatekeeper; it assesses and validates every single AI and machine learning model before it can be deployed. Their job is to prevent any single model from posing an undue risk to the firm or its customers.

Third Line: Internal Audit This line provides the highest level of independent assurance. Internal Audit periodically reviews the activities of both the first and second lines to ensure they are effectively managing risk according to firm policies and regulatory expectations. They report directly to the board of directors, ensuring their findings are impartial and carry significant weight.

This layered approach ensures that while business lines are empowered to innovate with AI, their work is consistently challenged and checked against a high standard of risk management. It creates a productive tension that balances speed with safety.

So how does this work in practice? Imagine a team within the CIB develops an LLM-powered tool to help bankers draft pitch materials. The first line owns the tool, trains it on internal data, and tests its outputs for accuracy.

Before it can be used with clients, they must submit it to the Model Risk Governance (MRG) team. MRG, as the second line, evaluates the model against the firm’s policies. They'll probe for risks like data leakage, inaccurate summaries (hallucinations), or the potential for biased language in the generated text. Their review follows a structured process based on the NIST AI RMF core functions.

Only when MRG is satisfied that the risks are appropriately managed does it approve the model for deployment. This structured, multi-layered process ensures that every AI application is worthy of being part of the 'fortress'.

Time to review the key components of JPMC's risk architecture.

Now, let's test your understanding of how these roles and frameworks fit together.

By embedding this rigorous, multi-layered governance structure, JPMC aims to build AI systems that are not just powerful, but also trustworthy and secure. This balance allows the firm to innovate confidently while upholding its commitment to stability.