OJK's AI Governance Guide for Banks: What Indonesian Banks Must Do

What does OJK expect from a bank that uses artificial intelligence? The answer sits in a guide the Financial Services Authority launched in April 2025, and it matters more this month than when it was published. From 28 September to 1 October 2026, OJK and Bank Indonesia hosted the Basel Committee on Banking Supervision meeting and the 24th International Conference of Banking Supervisors in Bali, where advanced AI was on the agenda alongside crypto assets and stablecoins. When supervisors turn their attention to a technology, the banks that already have their governance in order are the ones that move faster.

What OJK launched, and for whom

OJK launched Tata Kelola Kecerdasan Artifisial Perbankan Indonesia, its AI governance guide for Indonesian banks, on 29 April 2025 with the leaders of the commercial bank associations, according to its press release SP 67/GKPB/OJK/IV/2025. Dian Ediana Rae, OJK's Chief Executive of Banking Supervision, described it as a guide for commercial banks to develop and apply AI, including advanced AI systems, responsibly, across the whole AI lifecycle and the banking business cycle.

OJK expects AI use to keep widening, and its release names the areas: customer interaction and service quality, product development and pricing, compliance, risk management and fraud prevention, and market data analytics. The guide draws on the existing rules banks already follow, including POJK 11/POJK.03/2022 on IT at commercial banks, the circulars on cyber resilience and on digital maturity assessment, and Law 27/2022 on personal data protection, and on international references such as the EU AI Act and Basel Committee guidance.

Three principles: accountability, human oversight, reliability

Kontan reported on 29 April 2025 that Dian Ediana Rae named three core principles. Accountability means every AI system can be answered for in full. Reliability means decisions produced by AI are consistent with the bank's strategy and objectives. Human oversight he called an absolute condition for trustworthy AI. In May 2026, Zulkifli Salim of OJK's banking development directorate told Infobank that under the guide, AI-based decisions should not be left entirely to machines, so that bias in decisions is avoided.

The lifecycle and the AI committee

The guide follows AI through its whole life: initiation, design, model development, testing, implementation, and then evaluation and periodic audit, as Kontan described it. Because sound risk management is central, the roles of the board of directors and the board of commissioners are emphasised.

OJK also encourages banks to form an AI committee, drawing on legal, compliance, risk, data science, cyber security and customer service. Depending on how complex a bank's use of AI is, the committee can sit within the IT steering committee or stand alone. For banks already reorganising IT governance under OJK's 2026 rules on IT at commercial banks, the IT steering committee is a natural home.

Why it matters now

Speaking about the Bali meetings, Kontan reported on 12 October 2026, OJK Chair Friderica Widyasari Dewi said technology-driven changes in banking, including frontier AI and crypto assets, bring both opportunities and challenges for supervision. Dian Ediana Rae said new technology should support innovation that is safe, transparent and sustainable. The direction is consistent: supervisors want innovation, and they want evidence that it is controlled.

There is also a security reason. Infobank reported that, according to the national cyber agency BSSN, the financial sector is among the industries most often hit by cyber attacks and ransomware. AI systems that touch customer data or decisions widen that surface, which is one more reason the guide ties AI to the bank's existing risk and cyber frameworks.

How to put the guide into practice

This part is our analysis rather than OJK's wording. A guide becomes useful when it turns into a few concrete artefacts a supervisor or auditor can inspect.

• An inventory of every AI use, including AI inside vendor products, with its owner, purpose, data used and the decision it influences.
• A tiering of those uses by impact, so a chatbot answering opening hours is not governed like a model that prices credit.
• Checkpoints at each lifecycle stage: approval to start, design review, test results against an agreed evaluation set, go-live sign-off, and a date for the next review.
• Recorded human oversight: who reviews which AI outputs, when a person must approve, and a log that shows it happened.
• A committee charter that says who decides, who escalates and how often the inventory is reported to the board.

What to watch next

Two signals from the Bali meetings are worth following. According to Kontan, supervisors stressed approaches that are risk-based, principle-based and technology-neutral, and OJK highlighted the long-term need to move towards post-quantum cryptography. Both point the same way: more scrutiny of how banks govern new technology, not less. Banks that align with the April 2025 guide now will have less to change when expectations harden, and a clear answer the next time supervisors ask how AI is governed.