By Dr. Robert Straw, CEO, CEIBS Switzerland
The Vatican has produced the most sustained account yet of what responsible artificial intelligence (AI) deployment looks like from outside the technology industry, and Brussels, Denver, Delaware and Beijing have already written its central demand into law. All five locate the safeguard in the same place: a human being who can understand, contest and stop the machine. None of them asks whether the deployment has left that person able to do so. For banks, whose entire model-risk doctrine rests on competent human challenge, that is the question of the decade.
On May 15, 2026, Pope Leo XIV signed Magnifica Humanitas, the first papal encyclical on artificial intelligence. It runs to 245 numbered paragraphs under the subtitle “On Safeguarding the Human Person in the Time of Artificial Intelligence”.
The date was chosen rather than found. It was the 135th anniversary of Rerum Novarum, in which Pope Leo XIII confronted the factory system, mass industrialization and the reduction of workers to interchangeable labor; it helped set the terms on which industrial economies came to govern the treatment of working people. The signal is unsubtle. The Catholic Church intends to do for the age of artificial intelligence what it did for the age of the machine.
Readers of this publication may reasonably ask what a teaching letter of the Catholic Church is doing in a discussion of bank governance. Nobody is suggesting that institutions adopt theology. The claim is narrower and harder to dismiss.
First, outside standards of this kind migrate. Anyone who has lived through the climate and cybersecurity cycles will recognize the sequence: soft norms first, investor and stewardship questions second, disclosure rules and litigation third, with the substance largely written in the first phase by institutions that no bank controlled. Reading such a standard earlyis not piety. It is risk management.
Second, and more practically, the letter singles out finance. It identifies financial automation and speculative instruments as a domain in which systemic risk is amplified and value becomes detached from the real economy. Much of the public AI debate concerns model capabilities, compute thresholds and international machinery. This document is almost entirely about deployment: what an institution does when it buys a system, points it at a population and switches it on. That is not the legislature’s or the laboratory’s layer; it is the bank’s.
An unlikely convergence
The letter’s core demand is that for any consequential decision, a person must be able to account for it: to justify it, monitor it, contest it and put it right.
The letter’s core demand is that for any consequential decision, a person must be able to account for it: to justify it, monitor it, contest it and put it right. Its reasoning is that these systems do not understand what they produce, hold no conscience and bear no consequences, so accountability cannot be delegated to something that cannot be held to answer. If no human can be named as answerable, the system is not ready to run.
What makes this more than an ethical preference is that four other authorities have arrived at the same place from entirely different premises.
The European Union’s Artificial Intelligence Act (AI Act) classifies creditworthiness assessment and risk pricing in life and health insurance as high-risk and requires such systems to be designed so that natural persons can effectively oversee them in use. Colorado became the first US state to impose a duty of reasonable care on deployers of high-risk systems, though it has since narrowed that law to a disclosure regime taking effect in January 2027, a reminder that the rules are still moving even where the principle is settled. The Delaware oversight line requires directors to maintain genuine information and reporting systems for risks critical to the enterprise and holds that reliance on vendors and experts must be informed rather than blind. China’s ethical review measures, in force since March, require organizations conducting AI research to register ethics committees able to demonstrate a guaranteed ability for a person to intervene in a system’s operation.
Bank supervisors reached the same conclusion earlier than any of them. Model-risk management has required effective challenge for more than a decade: a critical review by parties who are objective, competent and hold sufficient authority to force a change when they find one is required. A control consisting only of a signature has never been acceptable.
Brussels, Denver, Delaware, Beijing and the Vatican proceed from incompatible assumptions about markets, rights and the state. All five locate the safeguard in a capable human being. An institution that builds to the encyclical’s standard is, as a practical matter, building ahead of the rest at once.
The question none of them asks
Can that person still do it?
Two of the three conditions for effective challenge are structural. Objectivity comes from independent reporting lines and organizational design, authority from mandate. Banks have engineered both, and supervisors examine them.
The third condition, competence, has never needed engineering. The people who challenged the models had all once completed the underlying work by hand. The credit reviewer had spread statements. The validator had built models. The investigator had worked on alerts from the beginning. Competence arrived as a by-product of a career, and no policy had to produce it.
Cognitive psychologist Lisanne Bainbridge identified this difficulty in 1983 and called it the irony of automation.Automating a task removes the routine practice that keeps judgment sharp, and the operator is then asked to take over precisely at the edge of the system’s competence, which is the moment that requires the most judgment and the moment for which he or she is least prepared. Aviation has spent four decades learning this at considerable cost.
Banking is the sharpest case, because banking automates the apprenticeship rather than the expert. AI triages anti-money-laundering (AML) alerts, so investigators review dispositions rather than working cases from scratch. It pre-populates credit memoranda, so analysts edit narratives rather than building them. It drafts underwriting rationales and flags anomalies. Each is a genuine efficiency, and each removes the unglamorous work through which a junior banker used to acquire a feel for when something was wrong.
The encyclical names the pattern directly, describing the current practice as deskilling workers and subjecting them to automated surveillance. It proposes a standard against it: Every automation must be paired with verifiable measures to protect employment, retraining and participation.
The professional-services sector, which sells judgment and therefore notices its supply first, is already responding. Ernst & Young (EY) is investing $100 million in rewarding employees who demonstrate judgment and adaptability, while a large survey of new accounting and finance hires found a third leaving within their first year as entry-level work moves into software. In KPMG’s survey of its own incoming cohort, more than 40 percent worried that dependence on the technology would blunt their critical thinking. Those are 22-year-olds forecasting their own deskilling. Banks should recognize the pattern, because analyst programs work the same way.
From a teaching letter to an operating model
Principles do not discharge oversight duties. Decision rules and information systems do.
The rule is simple: For every material AI proposal reaching the board, management should present two cases, and approval should require both. The economic case is familiar: savings, cycle time, revenue and competitive position. The human case is its missing twin: what the deployment does to the skill, judgment, contestability and trust it touches and who, by name, owns each residual risk. Given the convergence above, a business case silent on human capability is silent on whether the safeguard survives. That makes it incomplete rather than conservative.
Two instruments support it. The first is a live register of every material AI system, recording business purpose, affected population, decision rights, risk tier, named accountable owner, contestation route, testing status, vendor dependencies, data provenance, incident history and planned retirement. Institutions subject to the AI Act will build much of this anyway; it also happens to be how a board knows what it owns.
The second is a set of human measures reported alongside the financial ones: roles eliminated and redesigned, retraining completed before the savings are booked rather than after, whether workload and monitoring intensity rose, and whether the affected population is gaining skills or losing them.
To that I would add one metric that costs almost nothing and is rarely examined: Track the override rate. For every material automated decision, measure how often a human reviewer overturns the system, and watch the trend. A rate drifting toward zero admits two explanations: The model has become flawless, or effective challenge has quietly stopped. Most institutions can compute this from data they already hold.
The refusals nobody has minuted
One question from the letter has no equivalent in any compliance framework, and most boards have never formally answered it: What has this institution decided it will not automate, infer, monitor or monetize, even when doing so would be legal and profitable?
Risk-appetite statements describe the exposures an institution will accept. They rarely describe the capabilities it declines to build. Yet an institution’s identity is defined at least as much by its refusals as by its capacities, and a board unable to name a single refusal has delegated that definition to whoever configures the next system. The list need not be long, but it must exist before the business case is on the table.
Afterwards, it is no longer a principle; it is an objection.
The long horizon
A fiduciary may object that all of this subordinates shareholder value to an outside morality. This objection deserves a precise answer in two parts that should not be blurred together.
The encyclical’s ground is moral: A person’s worth comes first and is not earned; the document is candid that this is a position rather than a regression result. But on any horizon longer than a quarter, the evidence points the same way, so no choice between the standard and the shareholders is required. Gallup’s meta-analysis across millions of employees finds that the most engaged business units materially outperform the least on profitability, turnover and safety incidents. Alex Edmans’s work uncovers employee satisfaction predicting abnormal returns that the market had not yet priced, sustained across decades. And in a well-known survey by John R. Graham, Campbell R. Harvey and Shiva Rajgopal, 78 percent of chief financial officers admitted they would sacrifice long-term economic value to smooth a single quarter’s earnings.
The translation for a bank is short. Efficiency gains that erode trust, skill and judgment are unbooked liabilities. People and profits compete on the quarterly clock and converge on the horizon that a board is uniquely charged to hold.
The test
The encyclical’s own test is one line long: Does this technology make life more human, not merely more efficient?
The encyclical’s own test is one line long: Does this technology make life more human, not merely more efficient?
It is easy to hear that as sentiment. It is not. It is the operational question sitting underneath every oversight regime now being written, because an institution that has hollowed out the judgment of the person meant to supervise a system has defeated its own safeguard while passing every audit. Every form would be complete. Every examination would be survived. And the control would be hollow.
Directors need not share the letter’s faith to recognize its function. It is an early draft of a standard against which AI decisions may one day be measured, and the institutions that meet it comfortably will be those that started asking its questions while they were still voluntary.
So the question to put to the next model approval is not whether a human is in the loop. Someone always is. It is whether that human has done the work recently enough to know when the answer is wrong.
The views expressed in this article are those of the author.
Dr. Robert Straw is CEO of CEIBS Switzerland, responsible for the Zurich campus and the European activities of China Europe International Business School (CEIBS). He serves on the Advisory Board of Nasdaq’s Center for Board Excellence and the Global Advisory Council of the Corporate Governance Institute, and he sits on the boards of several privately held firms. He holds a Ph.D. in International Economics from the University of St. Gallen.