AI Governance in Indonesian Banks Scores 2.74 out of 5

AI governance maturity in Indonesian banks averages 2.74 on a five-point scale, or roughly 55 percent. The figure comes from a Perbanas and IBM survey of 91 respondents at 35 financial institutions, released in Jakarta on October 27, 2026. Its central finding is that banks are adopting AI faster than they are building ways to oversee it.

What the Perbanas and IBM survey covered

The survey appears in a white paper titled Digital Sovereign AI and the Future of Trusted Banking. According to Infobank, it was prepared by the Indonesian National Banks Association (Perbanas) with IBM and K&A and launched at the Grand Hyatt Jakarta. Ricky Satria, head of Bank Indonesia’s Data Innovation and Digitalization Department, attended the launch.

AI governance is the set of internal rules that decides who may use AI, for what purpose, with which data, and how the results are checked. A score of 2.74 suggests that most banks have some of those rules in place, but not a complete set, and not one that runs as a routine.

The same survey includes a sharper number. Bisnis.com reported that only 9 percent of Indonesian banks keep a complete AI inventory that is updated regularly. Such an inventory lists every AI model, tool, and feature in use, along with its owner and the data it touches. Without one, a bank has little way of knowing where its AI risk actually sits.

Perbanas Secretary General Anika Faisal urged banks not to adopt AI out of fear of missing out, and to build a basic understanding of the technology first. “Pelindungan nasabah adalah fundamental. Itu adalah dasar dari inovasi,” she said, as quoted by Bisnis.com, meaning that customer protection is the foundation of innovation. She added that the industry as a whole will be judged by its weakest players, so capability gaps between banks could become a shared risk.

AI adoption is outpacing oversight

Banks in the survey sit at very different stages. According to Fortune Indonesia, 34 percent are still piloting AI or using it in limited trials, and 18 percent apply it to some operational needs. Another 12 percent have not explored AI at all. Only 4 percent have expanded AI across functions under formal governance. The coverage we read does not break down the remaining respondents.

Asked which AI risk most needs to be controlled, 82 percent of respondents named data privacy. Cybersecurity followed well behind at 44 percent, then regulatory risk at 41 percent. The ranking fits banking, where AI models depend on large volumes of customer data both for training and for daily use.

The survey also found that each division looks at AI from a different angle. Governance teams focus on accountability, compliance teams on control over data, and technical teams on foundations and data engineering. That split is natural, but it can leave AI policy fragmented unless one forum brings the views together.

Juvanus Tjandra, managing partner of IBM Consulting Indonesia, said nearly half of banking activities will be affected by AI. In his view, the literacy challenge is shifting from teaching staff to use software toward adapting to AI agents, systems that can carry out a series of tasks on their own. Control teams at banks will therefore need to supervise systems that act autonomously.

Digital sovereignty came up as well. Seventy-three percent of bank executives said control over AI and digital sovereignty is a core transformation need for the next 12 to 24 months. Toto Prasetio, head of technology and security at Perbanas, said the industry’s priority is a shared understanding of how digital sovereignty works in daily practice.

The OJK guidance banks already have

Banks are not starting from zero. Indonesia’s Financial Services Authority (OJK) published the Tata Kelola Kecerdasan Artifisial Perbankan Indonesia (Indonesian Banking AI Governance) on April 29, 2025. According to the OJK press release, the guidance covers AI across its full life cycle and complements POJK Nomor 11/POJK.03/2022 on IT management by commercial banks and SEOJK Nomor 29/SEOJK.03/2022 on cyber resilience and security.

At the launch, OJK’s chief executive of banking supervision, Dian Ediana Rae, advised banks to set up an AI committee. According to ANTARA, it should bring together legal, compliance, risk, data science, cybersecurity, and customer service. The committee can stand alone or sit within the IT steering committee, depending on how complex a bank’s AI use is.

The life cycle runs from initiation and design through model building, testing, and deployment to periodic evaluation and audit. The guidance also draws on Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Indonesia’s Personal Data Protection Law) and on international practice such as the EU AI Act and guidance from the Basel Committee on Banking Supervision.

Awareness of the guidance remains limited. Only 43 of the 91 respondents knew about OJK’s AI governance guidance. The Personal Data Protection Law was known to 54 respondents, POJK 11/2022 to 49, and SEOJK 29/2022 to 33. Sixty-six respondents said AI governance training is the support they need most.

What this means for banks and financial institutions

The survey gives a clear picture of the unfinished work. According to Infobank, the white paper’s recommendations start with a registry of AI use cases and regular monitoring of models. Taken together with the OJK guidance, the findings point to several steps that banks, rural banks (BPR), savings cooperatives, and fintech companies can take now.

Build an AI inventory. Record every use of AI, including tools the bank did not build itself: customer service chatbots, credit scoring models, fraud detection, and AI assistants staff use to draft or summarize documents. For each entry, note the business owner, the vendor, and the data involved.

Map the customer data flowing into AI. Since privacy is the top concern, check whether personal data is sent to AI services outside the organization, where that data is processed, and whether the legal basis for processing meets the Personal Data Protection Law. The same mapping answers the data sovereignty questions the survey raised.

Create a cross-functional forum. The AI committee OJK recommends brings legal, compliance, risk, data, security, and customer service into one room. Smaller institutions can attach it to an existing IT committee, as long as it keeps its own agenda and record of decisions.

Monitor models after launch. An AI model can lose accuracy as transaction patterns or customer behavior change. Set performance measures, alert thresholds, and a review schedule, then keep the results as audit evidence. This matters even more once a bank starts testing AI agents that can act on their own.

Most of this is data work. Inventories, data flow maps, and model monitoring can be built on the dashboards risk teams already use. Merakit helps financial institutions prepare this kind of groundwork through its financial services solutions and artificial intelligence services, designed with data control from the start. For more on data use in Indonesian finance, see our piece on QRIS data as a credit scoring source for small businesses.

Frequently asked questions

Is OJK’s AI governance guidance mandatory?

The OJK press release describes the document as guidance for commercial banks so that AI is developed and applied responsibly. It complements binding rules such as POJK 11/POJK.03/2022 on bank IT. In practice, banks that follow it will be better prepared when supervisors ask how their AI is managed.

Who took part in the Perbanas and IBM survey?

The survey covered 91 respondents from 35 financial institutions in Indonesia. Respondents came from several functions, including governance, compliance, and technical teams, which is why the results also show different priorities across divisions.

Do small banks and rural banks need their own AI committee?

OJK says the AI committee can stand alone or form part of the IT steering committee, depending on how complex AI use is. A bank with limited AI use can start within its existing IT committee and split the committee off as the number of models and the risk grow.

Closing

A score of 2.74 out of 5 shows that Indonesian banks have started using AI while oversight is still catching up. The first steps are practical: know where AI is used, what data flows into it, who is responsible, and how its performance is tracked. If your institution wants to set up an AI inventory or a clear model monitoring system, the Merakit team is ready to help.

Sources

• Bisnis.com: Perbanas warns banks that AI use must not come at customers’ expense (October 27, 2026, Indonesian)
• Infobank: Banks urged to strengthen AI oversight, findings of Perbanas and IBM research (October 27, 2026, Indonesian)
• Fortune Indonesia: Data privacy seen as AI adoption risk for Indonesian banks (October 27, 2026, Indonesian)
• OJK: Press release on the launch of Indonesian Banking AI Governance (April 29, 2025, Indonesian)
• ANTARA: OJK says banks should form AI committees to oversee governance (April 29, 2025, Indonesian)