How CIBC Built an AI Governance Model That Actually Accelerates Innovation

“We’ve never stopped a project because we always tell people what the mitigation approaches are.” That’s not what you’d expect to hear from someone running AI governance at one of Canada’s largest banks. But Ozge Yeloglu, VP of Advanced Analytics and AI at CIBC, has built something unusual: a governance framework that teams actually want to use.

The Counterintuitive Path to AI Leadership

Ozge’s journey to running AI at a major bank started with rejecting one. “The first job offer I got out of undergrad was from a Turkish bank,” she recalls. “I was like, whoa, what would I do at a bank?” Two decades later, she runs AI governance and delivery for CIBC—and she got there through a path nobody would have planned.

After discovering machine learning in her final year of computer engineering (“When I started reading that 1970s neural networks bible, I was like, wow, this makes so much sense”), she pursued a PhD in Canada. But she dropped out when the work got too narrow. “Nobody cares about what you do other than yourself and your supervisor. And even after a few years, you lose your supervisor too because you got too deep.”

What followed was a startup, TopLog, where she served as CEO for nearly four years. “I’ve done a lot of things. I built the UI—what do I know about building UIs? I got to raise money from VCs and angels, do marketing, all kinds of things I would never do as a PhD in computer science.”

That startup experience—the “how hard can it be?” mentality and the speed of iteration—turned out to be exactly what she’d need to build AI governance at scale.

Why “Governance” Was the Wrong Word

When Ozge started thinking about AI governance four years ago, she didn’t call it that. “Governance has a bad reaction because of that concept of ‘we’re a highly regulated industry.’ It’s been used as a stick most of the times. And it’s hard to get engagement through that.”

Instead, she framed it as “trustworthy AI.” The pitch wasn’t about compliance—it was about responsibility. “We have clients that trust us with their data, information, money, in many words, with their lives in some cases. So put aside the regulations, we really believe in doing the right thing when we’re building AI.”

The team spent months just defining what AI meant for CIBC. “If we can’t even define something, you can’t put a framework around it.” Then they aligned on six pillars for trustworthy AI, built a target operating model, and figured out who was capable of doing what.

“We started thinking about governance as integrated into how we build AI, not as an afterthought. Most of the times governance is very much an afterthought than designed by approach.”

The Secret: Governance and Delivery Under One Roof

Here’s what makes CIBC’s model unusual: Ozge runs both AI governance and AI delivery. “Everything that I do with the governance team, I can check it very fast and test and experiment really fast with the delivery team. The moment the delivery team is yelling and screaming and saying ‘this is not working,’ we keep tuning the processes really fast.”

It’s a startup within a bank. And it works because the governance team isn’t made up of policy people—they’re former data scientists. “They have built AI solutions hands-on before, but somehow they’re either interested in the risk side or had some education separately or had that mindset.”

Her governance lead? “Previous to CIBC, he was a data scientist within my team. Before that, he was in the Air Force as an engineer—in the risk and audit department. So my joke is, if we trusted this guy to put Canadian jets on the air, I think I can trust him to build a system for AI governance.”

The governance team now serves as a single interface to 13 different risk groups within the bank. “AI solution owners love coming to us. We figure out the 13 different situations behind the curtains so they don’t have to go deal with 13 different people and get the same question asked in different ways.”

People Change Management: The Missing Piece

Twelve months ago, Ozge added something unexpected to her technical organization: a People Change Management team. “What do I know about PCM? I’ve learned a lot in the last six months.”

The insight was simple but easy to miss: “If we don’t have this dedicated change management function, adoption is going to be hard. Adoption of tools, adoption of AI, but also adoption of governance.”

The PCM team—just two people, “small and mighty”—does things the technical team never could. “They can even message me on the side during a stakeholder meeting: ‘This person’s body language is telling me you might want to lean into that one point you made.’”

“One mistake I’ve seen many others do is thinking PCM equals communications. It’s absolutely much more than that. If it’s only one-way communication, you’re just sending things to the void.”

The team helps personalize how different groups receive information. Frontline advisors, back-office operations, executives, technology partners—they all work with AI tools differently and have different expectations. “Not every technique is going to be sticky for every user.”

The Talent Problem: 4,000 Resumes, Not Enough Good Candidates

Finding AI talent is harder than you’d think—not because there aren’t enough candidates, but because there are too many unqualified ones. “We got close to 4,000 resume applications in two weeks for one job. Do you really think they’re all valid and qualified and skilled? No, absolutely not.”

Ozge’s approach: get them early. “We try to get them when they’re early in career. Then they fall in love with our culture.” The team partners with universities, runs eight-month co-op programs, and extends offers to graduates who’ve already learned the systems.

Retention, she says, comes easier. “I absolutely believe people work for and with people. I spend more time at work than with my kids. So it better be fun. I better enjoy what I do.”

The other retention trick: internal mobility. “Half my AI governance team have been on the delivery side before. They’re like, ‘Hey, this looks interesting, I’m going to gain new skills.’ Being able to create that fluid environment where they can move from one role to another—that’s helped.”

Build vs. Buy: A Scientist’s Practical View

With 2.5 million models on Hugging Face and new LLM providers emerging constantly, how does CIBC decide when to build versus buy?

“I believe in leveraging every tool available to us,” Ozge says. “My startup background probably balanced my research background—one is ‘go break fix, do it fast’ versus ‘take your time and find the most accurate answer.’ In the end, we’re running a business.”

The calculus is straightforward: “Yes, there are use cases where you make an API call to an LLM provider, put an application front-end in front of it, and you’re done. Very low risk. But we’re not going to get maximum value that way.”

For custom models, the bar is high: “Do I need something unique that’s going to work on my own data? Sometimes having something built on world’s data creates noise I don’t need. Is this a core investment I can spend a couple of years on, millions of dollars, with enough confidence it’ll get me a competitive edge? Then yes.”

That’s why CIBC maintains an applied AI research team—small, focused, making long-term bets on capabilities that could differentiate the bank.

The Honest Take on Agentic AI

“Agentic AI is definitely hype, in my opinion. We’re still in the hype phase. We all talk about it—how much value are we truly generating out of it yet is to be seen.”

But Ozge doesn’t expect a long wait. “It’s not going to be ten years, it’s not going to be five years. Most likely in the next couple of years it will probably pass over that hype phase. Everything is in a very accelerated timeline.”

What strikes her most is how the field has changed for practitioners. “Two years ago I had to pause and ask myself: am I going to be irrelevant in the next five years? What do I need to do to be relevant? It’s such an interesting feeling for AI folks who’ve done this their whole lives, because we’ve never had to ask that question.”

The future, she believes, is an “amalgamation of software engineering and AI scientists personas.” But one thing won’t change, especially in banking: “Accuracy is still so important. In the LLMs world, you can’t just ship something that’s 85% right when you’re handling people’s money.”

For more on how Canadian enterprises are approaching AI governance and scale, check out our episodes with other technology leaders navigating the balance between innovation speed and responsible deployment.