OJK AI Governance for Banks: What Vendors and System Integrators Need to Prepare

OJK's artificial intelligence governance guideline is written for banks, but its questions will reach vendors and system integrators (SIs) through due diligence, questionnaires and contracts. An SI that prepares its answers early, from model accountability to data center location, has a better chance of getting through the bank's risk review without delay.

What does OJK's AI governance guideline for banks say?

OJK launched the Indonesian Banking Artificial Intelligence Governance guideline (Tata Kelola Kecerdasan Artifisial Perbankan Indonesia) on 29 April 2025 and calls it a minimum reference for banks. It is principle-based, not a rigid technical rulebook. Banks adapt their use of AI to their business scale, complexity and risk profile, without giving up prudential principles.

As of October 2026, OJK emphasizes three core values: accountability, human oversight and reliability. Indah Iramadhini, Head of OJK's Banking Regulation and Development Department, presented them at HPE FSI Day Jakarta on 15 October 2026. According to that presentation, the guideline covers the full AI lifecycle: initiation, design, model development, testing, implementation, and periodic evaluation and audit. Its focus areas are data quality and security, explainability, cybersecurity and risk management.

The guideline does not stand alone. OJK positions it as a complement to existing banking IT rules, including POJK 11/POJK.03/2022 on IT operations by commercial banks and SEOJK 29/SEOJK.03/2022 on cyber resilience and security.

Does the guideline also apply to vendors and SIs?

Not directly. The OJK guideline is addressed to banks. But a bank remains responsible for the AI it uses, including AI built by third parties. So banks pass governance requirements down to vendors and SIs through IT service provider assessments, contract clauses and evidence requests. In practice, the SI is usually the first to receive these questions.

The formal channel is OJK Board of Commissioners Regulation (PADK) No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks. It was enacted on 23 January 2026, took effect on 1 March 2026, and revoked SEOJK 21/SEOJK.03/2017. The PADK governs the use of IT service providers, including re-assessment of a provider's materiality. It also governs licensing for placing electronic systems and processing transactions outside Indonesia.

The OJK AI guideline itself highlights a risk that matters to vendors: dependence on, and concentration in, a small number of cloud, model and software providers. That means banks will ask not only "which model do you use" but also "who else is in your supply chain".

What will banks ask vendors and SIs?

Banks usually ask about five things: who is accountable for the model, where humans still make the decision, how the model is monitored after go-live, where data is processed and stored, and which third parties are involved. The table below maps those questions to the documents that should be ready before the risk review starts.

Area	Bank's question	Documents to prepare	Usually prepared by
Accountability	Who owns the model and who approves go-live?	RACI matrix, model card, approval records	SI together with the bank
Human oversight	Which decisions stay in human hands?	Decision flow and written escalation thresholds	SI
Reliability	How is the model tested and monitored in production?	Test report, monitoring plan, incident response procedure	SI, with monitoring data from the infrastructure provider
Data quality and security	What data is used, where from, and who has access?	Data inventory, access controls, personal data protection impact assessment where required	Bank as personal data controller, assisted by the SI
Explainability	Can the model's output be explained to a customer or auditor?	Output explanation method and example cases	SI
Cybersecurity	What controls protect the model and the data?	ISO/IEC 27001 certificate, security controls summary	Infrastructure provider and SI
Processing location	Where do inference and storage run, including DC and DRC?	Data center location statement, architecture diagram	Infrastructure provider
Third parties	Who are the sub-processors and model providers?	Sub-processor list, model licenses	SI and infrastructure provider
Audit and exit	Can the bank audit, and what happens when the contract ends?	Audit rights clause, exit and data migration plan	SI and infrastructure provider

For the data location question, see also the guide to answering data residency questions in AI project RFPs. For the questions bank risk teams raise most often, see 3 bank client questions that often stall AI projects.

How do you map the AI lifecycle to project deliverables?

Use the six AI lifecycle stages OJK names as a deliverables framework. Each stage produces documents the bank can inspect. This way, governance is not extra work squeezed in before go-live. It sits in the work plan from kickoff and travels with every handover between the SI and the bank.

1. Initiation. Use case, business objective, initial risk classification, and the name of the model owner on the bank's side.
2. Design. Architecture, data flow, processing location, and human decision points.
3. Model development. Model choice (open-weight or proprietary), data sources, and fine-tuning notes where applicable.
4. Testing. Accuracy and bias test results for that use case, security tests, and staging tests with a load pattern close to production.
5. Implementation. Go-live approval, runbook, rollback procedure, and first-line support path.
6. Periodic evaluation and audit. Review schedule, monitoring metrics, and logs retained for audit.

What most often holds projects up in a bank's risk review?

It is usually not the model but documentation that arrives late. The most common patterns: processing location cannot be proven, the third-party chain is not recorded, monitoring stops on go-live day, and human oversight exists only on a slide. All of these can be answered at the design stage.

• Data location cannot be proven. The architecture diagram says "cloud" but does not say where inference and storage run. If the system is placed or processes transactions outside Indonesia, the bank needs OJK approval under PADK 1/2026. That adds time before go-live.
• The third-party chain is broken. The SI calls a model API from another provider without recording it as a sub-processor. Bank risk teams usually find this when they read the data flow diagram.
• Monitoring stops at go-live. The bank asks for evidence that model output is monitored, but the logs were never designed. Model drift is only discovered after customer complaints.
• Human oversight lives only on a slide. There is no written escalation threshold for cases that require human review, such as high-value decisions.

For customer personal data, the PDP Law still applies on top of all this. A summary is in the articles on using LLMs on customer data under the PDP Law and what Government Regulation 33/2026 means for AI projects.

Where IONext fits

IONext handles the infrastructure layer. IONext runs GPUs, inference and storage in Jakarta, so an SI can answer the processing location question with a clear, verifiable statement. IONext is certified to ISO/IEC 27001:2022 by TÜV NORD, certificate no. 01 07 E 26000410, and bills in Indonesian Rupiah. Certificate details and IONext's position on the PDP Law are on the IONext Security and Compliance page. GPU specifications are on the IONext GPU page.

In ORBIT, SI teams build, run and monitor infrastructure, pipelines and models in one workspace. IONA reads signals from infrastructure, models and pipelines, explains what they mean, then suggests a next step. These monitoring records help an SI prepare evidence for the periodic evaluation stage.

The limits matter too. IONext does not write a bank's AI policy, does not replace the bank's committees or risk management function, and does not handle licensing with OJK. Bias testing, explainability and the go-live decision remain the responsibility of the bank and the SI. The full split of roles is in the article on who holds what between the SI and the AI infrastructure provider.

If you are an SI preparing an AI project for a bank, talk through this split of roles via the IONext Partner Program. Want to try ORBIT and IONA first? Create an account on the IONext console.

FAQ

Is OJK's AI governance guideline legally binding? The guideline is guidance, not a numbered regulation, and OJK calls it a minimum reference. But AI systems at banks remain subject to binding rules, such as OJK PADK 1/2026 for IT operations and the PDP Law for personal data. The guideline is best read together with those rules.

Can a bank use an AI service that processes data abroad? Yes, with conditions. PADK 1/2026 governs licensing for placing electronic systems and processing transactions outside Indonesia. For personal data, the PDP Law's Article 56 on transferring personal data outside Indonesian jurisdiction also applies. Processing in Indonesia makes the answer simpler, but the decision stays with the bank.

Who prepares the personal data protection impact assessment for a bank's AI project? The bank, as the personal data controller. Article 34 of the PDP Law requires an impact assessment for processing personal data that is potentially high risk. SIs and infrastructure providers usually contribute technical inputs: data flow, processing location, security controls and the sub-processor list.

Sources

• OJK, Tata Kelola Kecerdasan Artifisial Perbankan Indonesia (Indonesian Banking AI Governance), 29 April 2025. PDF document.
• OJK, Abstract of PADK OJK No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks, 2026.
• OJK, FAQ on PADK OJK No. 1 of 2026, 2026.
• Bisnis.com, OJK Beri Ruang Perbankan Berinovasi pada AI Sesuai Skala dan Risiko (OJK Gives Banks Room to Innovate on AI by Scale and Risk), 15 October 2026.
• Hukumonline, OJK Terbitkan Panduan Tata Kelola AI untuk Perbankan (OJK Issues AI Governance Guideline for Banking), 30 April 2025.
• Law No. 27 of 2022 on Personal Data Protection, JDIH BPK.

This article is general information, not legal advice. For compliance needs, refer to the official text of the regulations and consult legal counsel.

IONext is sovereign AI infrastructure hosted in Indonesia, operated by PT Data Awan Nusantara in Jakarta. IONext provides GPU as a Service, managed inference through an OpenAI-compatible API, and open-weight model hosting, certified to ISO/IEC 27001:2022 by TÜV NORD.