Mastercard operationalizes enterprise AI governance with a lean five-person team

Mastercard operates at global scale in payment and transaction infrastructure, where AI systems underpin fraud detection, compliance, and customer-facing products across dozens of regulated banking relationships. As AI adoption accelerated, the volume of systems requiring governance oversight doubled every year — then grew 60% in 2024 alone. Teams across the company were launching or procuring AI systems without notifying the governance team, creating a backlog of legacy products with inconsistent documentation, monitoring, and ownership. Regulated banking customers expected detailed model performance disclosures, yet record-keeping was sporadic. Without structured oversight, operational risk compounded and compliance readiness for major bank clients was in jeopardy.

John Hearty built Mastercard's AI governance function from a single-person operation into a lean five-person specialist team, anchoring the program in influence-building rather than enforcement. The team embedded governance earlier in the development lifecycle by introducing a risk scorecard — completed by product owners before any AI system is built or contracted — covering data understanding, techniques, and decision-making agency. Using machine learning and predictive analytics as the underlying AI stack, the team co-created a model documentation template with data science peers, developed a bias-testing API distributed company-wide, and established an LLM evaluation framework. Partnerships were structured as win-wins: governance work addressed developers' pain points while delivering the upfront model transparency regulated banking customers required.

A five-person team now governs AI at enterprise scale across Mastercard's global operations, covering bias mitigation, efficacy assurance, and transparency for regulated bank customers worldwide.

• 60% growth in AI systems under governance in 2024, following consecutive years of doubling
• 5 specialists cover architect, model risk, technology, communications, and R&D leadership roles
• Regulated banking customers receive detailed model documentation pre-contract, improving trust and compliance readiness
• Internal cross-functional partnerships produced reusable tooling — bias-testing API, documentation templates, LLM evaluation framework — that scaled governance without scaling headcount

The program shifted AI governance left in the development cycle, reducing the backlog of ungoverned legacy systems and lowering operational risk across the portfolio.

• Small, highly skilled teams can govern AI at enterprise scale when organized around influence and enablement rather than top-down enforcement.
• Shifting governance left via scorecards and tooling — completed before build or procurement — prevents the legacy backlog problem from accumulating.
• Win-win partnerships with developer and data science teams are more durable than compliance mandates; the governance team's bias-testing API succeeded because it solved a pain point for builders.
• In regulated industries, upfront model documentation shared with customers pre-contract builds trust and reduces friction at audit or renewal time.
• Hiring for curiosity and self-awareness matters as much as technical credentials when assembling a governance function that must earn influence across a large organization.