AI Governance, Risk & Compliance

The regulatory landscape

Financial services regulators globally have converged on a consistent message: they are not banning AI, but they expect you to govern it.

Key regulatory developments:

You do not need to memorise these regulations. The common thread is this: regulators want to know that a human is accountable for every AI-influenced decision, and that you can explain how the AI contributed to that decision.

This is not fundamentally different from how you govern any other tool or process. The challenge is that AI adoption is happening faster than most governance frameworks can keep up.

Layer 1 — Use case classification

A practical governance framework for AI in financial services has four layers. The first is classification — not all AI use cases carry the same risk.

Low risk — Internal productivity (drafting emails, summarising meeting notes, formatting presentations). Minimal governance needed beyond basic data handling policies.

Medium risk — Analysis that informs decisions (earnings analysis, market research, comp tables). Requires human review before any output is acted upon.

High risk — Direct decision support (credit scoring, trade execution support, compliance monitoring). Requires formal validation, audit trails, and model risk management.

Prohibited — Fully automated decisions on client outcomes without human review (in most jurisdictions).

Layer 2 — Approval workflow

Before a team deploys a new AI use case, it should go through a lightweight approval process:

1. What is the use case? — One paragraph description
2. What data is involved? — Client data? Proprietary data? Public data?
3. What is the risk level? — Using the classification above
4. Who reviews the output? — Named individual accountable for AI-assisted decisions
5. What is the fallback? — If the AI tool is unavailable, how does the work get done?

This does not need to be bureaucratic. For low-risk use cases, a team lead sign-off is sufficient. For high-risk use cases, compliance and risk should be involved.

Layer 3 — Data handling rules

The golden rule: AI tools should be subject to the same data handling rules as email and shared drives. If you would not email a document to a personal Gmail account, you should not paste it into a personal AI account.

Layer 4 — Monitoring and audit

For medium and high-risk use cases, maintain:

• Usage logs — who used AI for what, when (enterprise AI plans provide this automatically)
• Output sampling — periodic review of AI outputs for quality and accuracy
• Incident tracking — log cases where AI output was materially wrong or misleading
• Annual review — revisit governance framework against evolving regulations

These four layers — classification, approval, data handling, and monitoring — give you a complete, practical governance framework. It is lightweight enough to not slow teams down, but robust enough to satisfy regulators.

Vendor evaluation

When evaluating AI platforms for your firm, here is what matters.

Non-negotiable requirements:

• SOC 2 Type II compliance — standard for enterprise SaaS
• Data not used for training — your conversations and documents must not be used to improve the model
• Encryption — in transit and at rest
• Access controls — SSO, role-based permissions, admin dashboard
• Audit logs — exportable records of all AI usage

Important but negotiable:

• Data residency — can you choose where data is processed? Important for EU-based firms under GDPR.
• Custom retention policies — can you set how long conversations are stored?
• API access — for integration into your own systems
• On-premise deployment — some firms require this; cloud is acceptable for most with proper controls.

Questions to ask vendors:

1. "If we upload a confidential prospectus, where is that data stored and for how long?"
2. "Can you provide a data processing agreement compliant with [your jurisdiction]?"
3. "What happens to our data if we terminate the contract?"
4. "How do you handle a data breach involving our content?"
5. "Can we get an independent security audit report?"

Responsible AI in practice

Beyond compliance, responsible AI use is about building trust — with your clients, your regulators, and your own team.

The human-in-the-loop principle: Every AI output that informs a client-facing decision should be reviewed by a qualified human. This is not just a regulatory requirement — it is common sense. AI is a powerful first draft, but the judgment, context, and accountability belong to you.

Bias awareness: AI models can reflect biases present in their training data. In financial services, this matters most in credit decisions, client risk scoring, and hiring and talent assessment. For these use cases, actively test for bias and document your testing process.

Transparency with clients: If AI contributed materially to work product delivered to a client, consider whether disclosure is appropriate. Regulatory guidance on this is evolving, but the trend is toward transparency.

Key takeaways

1. Governance is not the enemy of speed — a lightweight framework actually accelerates adoption by removing ambiguity and giving teams confidence to move.
2. Classify use cases by risk — not all AI usage needs the same level of oversight.
3. Apply existing data rules — AI should be subject to the same policies as email and document management.
4. Evaluate vendors rigorously — enterprise controls are non-negotiable for regulated firms.
5. Keep humans accountable — AI assists decisions; humans make them.

With governance in place, you are ready for the Practitioner tier. Next: Claude as your AI analyst — how to use AI for document analysis, research, and financial modelling.