The financial services sector was a frontrunner in AI adoption and it’s continuing to redefine how employees in the sector work as it becomes deeply embedded into regular tasks. Smarsh research shows that 61% of finance professionals now use generative AI on a daily basis, with 69% reporting a significant increase in content creation. The impact of AI is profound, from improving operational efficiencies to providing personalised services – and it’s now a core component of operational infrastructure for regulated firms.
However, this raises a clear question around governance that must be treated as a priority for any financial services institution. AI has increased the overall output of teams and put pressure on teams to work quickly and this risks creating a gap between the pace of delivery and the pace of compliance oversight. While regulatory bodies have introduced legislation such as the EU AI Act to counter this challenge, the pace of change will continue to directly challenge compliance and open up firms to unforeseen risks if this isn’t addressed.
The gap between AI adoption and compliance
AI has firmly moved from development to deployment. From customer services and fraud to anti-money laundering (AML) detection, cybersecurity and internal operations, AI is being leveraged across the sector.
However, focusing on deployment has often pushed regulatory concerns to the sideline. Governments and regulatory bodies have taken significant steps, such as the UK’s AI Opportunities Action Plan, to encourage AI adoption in a safe and secure manner; allocating funding, creating training programmes and setting out clearer guidelines for integrating AI into businesses’ systems.
Firms have taken different approaches to AI usage, all with differing results, as many try to tailor AI to their priorities. While the results showcase AI’s transformative potential, they also highlight the various regulatory issues that must be addressed. For example, under Consumer Duty, firms must demonstrate that AI-driven processes deliver fair outcomes and that requires governance, not just performance. Reports of firms seeing stronger service performances, error rate reduction and cost savings are all promising outcomes, but the pressure to show return on investment (ROI) and subsequently pushing compliance down the list of priorities is escalating.
Fragmented AI adoption across different companies has resulted in the Bank of England (BoE) and the Financial Conduct Authority (FCA) reporting on various regulatory problems from third-party dependencies, model complexity and embedded or ‘hidden’ models, all expected to pose a threat in the next three years. The rollout of AI must be safely executed by trialling models within sandboxes and deploying the technology in pilot stages to ensure models are embedded and clear records of AI use within businesses are properly recorded.
At this stage, AI is now an active component in operational functions for most firms, with many integrating third-party Large Language Models (LLMs) within their operations at scale. But it’s not too late to embed appropriate safety measures to fulfil safety guidelines. Embedding systematic monitoring and updates to AI usage, replacing legacy systems that aren’t compatible with AI-enabled platforms, providing comprehensive training and outsourcing complex AI work to specialists must all be preventative actions companies take on board.
AI can mask complexity for simplicity
AI accessibility has created a false sense of security among companies and consumers alike. Fewer than a third (32%) of financial services professionals believe their organisation’s surveillance systems are fully equipped to detect risks in AI-generated content. Real safety and security is reliant upon appropriate compliance measures, implemented and embedded across business processes to prevent large-scale compliance failures. As stronger regulatory rules come into force, many businesses can expect to feel significantly increased regulatory scrutiny around how they operate with AI if preventive action isn’t taken.
Equally, increased accessibility has introduced the threat of “shadow AI”, where employees are turning to external generative AI tools that are not sanctioned under organisational policy – with a third of all AI use cases in financial services coming from third-party implementations. This often includes employees inputting sensitive or highly confidential information into publicly accessible AI models, and it presents the same risks as shadow IT did, yet the enhanced danger is the level of access and AI user-friendly interfaces. Employers must navigate these issues with care and caution, enforcing credible and attainable rules that support employees and guide them towards internal AI platforms.
The primary challenge is the lack of understanding and forward-thinking around the risks of introducing information into non-compliance spaces. Where firms have deployed approved internal AI platforms, compliant behaviours around AI use are likely to be stronger, but only where that deployment is paired with clear policies, training and oversight of how those tools are used. Mandating rules without adequate training risks employees using backdoor methods to produce work, increasing the likelihood of confidential information being exposed.
The future of AI governance
The trajectory is clear. AI will move deeper into financial services workflows, take on more consequential decisions and attract sharper regulatory scrutiny.
The FCA has been consistent in its position. It’s not asking firms to slow down AI adoption, it’s asking them to demonstrate that they are in control of it. That means documented oversight, evidenced decision-making and governance frameworks that can withstand supervisory examination – not just internal sign-off.
The firms that treat governance as a design requirement, including building audit trails, defining AI ownership and extending existing compliance frameworks to cover AI-generated and AI-assisted outputs, will move faster, scale with more confidence and demonstrate responsible AI use. The governance foundations need to be in place before the supervisory questions arrive, not drafted in response to them.
By Shaun Hurst, Principal Regulatory Advisor, Smarsh.
- Fintech & Insurtech