AI governance is the set of decisions, owners, controls and records that show a firm knows which artificial intelligence it uses, what each system decides, who is answerable for it and how the firm checks that it works and treats customers fairly. In a bank, insurer, payment institution or electronic money institution (EMI), it is not a separate discipline. It is the firm's existing risk, compliance and accountability framework applied to decisions made or shaped by a model.
Most financial institutions already use AI in transaction monitoring, fraud screening, customer onboarding, credit decisioning, pricing and customer service. Adoption has often moved faster than governance. Regulators in the EU, the UK, the US and Singapore now ask the same three things: explain how the system reaches its outputs, show that it is fair, and name the person who is accountable for it.
This guide sets out the rules that apply in each of those markets after the 2026 changes, what supervisors look for, how payment institutions and EMIs are affected, and a seven-step route to a governance position that stands up to a supervisor, an auditor or a client's due diligence team. It brings together the firm's earlier guidance on AI governance, AI implementation and AI-driven transformation in financial institutions into one current reference.
The first practical question is where AI already sits in the business. Firms usually find more than they expected, because many systems were bought rather than built and some AI features were switched on by a supplier inside a platform purchased for another purpose.
| Use | Typical regulatory treatment |
|---|---|
| Creditworthiness assessment and credit scoring of individuals | High-risk under the EU AI Act (Annex III, point 5(b)); fair lending and Consumer Duty in the US and UK |
| Risk assessment and pricing for life and health insurance | High-risk under the EU AI Act (Annex III, point 5(c)) |
| Fraud detection | Expressly carved out of the Annex III credit category; governed by conduct, model risk and operational resilience rules |
| AML transaction monitoring and sanctions screening | Money laundering regulations, model risk expectations and human review of alerts |
| Identity verification and onboarding | Data protection, Consumer Duty and fair access; biometric uses can fall within other AI Act categories |
| Chatbots and generated content | EU AI Act transparency duties from 2 August 2026; Consumer Duty communications outcome in the UK |
| Internal productivity tools | Lower risk; data protection, confidentiality and third-party controls |
The table shows why classification matters. Two systems built on similar technology can sit in very different places: a model that declines a consumer loan carries far heavier obligations than one that summarises internal meeting notes.
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the main high-risk obligations back to give standards bodies and supervisors time to publish the technical standards and guidance firms need.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices; AI literacy duty |
| 2 August 2025 | Obligations for general-purpose AI models; governance and penalty provisions |
| 2 August 2026 | Transparency duties for chatbots and AI-generated content, with a short transition for systems already on the market |
| 2 December 2027 | High-risk obligations for Annex III uses, including credit scoring and life and health insurance pricing |
| 2 August 2028 | High-risk obligations for AI built into products regulated under Annex I |
Firms that planned to the earlier 2 August 2026 date for credit and insurance models now have until 2 December 2027. The work itself has not changed, and conformity work for a high-risk system typically takes six to twelve months, so the realistic starting point for a firm with high-risk uses is 2026.
The Act applies to providers, meaning firms that develop a system or place it on the market under their own name, and to deployers, meaning firms that use a system in their business. It also reaches providers and deployers outside the EU where the system's output is used in the EU. A UK lender scoring EU residents, or a UK EMI using a scoring model for its EU subsidiary, is within scope.
The Act recognises existing financial regulation. Credit institutions and other financial institutions already subject to internal governance rules under EU financial services law meet the deployer monitoring duty by complying with those rules, and financial supervisors act as the market surveillance authority for high-risk AI used by the firms they supervise. In practice, a bank's AI governance is examined by its usual supervisor, alongside its other governance.
| Breach | Maximum fine |
|---|---|
| Prohibited AI practices | €35 million or 7% of worldwide annual turnover, whichever is higher |
| High-risk and most other obligations | €15 million or 3% of worldwide annual turnover |
| Incorrect or misleading information to authorities | €7.5 million or 1% of worldwide annual turnover |
For small and medium-sized firms, the lower of the two figures applies. For most financial firms the larger cost is supervisory: restrictions, remediation programmes and independent reviews ordered by their usual regulator.
The UK has no AI statute for financial services. The Financial Conduct Authority states that it does not plan to introduce extra regulations for AI and that its approach is principles-based and focused on outcomes. Existing rules therefore apply to decisions made by models in exactly the way they apply to decisions made by people.
For banks and building societies with internal model approval, the Prudential Regulation Authority's Supervisory Statement SS1/23 on model risk management has applied since 17 May 2024 and expressly covers the use of AI and machine learning in modelling. The FCA also runs an AI Lab for firms developing AI use cases, and co-chairs an AI consortium with the Bank of England.
US rules are spread across agencies and sectors rather than a single statute. On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued SR 26-2, revised guidance on model risk management that replaces SR 11-7 and the 2021 statement on BSA/AML models. It applies to traditional statistical models and non-generative, non-agentic AI, and states that generative AI and agentic AI models are not within its scope. Banks must therefore govern those systems through their wider risk management framework, and examiners still ask how they are controlled.
Fair lending rules require lenders to give specific reasons when they decline credit, whatever model produced the decision. Investment advisers and broker-dealers face SEC examination of how they describe and supervise their use of AI. The NIST AI Risk Management Framework, with its generative AI profile, is the reference most US firms and their counterparties use to structure AI governance.
The Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management in October 2026. They apply to all financial institutions and all forms of AI, and expect board and senior management oversight, an AI inventory, a materiality assessment for each use, proportionate lifecycle controls and accountability for third-party AI. They take effect on 7 October 2027, with a phased period to 7 October 2028 for parts of the framework. They build on the FEAT principles (fairness, ethics, accountability and transparency) that MAS published in 2018.
A firm operating in more than one market does not need a separate framework for each. The practical approach is one framework built to the strictest applicable standard, usually the EU AI Act for high-risk uses, structured on the NIST lifecycle, and mapped to each local regulator's expectations. ISO/IEC 42001, the international standard for AI management systems, gives that framework a certifiable form.
Across the four markets, expectations meet in six areas. A firm that can evidence each one is in a strong position with any of these supervisors.
Payment institutions and EMIs use AI most heavily in three places, and each has a clear governance requirement.
Most firms now use machine learning to flag, hold or block transactions. Fraud detection is carved out of the EU AI Act's credit category, but outputs that stop a customer's payment still need to be explainable, reviewed by a person where they affect the customer, and tested for consistent treatment. For a UK firm this sits within its money laundering controls, its Consumer Duty evidence and its safeguarding and operational resilience arrangements.
AI is used for identity verification, document checks and customer risk scoring. Errors or uneven outcomes that restrict access to an account create Consumer Duty exposure and complaints. Firms should be able to show the approval rates by customer group and how declined applicants can reach a person.
Lending-adjacent payment services, such as buy-now-pay-later or credit lines on accounts, bring credit scoring into scope, which is high-risk in the EU from 2 December 2027. Firms launching AI agents that initiate payments on a customer's behalf raise further questions on authorisation, consent and liability, covered in the firm's guide to AI agents and payments regulation in 2026.
In each case AI governance belongs inside the existing compliance, risk and resilience framework. A separate AI policy that sits apart from the business does not satisfy any of these regulators.
List every AI system in use: built in-house, bought, and AI features inside software bought for other reasons. For each, record its purpose, the business area that uses it, the data it uses and whether its outputs affect customers. The inventory is the first document a supervisor or auditor asks to see.
Assess each system by what it decides and who it affects, and map it to the EU AI Act categories where the firm operates in or serves the EU. Classification sets how much control is proportionate, so effort goes where the exposure is.
Each system needs one accountable individual, recorded by name. A committee or a team is not an owner. The owner need not have built the system, but must be able to explain what it does, what it may not do, who approved it and on what basis.
Four existing obligations do most of the work: individual accountability, fair customer outcomes, operational resilience and third-party risk. Add the EU AI Act duties for any high-risk system and the data protection rules for automated decisions.
Match controls to the classification. Customer-affecting systems need pre-deployment testing, meaningful human oversight and monitoring in production, because accuracy and fairness at launch do not guarantee them a year later as data and customer mix change.
Record each control as it operates, with a date and a name: test results, oversight decisions, incidents, approvals and reviews. Evidence assembled at the end of a period does not show that controls operated throughout it.
Models are replaced, providers change terms, data sources change and rules move. Set a review cycle for each system and triggers for material change, so the documentation moves with the system.
| Tier | Examples | Controls |
|---|---|---|
| High | Credit scoring, insurance pricing, automated account closure | Full validation before use, bias testing, human review of adverse decisions, quarterly monitoring, board reporting |
| Medium | Fraud and AML alert scoring, onboarding risk scores, customer chatbots | Validation, alert review by trained staff, six-monthly performance and fairness review |
| Low | Internal summarising, drafting and search tools | Acceptable use policy, data controls, annual review |
For firms that want this evidence held in one place, Hael, an AI governance platform from the founders of Buckingham Capital Consulting, records the AI inventory, risk assessments, controls and evidence that ISO/IEC 42001 and the EU AI Act call for.
Generative AI and AI agents need specific attention for two reasons. First, they sit outside traditional model risk frameworks: SR 26-2 excludes them in the US, and most model validation methods were designed for scoring models with fixed inputs. Second, they are usually bought from a small number of providers, so the firm's control rests on contracts, configuration and monitoring rather than on the model itself.
The firm remains answerable for outcomes in its business regardless of who built the model. Treating bought AI as out of scope is the most common gap in otherwise mature frameworks.
Commercial pressure now arrives before regulatory pressure. Banks, enterprise clients and partners send AI questionnaires as part of onboarding and contract renewal, and the answers need to come from records rather than memory.
Certification to ISO/IEC 42001 answers most of these questions in one document. The firm's step-by-step guide to ISO/IEC 42001 certification sets out the clauses, the audit stages and the realistic timeline.
An inventory and risk classification for a small number of systems usually takes a few weeks. Building controls and evidence takes a few months, depending on what already exists in the firm's risk and compliance framework. For most firms the binding deadline is commercial: a client's due diligence date or a contract renewal. Regulatory dates have moved once and may move again; commercial deadlines rarely do.
The firm's AI governance service covers AI governance reviews, EU AI Act and ISO/IEC 42001 readiness, policies and board reporting, and responses to client AI due diligence.
From 2 December 2027 for Annex III uses, which include creditworthiness assessment and credit scoring of individuals and life and health insurance pricing. The Digital Omnibus on AI moved this date from 2 August 2026.
No. Annex III expressly excludes AI systems used to detect financial fraud from the creditworthiness category. Fraud models are still governed by conduct, model risk and operational resilience rules.
No. The FCA states it does not plan to introduce extra regulations for AI and applies Consumer Duty, SM&CR, operational resilience and outsourcing rules to AI.
Yes, where a UK firm places an AI system on the EU market or the system's output is used in the EU, for example when scoring EU residents for credit.
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information.
No. SR 26-2, issued on 17 April 2026, states that generative and agentic AI models are not within its scope, so firms govern them through their wider risk management framework.
An inventory and risk classification usually takes a few weeks; controls and evidence take a few months. High-risk conformity work under the EU AI Act typically takes six to twelve months.
Buckingham Capital Consulting has worked with regulated financial firms on authorisation, governance and regulator engagement since 2013, including FCA EMI authorisations for Dzing Finance, Hryze and HFS. It supports boards and compliance teams with AI governance reviews, EU AI Act and ISO/IEC 42001 readiness, board reporting and responses to client AI due diligence.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.