AI governance for regulated firms: start with the inventory

AI adoption in financial services rarely arrives through a formal programme. It arrives inside tools the business already licenses — a summarisation feature in a CRM, a scoring model bundled with an onboarding vendor, an assistant embedded in a helpdesk. By the time a governance framework is drafted, the estate already exists.

The first deliverable is therefore an inventory: every model or AI-enabled feature in use, its purpose, the data it processes, whether outputs influence customer outcomes, and who owns it. Risk classification under the EU AI Act, and the controls that follow, are impossible without it.

From there, governance is conventional risk management applied to a new asset class: documented purpose, human oversight where outcomes are material, monitoring for drift, and contractual clarity about what vendors do with your data. Firms that treat AI as a new category of third-party and model risk, rather than a novel discipline, get to a defensible position faster.