Compliance risk for AI and technology in financial institutions
Compliance risk from AI comes from outcomes, not technology: unfair or unexplainable decisions, misleading AI conversations, unlawful data use, weaker AML detection and vendor terms that breach outsourcing rules. Compliance teams manage it by setting requirements per use case, testing fairness and explainability before launch, sampling AI outputs, keeping evidence in one place and training staff on how AI fails.
Where does AI create compliance risk?
| AI use | Compliance risk | Key controls |
|---|---|---|
| Credit scoring and pricing | Unfair treatment; unexplainable declines; EU AI Act high-risk | Fairness metrics, reason codes, human review of edge cases |
| AML transaction monitoring | Missed suspicious activity; weak audit trail | Parallel runs, below-threshold testing, explainable alerts |
| Customer chatbots | Misleading advice; undisclosed AI; complaints | Disclosure, guardrails, conversation sampling |
| Staff productivity tools | Data protection breaches; confidentiality | Approved tools, DLP, acceptable-use standard |
| AI vendors and cloud | Outsourcing and data transfer breaches | Contract clauses, data location, audit rights |
How do we evidence AI compliance to a supervisor?
Keep, for each material use case: the inventory entry and materiality rating, the approval, pre-launch test results including fairness, monitoring reports, samples reviewed by compliance, complaints linked to AI, and the vendor contract terms. The eight-point checklist turns this into a quarterly self-check.
What has not changed?
Core compliance disciplines still carry most of the load: policies, training, monitoring, regulatory change tracking and independent testing. The compliance function register lists them by unit, and the founder's long-running compliance risk and AML training covers them in depth.
Guides in this topic
AI in AML compliance: benefits, risks and controls
How banks use AI in AML transaction monitoring and screening, the model and compliance risks it creates, and the controls supervisors expect.
Fair and explainable AI in lending decisions
How lenders keep AI credit decisions fair and explainable: fairness metrics, proxy checks, reason codes and human review, with EU AI Act and MAS context.
AI compliance checklist for banks, insurers and fintechs
A practical AI compliance checklist for banks, insurers and fintechs: policy, inventory, data, fairness, disclosure, vendors, records and training.
Primary sources (reviewed 17 Oct 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
- Regulation (EU) 2024/1689, the EU Artificial Intelligence Act
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- FATF: guidance on new technologies for AML/CFT
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
What compliance risks does AI create for banks?
The main ones are unfair or biased customer outcomes, decisions that cannot be explained, misleading customer communications from chatbots, unlawful use of personal data, weaker AML detection if models drift, and breaches of outsourcing rules through AI vendors.
Who is responsible for AI compliance?
Each AI use case has a business owner accountable for its outcomes. Compliance sets and monitors the conduct and legal requirements, risk owns the AI risk framework, and internal audit provides assurance.
Do customers have to be told they are dealing with AI?
Good practice and a growing number of rules expect disclosure when customers interact with AI, with a route to a human. The EU AI Act includes transparency obligations for certain AI interactions; check local requirements.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.