Businesses
The Urgency of AI Governance and Compliance
28 Oct 2026
The Ledger and the Oracle
The art of war is of vital importance to the State.
— Sun Tzu, The Art of War
In 1494, in Venice, a Franciscan friar named Luca Pacioli published a book of mathematics that contained, almost in passing, the first printed description of double-entry bookkeeping. Every debit would have a matching credit. Every transaction would carry a date, a sum and a name. Merchants who had traded on memory and reputation could now trade on records. Banks that had lent on trust could now lend on evidence. Pacioli did not invent capitalism, but he gave it a spine. For five centuries, every serious financial decision has had an author.
Now move forward to a Monday morning in London in 2026. A wealth manager's AI assistant drafts a suitability letter for a retired client. A second system checks the letter against the firm's product rules. A third sends it. Two weeks later the client complains that the recommended product was far riskier than she understood. The compliance officer opens the file and asks the oldest question in finance: who decided?
No one in the room can answer. The adviser did not write the letter. The model did not "decide" in any sense a court would recognise. The vendor's contract disclaims responsibility for outputs. The approval workflow shows a green tick, but nobody can say what the tick approved. The ledger, for the first time in five hundred years, has a gap where the author should be.
This whitepaper is about closing that gap.
The oracle problem
Artificial intelligence is not the first technology to change finance. The telegraph, the computer, the spreadsheet, electronic trading and the internet all did so. What makes AI different is that it produces decisions, or something very close to decisions, faster than any human can review them, and in a form that even its builders cannot always explain. Earlier systems followed rules that people wrote. Modern AI systems learn patterns from data and return probabilities. They behave less like a ledger and more like an oracle: they give answers, often good ones, without showing their working.
An oracle is useful. The ancient Greeks travelled for weeks to consult the one at Delphi. But they did not let the oracle run the city. They built institutions around it: priests who interpreted, assemblies that debated, generals who took responsibility for acting on what they heard. The question for every organisation using AI today is the same one the Greeks answered with institutions: how do we use the oracle's power without surrendering our judgement and our accountability?
That is what AI governance is. It is the set of policies, decision rights, technical controls and legal obligations that determine how an organisation develops, buys, deploys and monitors AI systems, and who answers for the results. Inside a firm, it is a management discipline: an inventory, a risk classification, approval gates, documentation and monitoring. Outside the firm, it is a set of public frameworks that shape that discipline: binding law such as the European Union's AI Act, voluntary standards such as the US National Institute of Standards and Technology's AI Risk Management Framework, and certifiable management standards such as ISO/IEC 42001.
Governance, compliance and security
Three words are often used as if they were one. They are not, and confusing them is one of the most common reasons programmes fail.
- Governance sets direction. It defines who owns each AI system, what risks the firm is willing to take, and who may approve changes. It answers the question should we?
- Compliance translates external law and regulation into internal controls, keeps the firm ready for audit and maintains the record. It answers the question can we prove it?
- Security protects data, models and agents from attack: prompt injection, data poisoning, model theft, leakage of client information. It answers the question can anyone break it?
A firm that has security without governance will build well-defended systems that do the wrong thing. A firm that has compliance without governance will produce paperwork that describes systems no one actually controls. A firm that has governance without security will make sound decisions about systems that an attacker can quietly redirect. The three must work as one operating system, and this book treats them that way.
Why now
Adoption has outrun control. The Bank of England and the Financial Conduct Authority surveyed UK financial firms in 2024 and found that 75% were already using AI, with a further 10% planning to within three years. In the same survey, 46% of firms said they had only a partial understanding of the AI technologies they used, against 34% who reported a complete understanding. Much of that gap came from models supplied by third parties.
Across the economy the pattern repeats. Stanford's AI Index 2026 reports that 88% of organisations have adopted AI in some form. A DigiCert survey of 1,001 IT and security leaders in the US, UK and Australia, fielded in May 2026, found that 78% had experienced an AI-related security incident or identified an AI-related vulnerability, while almost half lacked centralised visibility into their AI systems and activity. A study by WSJ Intelligence and Code and Theory of 801 executives at large US companies found that a quarter said no one was accountable for orchestrating AI, against an average of 183 AI tools per organisation.
Regulators have noticed. In 2026 alone, the FCA published the Mills Review on the future of AI in retail financial services; the Monetary Authority of Singapore issued formal guidelines on AI risk management; the Central Bank of the UAE issued a guidance note on the responsible use of AI; Hong Kong's four financial regulators launched an expanded generative AI sandbox; and the European Union amended its AI Act to reset the timetable for high-risk systems. The Bank of England's Financial Policy Committee warned in July 2026 that rapid advances in frontier AI had "significantly increased financial stability risks".
The FCA has been explicit that it does not intend to write a new rulebook for AI. Alex Smith, who leads its cross-cutting policy work, wrote in June 2026: "We have been clear that we are not going to introduce new regulations for AI." Some read this as relief. It is the opposite. It means that every existing duty (the Consumer Duty, the Senior Managers and Certification Regime, the rules on systems and controls, the rules on operational resilience) already applies to every AI system a firm uses, and that firms are expected to work out how for themselves.
What governance is not
It is worth being precise about the edges of the subject.
AI governance is not data governance, although it depends on it. Data governance manages the quality, lineage, access and retention of data. AI governance also covers the behaviour of models, the outputs they produce and the accountability for decisions made with them.
It is not AI ethics. Ethics describes principles such as fairness and transparency. Governance is the machinery that turns those principles into roles, controls and evidence.
It is not AI safety in the research sense, which concerns preventing severe failures in the most powerful models. Safety research feeds governance but is not a substitute for it.
And it is not regulation alone. Governance includes compliance with the law, but it also covers the many places where no law yet applies and the firm must decide for itself.
The Urgency
"Those who cannot remember the past are condemned to repeat it." — George Santayana, The Life of Reason (1905)
On the morning of 15 September 2008, Lehman Brothers filed for bankruptcy. In the inquiries that followed, one theme recurred. The firm, and many like it, had relied on models that few senior people fully understood, to measure risks that no single person fully owned. The board could not see its own exposure. Accountability was spread so thinly across desks, committees and counterparties that, when the losses came, it seemed to belong to no one.
The technology of 2008 was not artificial intelligence. But the failure was a failure of governance: complex models, distributed responsibility, and a gap between what the institution was doing and what its leaders could see. In 2026 the models are more powerful, more widely used and harder to explain. They price credit, screen for fraud, answer customers and draft regulatory reports. If the governance gap of 2008 reappears around AI, it will open faster and reach further.
This article explains why the period of voluntary, unhurried AI governance has ended, and gives leaders a way to measure where their organisation stands.
From principles to machinery
The phrase "AI governance" entered common use in 2019. That year, Singapore's Personal Data Protection Commission published the first national Model AI Governance Framework in January; the European Commission's High-Level Expert Group published its Ethics Guidelines for Trustworthy AI in April; and in May the Organisation for Economic Co-operation and Development adopted its AI Principles, revised in 2024 and now endorsed by 47 adherents.
These were statements of principle. They described what good AI should look like (fair, transparent, robust, accountable) but left organisations to work out how. Over the following seven years, principles became machinery.
The European Commission proposed the AI Act in April 2021. NIST released its AI Risk Management Framework 1.0 on 26 January 2023, organised around four functions: Govern, Map, Measure and Manage. On 18 December 2023, ISO and the International Electrotechnical Commission published ISO/IEC 42001, the first certifiable management system standard for AI. The EU AI Act entered into force on 1 August 2024. Its prohibitions and its AI literacy duty applied from 2 February 2025; obligations for general-purpose AI models from 2 August 2025; and general application from 2 August 2026. In July 2026, the EU's Digital Omnibus amendment, Regulation (EU) 2026/1744, reset the timetable for high-risk systems: stand-alone high-risk systems now fall due on 2 December 2027, and AI embedded in regulated products on 2 August 2028.
In finance, the shift was just as clear. The FCA launched its AI Lab in October 2024. The Bank of England and the FCA published their third survey of AI in UK financial services in November 2024. The US Treasury and its public-private partners released a Financial Services AI Risk Management Framework on 19 February 2026. Hong Kong's regulators expanded their generative AI sandbox on 5 March 2026. The FCA's Mills Review followed in July 2026, and the Monetary Authority of Singapore's AI Risk Management Guidelines on 7 October 2026, with obligations phasing in from October 2027.
The direction of travel is unmistakable. What was once a matter of corporate values is now a matter of supervisory evidence.
Five forces that made 2026 the turning point
First, AI now acts as well as answers. The first wave of generative AI drafted text that humans reviewed. The current wave of agentic AI takes actions: it books, buys, sends, approves and hands tasks to other agents. Agents can drift from their original purpose as they pass work along a chain. Governance designed for a system that suggests is not enough for a system that does.
Second, regulators now name AI explicitly. Earlier guidance spoke of models, algorithms and technology in general. In 2026, the FCA, MAS, the Central Bank of the UAE and Hong Kong's regulators all published material specifically about AI in finance. Supervisors now have a vocabulary, and they are using it in their questions.
Third, systemic risk is on the record. The Bank of England's Financial Policy Committee stated in its July 2026 Financial Stability Report that rapid advances in frontier AI capabilities had increased financial stability risks, particularly for cyber and operational resilience. When a central bank says this in a stability report, it becomes a board-level matter for every bank and insurer it oversees.
Fourth, incidents are already common. The DigiCert survey found that 78% of organisations had experienced an AI-related security incident or identified an AI-related vulnerability, and that almost half lacked centralised visibility into their AI systems. Ninety per cent discussed AI governance at executive or board level, but only half had a formal AI governance programme. Discussion is not control.
Fifth, dependence is concentrated. The Bank of England and FCA survey found that the top three providers accounted for 73% of named cloud providers, 44% of named model providers and 33% of named data providers used by UK financial firms. A third of AI use cases were third-party implementations, up from 17% in 2022. When a handful of suppliers sit behind a large share of the market's AI, a failure at one becomes a failure at many.
The eight dimensions to assess
Governance becomes manageable when it is broken into parts. This book uses eight dimensions, each of which a supervisor can test and a board can measure.
- Governance ownership and accountability. Who owns AI at board and executive level, and who owns each system? In the UK, this should map to a named senior manager under the Senior Managers and Certification Regime. The red flag: "the data science team" or "IT" given as the answer.
- AI inventory and visibility. Does the firm have a complete list of the AI it builds, buys and accesses through vendors, including AI embedded in software it already uses? Unsanctioned tools used by staff (shadow AI) sit outside any inventory by definition. The red flag: an inventory of six tools in a firm where staff use forty.
- Risk classification. Is each system tiered by the harm it could cause? The EU AI Act supplies a familiar scale: prohibited, high-risk, limited-risk and minimal-risk. Firms should add their own commercial and conduct tiers. The red flag: every system reviewed in the same way, regardless of impact.
- Policies and controls. Are there written rules on approved uses, data handling and human review, and are they enforced in the workflow rather than on paper? The red flag: a policy no one has read and no system enforces.
- Data and model governance. Is training and input data of known quality and lawful origin? Are models validated, versioned and tested for bias? The red flag: no one can say which version of a model produced a given decision.
- Human oversight. Where does a human review, approve or override, and do they have the time, information and authority to do so meaningfully? The red flag: a human "in the loop" who approves hundreds of outputs an hour.
- Monitoring and auditability. Are outputs, drift, incidents and vendor changes logged and reviewed? Could an auditor reconstruct a decision six months later? The red flag: a vendor quietly updates its model and nobody notices.
- Governance across the AI lifecycle. Does governance run from idea to retirement (design, procurement, testing, deployment, monitoring, change and decommissioning) or does it stop at launch? The red flag: an approval at go-live and nothing afterwards.
The maturity journey
Organisations move through five stages of maturity.
- Ad hoc. Visibility is limited and decisions are reactive. AI arrives through individual enthusiasm and vendor upgrades. Nobody has a complete picture.
- Defined. Basic policies and controls exist. There is an approved-tools list, a named owner and a first inventory.
- Managed. Processes are standardised and monitoring is in place. Systems are risk-tiered, high-risk systems pass through approval gates, and incidents are logged.
- Integrated. Governance is embedded across functions. Risk, compliance, technology, data and the business work from one register. Training is tied to the systems people use.
- Optimised. Governance is proactive and data-driven at scale. Controls are partly automated, evidence is generated as a by-product of work, and the firm can adopt new AI quickly because its governance is trusted.
Most firms will find they sit at different stages on different dimensions. That is normal. The weakest dimension usually sets the pace for the whole programme, because a supervisor will find it first.
Case study · Knight Capital, 1 August 2012
On 1 August 2012, Knight Capital, then one of the largest market makers in US equities, deployed new trading software. A configuration error reactivated dormant code on one of its servers. In about 45 minutes after the market opened, Knight's router sent more than four million orders while trying to fill 212 customer orders. The firm lost more than $460 million, according to the US Securities and Exchange Commission. It needed an emergency rescue and was later acquired. The SEC fined Knight $12 million for breaching the market access rule, finding that it lacked adequate controls and procedures.
Knight's system was not AI. But every element of an AI governance failure was present: an automated system acting at machine speed; a change deployed without adequate control; no effective kill switch; and monitoring that did not alert humans in time. If a deterministic system with known code could do this in 45 minutes, the case for governing probabilistic systems with learned behaviour needs no further argument.
Toolkit · The 8 × 5 maturity self-assessment
Score your firm from 1 (Ad hoc) to 5 (Optimised) on each of the eight dimensions. Ask three people to score independently: a business leader, a risk or compliance leader and a technology leader. Where scores differ by more than one point, you have found a blind spot. Take the lowest-scoring dimension as your first priority.
Board questions
- How many AI systems do we use, including those embedded in vendor software?
- Who is the named senior manager for each, and is it in their Statement of Responsibilities?
- Which of our AI systems affect credit, pricing, suitability or claims decisions?
- When did the board last receive an AI incident report?
- On the eight dimensions, which maturity stage are we at, honestly?
Sources
UK regulators and survey data
- Bank of England and FCA, "Artificial intelligence in UK financial services – 2024" (75% using AI; 46% partial understanding; third-party share): https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
- Tech Monitor, on the same survey (46% partial vs 34% complete understanding): https://techmonitor.ai/?p=412091
- Burges Salmon, on the survey's third-party concentration figures (73% cloud, 44% model providers): https://www.burges-salmon.com/articles/102jpbu/ai-hot-off-the-press-from-the-bank-of-england-and-fca-how-is-it-being-used-ac
- Bank of England, Financial Stability Report, July 2026: https://www.bankofengland.co.uk/-/media/boe/files/financial-stability-report/2026/financial-stability-report-july-2026.pdf
- Regulation Tomorrow, "BoE publishes latest Financial Stability Report" (7 July 2026; frontier AI and financial stability risk): https://www.regulationtomorrow.com/2026/07/boe-publishes-latest-financial-stability-report-2/
- FCA, "AI and the future of retail financial services (The Mills Review)": https://www.fca.org.uk/publications/corporate-documents/mills-review
- FOW, "Collaboration becomes ever more important as FCA prepares AI guidance" (Alex Smith quote, June 2026): https://www.fow.com/insights/collaboration-becomes-ever-more-important-as-fca-prepares-ai-guidance
- Regulation Tomorrow, "FCA speech on ten years of innovation and launch of new AI Lab" (October 2024): https://www.regulationtomorrow.com/2024/10/fca-speech-on-ten-years-of-innovation-and-launch-of-new-ai-lab/
International regulators and frameworks
- Monetary Authority of Singapore, "MAS sets out supervisory expectations on responsible AI adoption by financial institutions" (7 October 2026): https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions
- Central Bank of the UAE, guidance note on responsible use of AI in the financial sector (2026): https://www.centralbank.ae/media/mykn5fue/cbuae-issues-guidance-note-to-protect-consumers-and-ensure-responsible-use-of-artificial-intelligence-in-the-financial-sector-en.pdf
- HKMA, "Regulators launch GenA.I. Sandbox++" (5 March 2026): https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/03/20260305-3
- US Treasury Financial Services AI Risk Management Framework (19 February 2026), summarised by ZwillGen: https://www.zwillgen.com/artificial-intelligence/us-treasury-department-publishes-ai-guidance-financial-services/
- OECD, AI Principles overview (adopted 2019, updated 2024; 47 adherents): https://oecd.ai/en/ai-principles
- Digital Policy Alert, "First edition Model AI Governance Framework" (Singapore, 2019): https://digitalpolicyalert.org/change/9912-first-edition-model-ai-governance-framework
- Osler, "NIST launches version 1.0 of AI Risk Management Framework" (January 2023): https://www.osler.com/en/resources/regulations/2023/national-institute-of-standards-and-technology-launches-version-1-0-of-ai-risk-management-framework
- IEC Webstore, ISO/IEC 42001:2023: https://webstore.iec.ch/publication/90574
EU AI Act and Digital Omnibus
- Burges Salmon, "AI literacy on the agenda: EU, UK and US" (entry into force 1 August 2024; Article 4): https://www.burges-salmon.com/articles/102jhol/ai-literacy-on-the-agenda-eu-uk-and-us
- Mondaq, "EU Digital Omnibus on AI enters into force" (Regulation (EU) 2026/1744; new high-risk dates): https://www.mondaq.com/uk/new-technology/1825722/eu-digital-omnibus-on-ai-enters-into-force
- Software Improvement Group, EU AI Act summary (application timeline): https://www.softwareimprovementgroup.com/eu-ai-act-summary/
Adoption and security surveys
- DigiCert, "Latest DigiCert research shows AI security risks already hitting enterprises, with 78% reporting incidents" (July 2026): https://www.digicert.com/news/latest-digicert-research-shows-ai-security-risks-already-hitting-enterprises-with-78-Reporting-Incidents
- PPC Land, "DigiCert: 78% of firms face AI incidents, half lack governance": https://ppc.land/digicert-78-of-firms-face-ai-incidents-half-lack-governance/
- Neodata Group, "AI Index Report 2026: what actually matters for organizational leaders" (88% adoption): https://neodatagroup.ai/ai-index-report-2026-what-actually-matters-for-organizational-leaders/
Case study
- US Securities and Exchange Commission, "SEC Charges Knight Capital With Violations of Market Access Rule" (October 2013): https://www.sec.gov/news/press-release/2013-222
History and quotations
- ICAEW Library, "Earliest books on bookkeeping" (Pacioli, 1494): https://www.icaew.com/library/library-collection/historical-accounting-literature/earliest-books-on-bookkeeping
- MacTutor, University of St Andrews, Alan Turing quotations: https://mathshistory.st-andrews.ac.uk/Biographies/Turing/quotations
Share
Dinis Guarda
Dinis Guarda is an author, entrepreneur, founder CEO of ztudium, Businessabc, citiesabc.com and Wisdomia.ai. Dinis is an AI leader, researcher and creator who has been building proprietary solutions based on technologies like digital twins, 3D, spatial computing, AR/VR/MR. Dinis is also an author of multiple books, including "4IR AI Blockchain Fintech IoT Reinventing a Nation" and others. Dinis has been collaborating with the likes of UN / UNITAR, UNESCO, European Space Agency, IBM, Siemens, Mastercard, and governments like USAID, and Malaysia Government to mention a few. He has been a guest lecturer at business schools such as Copenhagen Business School. Dinis is ranked as one of the most influential people and thought leaders in Thinkers360 / Rise Global’s The Artificial Intelligence Power 100, Top 10 Thought leaders in AI, smart cities, metaverse, blockchain, fintech.
