Governance is how leaders say yes
Most finance leaders think governance is the brake. It is the opposite - it is the thing that lets you take your foot off the brake. A team with no rules either freezes out of fear or pastes confidential numbers into a free chatbot; a team with a clear, light governance stack can adopt quickly because everyone knows where the lines are. Tonight is not about writing policy from scratch. It is about knowing the seven ways AI hurts a finance function, the four regulatory regimes already watching, and the six controls that cover almost all of it - then scanning your own team against them.
The finance-specific risks 7 min live
Every industry worries about AI errors. Finance has its own flavours, because a wrong number here flows into a filing, a credit decision, or a board pack - and someone is legally accountable for it. These are the seven that should be on your risk register, and they layer into a stack of controls you can actually manage.
LiveFabricated figures and model risk - the two that hit a P&L3 min▶
The first family of risk is about wrong numbers reaching a decision. Two forms matter most to you.
- Hallucinated or fabricated figures. As the builder track shows in b1, an ungrounded model invents confident, well-formatted numbers. In finance that fiction can land in a board slide, a forecast, or a filing before anyone checks it.
- Model risk. Any model used in a decision - a forecast, a credit score, a fraud flag - can be wrong in ways that are systematic, not random. Regulators treat this as its own discipline (that is what SR 11-7 is about, Part 2).
- Over-reliance. The quieter danger. When the output looks polished, people stop checking. A team that trusts the draft blindly has re-created the fabrication risk with extra steps.
The confident forecast nobody questioned. A planning team let an AI assistant generate a driver-based forecast and, because it read cleanly, pushed it to the CFO with light review. A sign flip in one driver had inverted a segment's trajectory. It survived two meetings before a controller re-derived the math by hand. The fix was never a better model - it was a mandatory human check on any number that leaves the team.
LiveExplainability, data leakage, and bias - the ones that draw regulators3 min▶
The second family is about defensibility and fairness - and it is where the law is most explicit.
- Explainability. The leader's version of this question is blunt: can you defend this number to an auditor or a regulator? "The AI produced it" is not an answer. If you cannot trace how an output was reached, you cannot stand behind it.
- Data leakage. Pasting real financials, MNPI, or client PII into an ungoverned tool can breach securities law, PDPA/GDPR, and confidentiality obligations at once. This is rail one, and it is the bottom layer of the stack for a reason.
- Bias in credit and fraud. A model that scores creditworthiness or flags fraud can encode discrimination against protected groups - which is exactly why the EU AI Act treats credit scoring as high-risk (Part 2).
Self-studyAI-washing - the risk that points outward2 min read▶
Every risk above is about AI harming your own numbers. AI-washing is the mirror image: overstating what your AI does, to clients, investors, or the market. The SEC has already penalised firms for it. For a finance leader this shows up in marketing copy, investor decks, and product claims - and the rule is simple: be exactly as honest externally about your AI as you are internally. If your team would not say it in a control review, do not put it in a brochure.
The regulatory map 5 min live
You do not need to read the statutes - your compliance and legal teams do. But you do need the leader's-eye view, so you can ask the right questions and recognise when a use case has crossed into regulated territory. Four regimes shape almost every finance AI conversation today.
LiveWhat each regime actually demands of finance3 min▶
| Regime | What it demands of a finance function |
|---|---|
| US Fed SR 11-7 - model risk management | Keep an inventory of models in use, validate them independently, and monitor them over time. Treats any model driving decisions as a governed asset, not a spreadsheet. |
| EU AI Act - risk tiers | Classifies AI used for credit scoring as high-risk, triggering extra duties: documentation, human oversight, data quality, and transparency. Higher risk = more obligations. |
| Singapore MAS FEAT / Veritas | Four principles for AI in financial services: Fairness, Ethics, Accountability, Transparency. Principles-based - asks you to show you took them seriously. |
| SEC / FINRA - marketing + AI-washing | Scrutinises overstated AI claims in marketing and disclosures. Say only what you can demonstrate; accountability for the claim stays with the firm. |
Self-studyThe pattern underneath all four2 min read▶
Read together, the four regimes are asking for the same handful of things in different accents:
- Know your models. An inventory - what AI is in use, for what, owned by whom (SR 11-7).
- Match effort to risk. A credit model gets more scrutiny than a memo drafter (EU AI Act tiers).
- Keep a human accountable. Someone owns the decision, always (FEAT accountability, SR 11-7).
- Be able to explain and evidence it. Documentation, audit trail, honest external claims (FEAT transparency, SEC).
If your governance stack (Part 3) delivers those four, you are most of the way to defensible under any of these regimes - which is exactly why the stack is worth more than memorising any single rule.
The governance stack you actually need 5 min live
Here is the good news: you do not need a governance function the size of a bank's to be responsible. Six controls cover the vast majority of finance AI risk, and each one is a management decision, not a technical build. This is the leader's mirror of what the builder track constructs in b10.
LiveThe six controls, in the order to build them3 min▶
- Acceptable-use policy. One page: what AI may and may not be used for, which data may never go in, who to ask when unsure. The thing everyone signs up to.
- Tool tiers. Decide which tools are cleared for which data - consumer (public/synthetic only), enterprise (real financials, contractually no training), local (most sensitive). The privacy line made concrete.
- Human-in-the-loop on all decisions. Every workflow that produces a number, decision, or external output has a named human who reviews and owns it. Rail two as an org rule.
- Logging and audit trail. Keep a record of significant AI-assisted work: the ask, the output, the approver. This is what lets you answer the auditor's question.
- Model inventory. A living list of AI tools and models in use, what they do, and who owns each. You cannot govern what you have not written down.
- Review cadence + incident plan. A regular check that the above is being followed, and a pre-agreed plan for when something goes wrong - who is told, what stops, how you remediate.
Six controls in an afternoon. A mid-size finance team stood up all six in a single workshop: a one-page policy, three tool tiers, a sign-off rule, a shared log, a model list in a spreadsheet, and a quarterly review on the calendar. None of it was technical. It was enough to move from "quietly nervous" to "openly adopting" - and enough to satisfy their first internal audit.
Self-studyRight-sizing the stack to your risk2 min read▶
Not every team needs the heaviest version of every control. Match the weight to the risk:
- Drafting and summarising (commentary, memos) → policy + tool tiers + a light human edit is enough.
- Analysis and forecasting → add human sign-off on any number that leaves the team, plus logging.
- Credit, fraud, or anything about a person's money → the full stack, plus model inventory and validation, because this is where SR 11-7 and the EU AI Act bite hardest.
The art of governance is not maximum control everywhere - it is proportionate control, heaviest where a mistake hurts a person or breaks a law.
Run a governance gap-scan on your team ◐ 20-30 min
No code, no tools - a table and an honest conversation. Score your team against the six controls, then turn the two biggest gaps into named owners and dates. This is the artifact you take back to your risk or exec meeting.
- Score each control. For all six - policy, tool tiers, human-in-loop, logging, model inventory, review cadence + incident plan - mark your team as Solid, Partial, or Missing. Be honest; "we talked about it once" is Missing.
- Find the leak. Where is real financial data or client PII most likely to reach an ungoverned tool today? That gap goes to the top of the list regardless of its score.
- Pick two to close this quarter. Choose the two gaps that reduce the most risk for the least effort. Give each a named owner and a date. Two done beats six planned.
- Draft the vendor questions. Before you license or renew any AI tool, you should be able to answer: does it train on our data? What is the data retention? Can it explain its outputs? Does it keep audit logs we can access? Write your version of these into a standing procurement checklist.
Official sources covered
This session teaches the leader's working view of the finance-AI regulatory canon. The statutes, official guidance, and any binding interpretation stay with the regulators and your own legal and compliance teams - said honestly. This session covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · At its core, what is US Fed SR 11-7 about?
SR 11-7 treats any model driving decisions as a governed asset: know what models you run, validate them independently, and watch them for drift. It is the backbone of the model-risk layer in your stack.
2 · Why does the EU AI Act single out credit scoring for extra duties?
The Act scales obligations to risk. Credit scoring affects a person's access to money, so it lands in the high-risk tier, triggering documentation, human oversight, data-quality, and transparency duties.
3 · Your team used AI to help produce a number in a filing. Why does an audit trail matter?
"The AI produced it" is not a defence. An audit trail - the ask, the output, the human approver - is what lets you explain and stand behind an AI-assisted number when someone asks how you got there.