Drawn from a closed-door session of senior financial services, FinTech, legal and regulatory leaders, with the regulator present throughout. These are conclusions rather than opinions.
Three working groups ran in parallel, on accountability and evidential control, on AI guardrails and staff capability, and on regulatory navigation and engineering sandboxes. What follows is where they converged.
01 Accountability is non-negotiable and non-transferable
Senior managers are accountable for AI-driven decisions under existing regulatory frameworks. That accountability does not move because a vendor’s terms say it does.
02 A vendor assurance is not a control
Assurances on data handling, model training and PII protection are not equivalent to engineering controls. Where the risk is material, the control has to be architectural.
03 Start with a data taxonomy, not a policy
Before any AI tool is granted access to data, define the fields in scope, classify them by sensitivity, and determine the appropriate handling for each. The taxonomy drives the technical controls; the policy documents them.
04 A governed gateway changes the dynamic
Centralising model access through a single governed interface, with masking, encryption, usage logging and role-based permissions, moves governance from aspiration to operation.
05 Evidence is a product of the architecture
The audit trail, the redaction report, the usage dashboard, the model selection record. These should be outputs of a well governed system, not retrospective compliance exercises.
06 Compliance has to move upstream
Compliance expertise belongs in the design sprint, the product pod and the architectural decision. Involvement at the point of deployment is too late to change anything.
07 Know your AI before you deploy it
Due diligence on an AI system should be a defined process, not an informal conversation: PII handling, data residency, training practices, audit capability, certifications and contractual protections.
08 ISO 42001 is a practical starting point
For firms already familiar with ISO 27001, the structure is analogous: governance policies, evidence of testing, documentation of process. Its requirements closely mirror what institutional buyers are already asking for.
09 Build the baseline before you build the product
Without a defined baseline, return on investment cannot be demonstrated, model drift cannot be detected, and the case for continued deployment cannot be made.
10 Safe experimentation needs a home
Internal sandboxes should be treated as a governance requirement for any organisation serious about AI adoption. Where internal infrastructure is not available, regulator-provided environments are worth engaging with directly.
Each of these carries detail that does not fit in a list: the working group discussions that produced them, a live demonstration of a governed AI gateway, the regulator’s responses to direct questions, and the five challenges the room identified as most pressing.
Author: Ian Davey, Founder & CEO, FinTech-Tables.
Read the report
This article draws on the AI Capability Building working session, convened by FinTech-Tables with Keeper Solutions and Higgs LLP. The full report sets out the keynotes, the three working group findings, the five key challenges and the ten takeaways in full.
