Independent analysis by Jonas Mohamed Osman Abdelghafour, known as Yonas Osman, CEO of Quantica Risk Modelling. This article is educational and is not legal advice.
AI compliance in financial services is not a single policy or a software certificate. It is a control system that connects each use case to its purpose, data, risk classification, accountable owner, validation evidence and monitoring plan. A bank or insurer should be able to explain what an AI system does, why it is permitted, how it was tested and what happens when it fails.
Build the inventory first
Record every model, vendor tool, generative-AI assistant, scoring engine and automated decision workflow. Capture the business process, affected customers, data categories, human role, model owner, deployment location and supplier. An inventory that excludes spreadsheets, embedded vendor functions or experimental tools creates false comfort.
Classify the use case
Classify each system under the relevant legal and internal risk taxonomy. Consider prohibited practices, high-risk functions, general-purpose models, personal-data processing, outsourcing and prudential model risk. Classification should be documented before procurement or production release, not reconstructed after an incident.
Control the lifecycle
Set minimum requirements for design, data quality, fairness, explainability, security, performance, human oversight, change control, incident reporting and retirement. Map those controls to the three lines of defence and retain evidence in a decision-ready register.
The European Commission AI regulatory framework and the NIST AI Risk Management Framework provide useful reference points. Quantica Risk Modelling recommends a proportionate, risk-based implementation rather than treating compliance as a checklist.