AI Regulatory Considerations
Executive Summary
Key Takeaways
- ✓ AI use in finance intersects with a developing regulatory landscape spanning general AI risk management frameworks, sector-specific financial regulation, and jurisdiction-specific requirements.
- ✓ General AI risk management frameworks, such as the NIST AI RMF and ISO/IEC 42001, provide structured approaches to AI governance that inform, but do not themselves constitute, binding legal requirements in any specific jurisdiction.
- ✓ Disclosure expectations around AI use, whether and how a firm discloses that AI assisted in producing analysis supporting a material decision, are an area of active regulatory development that varies by jurisdiction and sector.
- ✓ Regulatory obligations relevant to AI use in finance depend materially on jurisdiction, sector, and the specific AI application involved, which is why this guide presents categories of consideration rather than definitive requirements.
- ✓ This guide is not legal advice; specific regulatory obligations should be confirmed with qualified legal counsel familiar with the firm's jurisdiction, sector, and specific AI use cases.
Objective¶
This guide sets out categories of regulatory consideration relevant to AI use in finance, within AI Financial Modelling & Artificial Intelligence in Finance. It is not legal advice.
General AI Risk Management Frameworks¶
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide structured approaches to AI governance, risk identification, and management practice, widely referenced across industries as good practice benchmarks. These frameworks inform the governance practices addressed throughout this domain, in AI Model Governance and elsewhere, but are not themselves binding legal requirements; binding obligations depend on the specific law and regulation applicable to a firm's jurisdiction and sector.
Sector-Specific Financial Regulation¶
Existing financial sector regulation, model risk management requirements, disclosure obligations, and fiduciary standards, may apply to AI-assisted finance work in ways that predate AI-specific regulation entirely, since a decision supported by AI-assisted analysis remains subject to the same underlying financial regulatory framework that would apply regardless of how the supporting analysis was produced.
Disclosure Expectations¶
Whether and how a firm should disclose that AI assisted in producing analysis supporting a material decision, an investment recommendation, a valuation, a risk assessment, is an area of active regulatory development that varies materially by jurisdiction and sector. This is a category of consideration this guide flags rather than resolves, since specific disclosure obligations are jurisdiction- and context-dependent.
Jurisdiction-Specific Requirements¶
AI-specific regulation is developing at different paces and with different approaches across jurisdictions, and a firm operating across multiple jurisdictions may face materially different requirements for the same AI application depending on where it is used and where the affected decision-maker or counterparty is located.
Why This Guide Stops at Categories, Not Requirements¶
Regulatory obligations relevant to AI use in finance depend materially on jurisdiction, sector, and the specific AI application involved, a level of specificity that varies faster and more granularly than general Knowledge Centre content can responsibly track. This guide's role is to flag the categories of consideration a firm should raise with counsel, not to state what any specific firm's obligations actually are.
Common Construction Pitfalls¶
Treating a general AI risk management framework as a compliance substitute. Adopting NIST AI RMF or ISO/IEC 42001 practices is good governance practice but does not by itself satisfy jurisdiction-specific legal requirements that may also apply.
Assuming existing financial regulation does not apply because AI was involved. Underlying financial sector regulatory requirements typically continue to apply to a decision regardless of how the supporting analysis was produced.
Applying a single jurisdiction's disclosure practice universally. A firm operating across multiple jurisdictions should confirm disclosure requirements separately for each relevant jurisdiction rather than assuming uniformity.
Recommended Practices¶
- Engage qualified legal counsel familiar with the firm's jurisdiction, sector, and specific AI use cases before finalising AI-related compliance positions.
- Treat general AI risk management frameworks as informing, not substituting for, jurisdiction-specific legal compliance.
- Confirm disclosure expectations for AI-assisted analysis separately for each relevant jurisdiction and sector.
- Revisit regulatory considerations periodically, given the pace at which AI-specific regulation is developing.
Continue Reading¶
Related Pillars¶
Related Technical Guides¶
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
Does this guide provide legal advice on AI regulation?
No. This guide sets out categories of regulatory consideration relevant to AI use in finance at a general level; it is not legal advice, and specific regulatory obligations should be confirmed with qualified legal counsel familiar with a firm's jurisdiction, sector, and specific AI use cases.
What are general AI risk management frameworks, and are they legally binding?
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide structured approaches to AI governance and are widely referenced as good practice, but they are not themselves binding legal requirements in any specific jurisdiction; binding requirements depend on applicable law and regulation.
What disclosure expectations exist around AI use in finance?
Whether and how a firm should disclose that AI assisted in producing analysis supporting a material decision is an area of active regulatory development that varies materially by jurisdiction and sector, making it an important area to confirm with counsel rather than assume.
Why does this guide present categories rather than specific requirements?
Because regulatory obligations relevant to AI use in finance depend materially on jurisdiction, sector, and the specific AI application involved, a level of specificity this guide cannot responsibly provide as general Knowledge Centre content.
What should a finance function do to manage regulatory risk around AI use?
Engage qualified legal counsel familiar with the firm's specific jurisdiction, sector, and AI use cases, and treat the general risk management frameworks and governance practices addressed across this domain as informing, not substituting for, that legal engagement.
References
Related Articles
AI Financial Modelling & Artificial Intelligence in Finance
AI financial modelling is the application of machine learning and generative AI techniques within the financial modelling process itself, driver identification, construction assistance, scenario generation, and narrative drafting, while artificial intelligence in finance is the broader application of those same technique categories across the finance function generally. This page is the hub for the Knowledge Centre's AI financial modelling content: the foundational distinction between machine learning, natural language processing, and generative AI; how AI accelerates modelling construction without replacing the auditable calculation layer beneath it; a staged framework for adopting AI reliably; enterprise applications across FP&A, forecasting, valuation, and investment analysis; governance and risk practice; and the institutional best practice synthesis this domain builds toward.
AI Model Governance
AI model governance establishes ownership, documented scope and limitations, change control, and periodic re-validation for machine learning and generative AI models used within a finance function. This guide sets out the governance elements specific to AI models, distinct from but complementary to the financial model governance a firm already applies to its spreadsheet and system models, and why an AI model's statistical nature requires governance triggers a static formula-based model does not.
AI Ethics in Finance
AI ethics in finance addresses considerations distinct from, though related to, the regulatory and governance topics covered elsewhere in this domain: fairness in decisions an AI-generated analysis influences, appropriate transparency with parties affected by an AI-influenced decision, and accountability that remains with a human or institution regardless of how sophisticated the underlying AI analysis was. This guide sets out these considerations as practical questions a finance function should be able to answer about its own AI use.
AI Risk Management
AI risk management brings together the distinct risk categories addressed across this domain, hallucination, model drift, explainability limitations, fairness, regulatory exposure, and accountability diffusion, into a single risk register structure a finance function can maintain and review as part of its broader risk management practice. This guide sets out that register structure and how it connects to the governance, validation, and quality assurance practices addressed elsewhere in this domain.