Financial institutions face regulatory risks with embedded AI services

Ask a procurement department at a bank where the artificial intelligence budget sits, and it will often struggle to point to a single line. What it can usually identify instead are budgets for document review, customer service, KYC remediation, translation, marketing production, reconciliation and other familiar tasks that AI is increasingly being used to perform.

That is the real story behind the current wave of adoption in financial services. The winning vendors are not alway...

s selling abstract capability. They are embedding themselves into pre-existing spend categories and promising the same result more quickly, more cheaply and with less internal disruption.

That shift matters because it changes both the commercial model and the governance burden. For several years, many institutions bought access to models or platforms and then asked internal teams to find useful applications. Success was often measured in licences, seats or usage. The newer model is more direct: the supplier delivers the finished work, then charges for the output, whether that is a resolved support ticket, a drafted legal document or an automated compliance task.

That approach is attractive because it sidesteps some of the most common barriers to adoption. There is no need to train large teams, redesign every workflow or persuade sceptical managers to justify another software subscription. The service arrives already packaged as an outcome. For a business line under constant cost pressure, that can be hard to resist.

Yet the convenience creates a blind spot. When a bank buys a model licence, it can usually fold the system into its own control framework, document it, test it, monitor it and review it periodically. When it buys a finished service, the model may never appear in the organisation’s inventory at all. On paper, the bank has only procured customer support, content production or document processing. In practice, it may be relying on a model making thousands of decisions over its data, without the risk function ever seeing the underlying system.

The regulatory implications are obvious. Frameworks such as SR 11-7 in the US, supervisory expectations in the UK and EU, and the EU AI Act all assume that institutions can inspect and govern the systems they rely on. But service-based procurement can obscure that dependency. The exposure does not disappear simply because the invoice describes the work differently.

That is why banks need to ask sharper questions of vendors. They should want to know what records are kept for each decision, including inputs, outputs and timestamps. They should ask what happens when the system is wrong, who detects the failure and how quickly the process stops. They should press for evidence on calibration as well as accuracy, particularly where the output is probabilistic. And they should establish whether the model can change without notice, because a system that is continually updated is not the same system that may already have been validated.

Several newer suppliers are building their products around exactly these concerns. RiskInMind, for example, has positioned its offer around transparent pricing for financial institutions, with different tiers aimed at community banks, credit unions and larger enterprises. Inceptive says its AI operating system is designed for fintech compliance, covering tasks such as KYB, AML triage, SAR drafting and vendor risk management, with a maker-checker structure intended to keep human oversight in place. Sky BlackBox has taken a vendor-based pricing approach to vendor risk management, charging according to the number of suppliers managed rather than the number of internal users. StandardC says its AI platform is built for privacy-first use in financial services, combining governed agent libraries, configuration tools and reporting for examiners, while Attestant advertises model compliance tooling for banks and credit unions with audit trails and validation checks tied to regulations including SR 11-7 and the EU AI Act. Nuviax, meanwhile, offers an AI gateway for banking that routes traffic across model providers, enforces spend limits and logs each call.

Taken together, those offerings point to a broader industry pattern. AI is no longer being purchased only as software to be explored internally. Increasingly, it is being bought as an operating layer for work that institutions already know how to pay for. That may be efficient, but it also means the governance conversation has to move earlier, not later.

The important distinction is not between AI and non-AI budgets. It is between low-cost outcomes and low-visibility outcomes. The latter can be more dangerous, because they are easier to approve and harder to audit.

For that reason, business lines should treat any externally delivered service that depends on model output as a candidate for the model inventory, regardless of how the invoice is worded. Risk teams, meanwhile, should start with records and failure handling before asking for headline accuracy figures. Vendors that can explain those basics are usually the ones that have thought seriously about control. Those that cannot are often asking buyers to trust the marketing more than the machinery.

Educational content, not financial advice.

Source: Noah Wire Services