AI governance for regulated firms: the working overview
The rules were already there. This series maps them to controls a small firm can actually run.
AI governance is the set of controls a firm runs so its use of AI stays safe, evidenced and defensible: an inventory of the AI in use, a named accountable owner, human review of client-facing output, due diligence on AI vendors, and records that prove all of it. Regulators worldwide have converged on those five expectations.
Very few regulators have written an AI rulebook, and most have said they do not intend to. That has led many smaller firms to a comfortable and wrong conclusion: that AI use is ungoverned until a rulebook arrives. The reality across every jurisdiction this series covers is the opposite — existing obligations attached the moment your firm first used AI near client data or client-facing work. The question is never "what will the AI rules say?" It is "which of our existing obligations does this tool touch, and can we evidence that we are meeting them?"
The encouraging part: regulators worldwide have converged on what they expect that evidence to look like. Five controls come up in every serious supervisory statement, from the FCA to MAS to the SEC:
- An inventory. A current register of every AI tool in use — including the unofficial ones. You cannot govern what you have not identified.
- A named owner. One senior person accountable for AI use, with approval authority over new uses. Accountability does not transfer to a model or a vendor.
- Human review of client-facing output. Meaningful review, not a rubber stamp — designed to catch AI-specific failure modes like fabricated sources.
- Vendor due diligence. Where client data goes, whether it trains models, what happens when the vendor fails — answered before adoption, refreshed at renewal.
- Records that prove all of it. An audit trail of what the AI did, what a human changed, and who approved — because to a regulator, undocumented control is no control.
Everything else is proportionate detail: how each control anchors to your regulator's specific hooks, and how heavyweight the paperwork needs to be (for a 5–30 person firm: not very). That detail is what the guides below carry.