Set out recommended regulatory practice on AI, covering supervisors' own use of AI and policy advice on how regulated firms should use it.
The idea
Recommended regulatory practice has two sides. For regulated firms, policy advice is that existing, technology-neutral rules should be reviewed first for gaps before AI-specific rules are written. Firms should have governance and clear senior accountability, and risk management proportionate to the materiality of each use. They also need model validation and ongoing monitoring, sound data quality, explainability, human oversight, and third-party risk management with due diligence and exit plans. Outsourcing never transfers responsibility for outcomes. For supervisors, the advice is to build skills and data, and to close gaps in information about AI use and provider dependencies. Supervisors should also use AI themselves to analyse large data sets and detect misconduct, with human review, validation and explainability so that decisions can be justified. The usual error is thinking that regulators should ban AI or that a vendor carries the firm's responsibility. For the exam, remember proportionality and human accountability.
A practice question
Which is a policy recommendation for firms using AI in capital markets?
- Avoid AI altogether in trading and surveillance until regulators approve every model individuallyWhy not: Recommendations do not call for banning use or for case-by-case approval of every model.
- Governance and risk management proportionate to materiality, with senior accountability - correct
- Use AI only for tasks with no effect on clients or marketsWhy not: Not a recommendation; the advice is to manage risk in line with use, not to limit use to trivial tasks.
- Delegate accountability to the AI vendor through a contractWhy not: Responsibility stays with the firm; a contract cannot transfer it.
Recommended practice is proportionate governance: controls and oversight scale with materiality, and senior management stays accountable.
A harder one
A broker-dealer buys a third-party language model to support client communications. What is the recommended approach from a regulatory perspective?
- Rely on the vendor's contract, since responsibility for outcomes transfers to the providerWhy not: Outsourcing does not transfer regulatory responsibility to the provider.
- Skip due diligence if the provider is itself a regulated financial institutionWhy not: Provider status does not remove the need for the firm's own assessment.
- Carry out a single review at onboarding and no further monitoring of the provider afterwardsWhy not: Ongoing monitoring is needed because models and services change over time.
- Do due diligence, monitor the provider and plan for exit, as the firm remains responsible - correct
Third-party risk management covers due diligence, ongoing oversight and exit planning. The regulated firm remains accountable for what the AI does in its name.
The hardest tier
A supervisor builds an AI tool to detect manipulative trading patterns. Which safeguard is most consistent with recommended practice?
- Automatic penalties for every alert, to save time and ensure consistency across casesWhy not: Removes human judgement and explainability, and risks wrongful sanctions.
- Human review of alerts, documented validation and bias testing, and explainable findings - correct
- Relying on the vendor's marketing claims in place of independent testing by the supervisorWhy not: Supervisors need their own validation; vendor claims are not enough.
- Validation only on the data used to train the tool, with no out-of-sample testing at allWhy not: In-sample validation is weak; out-of-sample testing and monitoring are needed.
Supervisors should apply to their own AI the standards expected of firms: validation, bias testing, explainability and human accountability.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →