AI product management · Industry brief

""

Deloitte's recent webcast framed ISO/IEC 42001:2023 (Artificial Intelligence Management System) and the EU AI Act as audit-evidence anchors for financial institutions, signaling that regulators examining banks are now demanding documented governance programs rather than policy statements alone. Finance teams without certified or equivalent management systems face heightened examination risk. The guidance explicitly addresses agentic AI processes, indicating that governance programs limited to traditional model risk management will be considered incomplete; financial institutions deploying AI agents must now document control boundaries and human oversight rationales. The EU AI Act (Regulation (EU) 2024/1689) obligations apply to any financial institution serving EU markets regardless of headquarters location, creating a cross-border compliance gap for US-based finance teams that have not yet mapped EU requirements. Finance regulators in the US and EU are moving toward expecting AI governance programs to meet model risk management evidence standards including documented testing, version control, and board-level escalation. The interagency model risk guidance expected in 2026 and ongoing EU AI Office enforcement activity targeting credit and financial services AI will sharpen these examiner expectations. ISO 42001 certification may become an explicit examiner expectation in banking supervisory letters within the next 12 months.

Singapore's Monetary Authority (MAS) issued Guidelines on Artificial Intelligence Risk Management on October 7, 2026, applicable to all financial institutions proportionate to risk, covering traditional AI, Generative AI and AI agents. The guidelines take effect October 7, 2027, with foundational requirements including board oversight, AI identification, inventory and risk materiality assessment, followed by full lifecycle controls and capabilities by October 7, 2028. The MAS framework aligns closely with ISO/IEC 42001:2023, the world's first certifiable AI Management System standard, though MAS adds specific expectations including quantitative AI risk appetite measures, AI inventory with defined attributes including shadow AI and embedded SaaS AI, risk materiality tiers, independent validation and kill switches for high-risk AI, and fairness and concentration risk controls. Source: MAS Guidelines on Artificial Intelligence Risk Management (October 7, 2026).

""

The 2026 NAVEX State of Risk & Compliance survey reveals that AI adoption in compliance is moving from exploration into implementation, with 49% of organizations using AI for risk assessment and scoring, 45% for training, and 41% for reporting. Compliance teams are increasingly gaining voice in AI governance decisions, with 71% reporting involvement in AI decision-making, though 29% still have minimal involvement. The survey indicates a shift toward employee enablement use cases, with 61% of organizations planning to invest in AI-powered ethics and compliance training over the next 12 months, while emphasizing that successful AI adoption depends on governance frameworks, human oversight, and cross-functional collaboration between compliance, risk, legal and IT functions rather than technology alone.