The supervisory perimeter for AI in financial services is now six sources wide. The EU AI Act is becoming binding. ISO 42001 and the NIST AI RMF set the operating standard. SS1/23 holds the model-risk line. SM&CR Section 36 and the Consumer Duty pull AI into individual accountability. UK GDPR Article 22 and the ICO AI Audit framework cover automated decisions. This briefing translates each source into what the CRO must do — and into one control library the bank can build once and use six ways.
Six sources govern AI in financial institutions today. Different scope, different teeth, overlapping obligations. MRM has always covered stochastic models — VaR, Monte Carlo, IRB — but the AI gap is wider: outputs that resist characterisation, vendor models the bank cannot inspect, autonomous action, customer rights, and a data perimeter MRM never owned.
The highest-priority obligations across the six sources, translated into CRO actions. Each row answers more than one regulator at once.
| Source / Article | What it requires | What the CRO does |
|---|---|---|
| EU AI Act — Art. 9, 10, 13–15 | Risk management, data governance, transparency, human oversight, accuracy. | One AI risk register per use case; data-quality controls with documented lineage; named human-overseer per system. |
| EU AI Act — Art. 17, 27, 43 | Quality management system, Fundamental Rights Impact Assessment, conformity assessment. | Merge FRIA with the DPIA workflow; decide assessment route per tier-A system; build technical file; register in EU database. |
| ISO 42001 — Clauses 5, 6, 8 + Annex A | Board-level AI policy, AI risk assessment, system impact assessment, 38 reference controls. | Use ISO 42001 gap analysis as the spine of the group framework; close gaps via existing 2LoD functions, not a parallel team. |
| NIST AI RMF — Govern · Map · Measure · Manage | Accountability, context categorisation, trustworthy AI metrics, risk response. | Adopt the seven NIST trustworthy characteristics as the AI metric backbone; report material AI incidents via the existing ORM channel. |
| PRA SS1/23 — Principles 1, 2, 4 | Identification and tiering, board / SMF governance, independent validation with effective challenge. | Group AI inventory tiered A/B/C; quarterly board MI; structural separation of validation preserved regardless of US softening. |
| PRA SS1/23 — Principle 5 + self-assessment | Documented mitigants (override, rollback, kill-switch); firm-level annual self-assessment. | Self-assessment evidence pack designed to also serve EU AI Act conformity, ISO 42001 audit and the FCA reasonable-steps test. |
| FCA SM&CR — FSMA s.66A + Section 36 | Senior-manager duty of responsibility; reasonable steps to ensure AI-relevant controls are effective. | Statement of Responsibilities names AI risk; quarterly reasonable-steps log; AI-specific training for SMF and certified staff. |
| FCA Consumer Duty — PRIN 2A | Four outcomes (products, price & value, understanding, support); foreseeable-harm test on AI decisions. | AI customer-journey impact assessment with vulnerable-customer carve-outs; logged human escalation route for every AI-handled query. |
| UK GDPR Art. 22 + Art. 35 | Right not to be subject to solely automated decisions; DPIA for high-risk processing. | Inventory solely-automated decisions; build genuine human review (not rubber-stamp); single DPIA + FRIA + SS1/23 template, DPO / CRO co-signed. |
| ICO AI Audit framework | Accountability and governance, fairness / accuracy / security, individual rights including erasure. | Map ICO principles to ISO 42001 leadership clauses; one set of board AI minutes serves both; SAR / erasure workflow live for training data. |
Each control area below is required, in some form, by multiple sources. Build the control once; map it to the source language each regulator uses. Built separately, the bank pays six times. Built once, every row answers six audit conversations.
| Control area | EU AI Act | ISO 42001 | NIST RMF | SS1/23 | SM&CR / CD | GDPR / ICO |
|---|---|---|---|---|---|---|
| AI inventory & tiering | ||||||
| AI policy & risk appetite | ||||||
| Per-system risk assessment | ||||||
| Data governance & quality | ||||||
| Validation & testing | ||||||
| Human oversight by design | ||||||
| Customer-impact assessment | ||||||
| Monitoring & incident response | ||||||
| Documentation / technical file | ||||||
| Board MI & accountability |
Three phases of thirty days to a defensible operating standard. Four quarters to a fully evidenced framework. Each quarter ships an external artefact.
The window to early 2028 is heavy on AI-specific obligations. Three rules survive the calendar: design the policy once to the highest bar; build the evidence library to serve every source from one drawer; and appoint a single accountable executive before the inventory work begins.
| Date | Stream | Item | CRO action |
|---|---|---|---|
| Q2 2026 | AI Gov · Group | Establish single AI inventory across UK, US, EU. | Appoint accountable SMF / exec; lock taxonomy. |
| Q2–Q3 2026 | AI · US | US interagency RFI on AI (expected). | Pre-position group response; align SS1/23 narrative. |
| 2 Aug 2026 | AI · EU | EU AI Act — Annex III high-risk obligations apply. | Conformity assessment; FRIA; EU database. |
| H2 2026 | AI · UK | PRA AI Consortium report and biennial AI survey. | Refresh AI register; brief board on findings. |
| Year-end 2026 | AI Gov · Group | First annual SS1/23 AI-specific self-assessment. | Remediation plan finalised and board-approved. |
| Q1 2027 | AI · US | Revised US guidance expected post-RFI. | Gap analysis vs group standard; document exceptions. |
| 2 Aug 2027 | AI · EU | EU AI Act — full applicability incl. GPAI. | Legacy GPAI sweep; Annex I product-embedded review. |
The CRO test for 2026–2027 is not which framework the bank picks — it is whether the bank can carry six sources through one operating model.
Pick the highest bar, build the evidence once, and let each regulator draw from the same drawer.Design the policy once to the highest standard; build the library to serve every source; appoint a single accountable executive before the inventory work begins.
LINXS Advisory works with banks and asset managers on AI inventory, EU AI Act conformity assessment, SS1/23 self-assessments, ISO 42001 readiness and group AI policy design across the US, UK and EU.
Get in Touch Visit LINXS Advisory