financial-services

If you can replace 'agent' with 'application' and the principle still reads fine, it was never about agents.

Compliance-first governance produces paperwork. Design-first governance produces systems you can actually explain to a regulator.

SR 11-7 assumes models are tools that produce outputs for human review. AI agents are actors that take actions autonomously. Every assumption breaks.

List-based and process-based approaches to AI risk classification both fail in predictable ways. The failure mode depends on which you chose.

Every AI governance framework demands human-in-the-loop. Nobody does the maths on what that means at enterprise scale.

Most AI maker-checker implementations capture the correction but not the reason. That's a feedback loop with no signal.

The most useful reframe I've found for AI governance in financial services

After a decade in financial services, I've stopped believing that what you earn reflects what you contribute.

I work in AI in financial services. The honest list of where gen AI is real is shorter than the industry wants you to think.

Peter Steinberger stopped reviewing AI-generated code entirely. That works for indie software. In regulated environments, it can't. Here's how to think about where you sit.

Most AI governance frameworks are technically-focused risk checklists. Three structural risks are missing from almost all of them.

OpenAI took the Pentagon contract Anthropic refused. Your AI vendor just became a political statement — and enterprise procurement hasn't caught up.

I expected the hard parts to be the technical sections. They weren't. The governance sections were harder, and more useful.

The models aren't the problem. The operating models are. Three structural failures in AML AI from years building these systems inside a bank.

Two job ads. Same bank. Same week. Same title pattern. Completely different jobs. The AI hiring market has a labelling problem.

Your AI governance framework is a routing spreadsheet pretending to be a compliance programme. Regulators will spot the difference.

The most dangerous person in an AI consulting engagement knows how the model works but has never sat in a credit committee.

Hong Kong has quietly run one of the most sophisticated GenAI experiments in global banking. Almost no one outside the region is paying attention.

Most enterprise AI agent pilots in financial services fail at the same point: the second tool call. The problem isn't the framework.

Banks are deploying RAG for compliance and discovering the hard problem isn't retrieval. It's the pipeline before it.

The operational instincts built in production banking don't belong in the past. They're exactly what makes a practitioner-turned-consultant useful.

The real project isn't artificial intelligence. It's the data infrastructure that AI exposes as broken.