AI GRC Network Weekly
At a Glance
UK: The FCA’s latest examples of good and poor practice show how human review can become less effective when reviewers increasingly defer to AI recommendations.
EU: The Council's negotiating position on proposed GDPR amendments states that developing and running AI does not in itself establish a legitimate interest for processing personal data.
Global: Tao Zhang's BIS-published speech discusses potential herding and shared-provider disruption.
The Week’s Key Development
FCA publishes AI practice examples exposing weaknesses in human oversight
What happened. On 19 October, the FCA published “AI in financial services: good practice and areas for improvement”. The examples are illustrative and create no new requirements; existing regulation remains relevant to firms’ use of AI, including the Senior Managers and Certification Regime and the Consumer Duty.
What it says.
“Firms are responsible for AI systems they develop, procure and deploy”, this covers their outputs and outcomes too.
In some firms, the second and third lines did not have enough expertise to spot risks as they emerged, or to challenge them.
At one firm, reviewers accepted AI recommendations more and more often without enough scrutiny. They became less likely to push back, even when the AI showed signs of errors or limitations.
In a contrasting example, staff at one firm still made the decisions while its AI for affordability checks was being set up. Reviewers assessed each case without seeing the AI’s answer, so the firm could compare human and AI judgements.
What it means. Human approval does not necessarily demonstrate independent judgement. The two cases distinguish formal human involvement from independent scrutiny. In the weaker example, an unclear reviewer role and escalation criteria accompanied growing deference to AI outputs. In the contrasting case, reviewers did not see the AI’s answer, which helped reduce the risk of automatic deference. For Risk and Internal Audit, records of questions, escalations and overrides offer stronger evidence of meaningful oversight than approval counts alone.
What’s next. The FCA says its examples will evolve, without announcing a date. In a speech published the same day, Jessica Rusu, the FCA’s Chief Data, Information and Intelligence Officer, said the FCA will develop “a trusted framework for agentic finance”. It will do this with industry, other regulators and frontier AI labs. The joint Bank of England and FCA survey, published on 26 October, shows how widely firms already use AI agents. Of the firms that responded, 80% said they use them. Only 2% said they give them broad autonomy.
Most relevant to: Board · Risk · Internal Audit · AI Governance
Sources: FCA, AI in financial services: good practice and areas for improvement · FCA speech, Building the future of finance in the age of AI · Bank of England and FCA, Artificial intelligence in UK financial services - 2026
Also that week
EU: Council agrees position on proposed GDPR amendments
What it says. On 21 October, the Council agreed its negotiating position on proposed GDPR amendments. Its text states that developing and running an AI system or model “does not in itself constitute a legitimate interest”.
What it means. Developing or running AI does not, on its own, count as a legitimate interest for using personal data. The legitimate interest ground may still apply, following a case-specific look at the purpose behind the processing.
Most relevant to: Privacy & Data · Legal · Compliance
Sources: Council of the EU, press release · Council mandate
Global: BIS speech identifies potential channels of shared AI risk
What it says. In a 21 October speech, Tao Zhang, the BIS Chief Representative for Asia and the Pacific, said financial firms depend on the same technology, data and service providers. He added:“A disruption affecting a critical provider could therefore affect several institutions at once.” He also noted that firms using similar models, data, or decision rules may act simultaneously if they interpret information alike. Authorities, he said, need to know how much firms depend on critical outside providers.
What it means. Shared providers could transmit operational shocks, while correlated decisions could amplify market pressures. Both represent potential system-wide vulnerabilities. These are Zhang’s own views, not necessarily the BIS’s.
Most relevant to: Board · Risk · Information Security
Source: Tao Zhang, Artificial intelligence, monetary policy and financial stability
Worth Watching
Colorado: Clarifying Meaningful Human Review
The Attorney General’s 21 October analysis examines proposed rules clarifying the right to request “Meaningful Human Review” after certain Adverse Outcomes involving covered automated technology. The right is established by legislation taking effect on 1 January 2027. The proposed rules clarify its implementation rather than creating a new right.
Most relevant to: Legal · Compliance · AI Governance
Sources: Colorado Attorney General, Regulatory Analysis · Colorado Attorney General, AI rulemaking page
US: SEC identifies emerging technology monitoring as an examination priority
On 23 October, the SEC’s Division of Examinations published its priorities for fiscal year 2027, which include how firms monitor their use of “super intelligence (SI)”, for example in fraud detection, anti-money laundering and trading. The document is a staff statement, not a Commission rule, and imposes no new obligations.
Most relevant to: Compliance · Internal Audit · Risk
Sources: SEC, press release · Fiscal Year 2027 Examination Priorities
Coming Up
30 October: EDPB consultation on web scraping for generative AI closes.
31 October: AI-enabled cyber-threat action plans due from ECB-supervised significant institutions.
20 November: ICO call for evidence on agentic AI closes.
AI GRC Network
AI GRC Network briefs and connects the executives accountable for AI in financial services. Subscribe to our free weekly newsletter at aigrcnetwork.com and follow us on LinkedIn.
Know someone who should be reading this?
Disclaimer: this newsletter is designed to provide general analysis, and it is not legal, regulatory or financial advice.