A mortgage adviser has a meeting note to write up at a quarter to five, before the application goes to the lender. She pastes her notes into a chatbot and asks for a tidy report. On the claims desk, a colleague has a claim summarised, with the medical description and the policy number still in it. Both are done in two minutes.
That is what AI governance for a financial services firm is about. Not whether the firm may use AI, because it already does. Which tools are in use, what the firm has decided about them, whether the adviser knows that decision at the moment the note sits in the text box, and whether the firm can show afterwards that the policy was applied. What AI governance means in general is set out in what is AI governance. This piece is about what a supervised firm adds.
What do advisers and the back office do with AI?
More than the policy says. Writing up a meeting note, drafting the explanation for a mortgage application, answering a complaint, filling a spreadsheet with formulas, answering a client question in plain language. The back office adds transcription of advice meetings, summaries of long files and the AI features built into the advice software and the CRM that nobody regards as a separate tool.
The first layer is usually known: Microsoft 365 Copilot, procured and named in the policy. The second layer consists of tools someone found because they make the work faster. That layer rarely appears in any decision, and the data landing in it is no less sensitive than in the first. Why it does not disappear when you ban it is in what is shadow AI.
Which client data goes in?
A financial services firm processes little else than data the GDPR treats as weighty, and the work in which AI helps is exactly the work that contains it.
| Task | What the text can contain | What can come out before you paste |
|---|---|---|
| Summarising a meeting note | Name, citizen service number, household income, IBAN, the reason for the advice | Everything that leads to the client; the advice question stays usable |
| Explaining a mortgage application | Income, debts, employer, family situation, valuation | The story works with placeholders for the figures and the name |
| Summarising a claim | Policy number, medical description, claim amount | Medical data does not belong in a tool without a decision, even with the name removed |
| Answering a complaint | Name, file number, the complaint itself, sometimes an accusation against a colleague | The complaint in your own words, without number and name |
| Anti-money-laundering file of a business client | Beneficial owners, transaction patterns, source of wealth | This belongs in a tool the firm has deliberately decided on |
The citizen service numbers and account numbers stand out most, but the medical data in claims and the anti-money-laundering files call for the most care: the first is a special category of personal data, the second carries a duty of confidentiality. A list of what never belongs in a prompt and what usually does is in what you may and may not share with AI.
Which frameworks apply to a supervised firm?
Four, and they touch the same use from four sides. The exact application differs per firm and per licence; this is the map, not the route.
The Wft, the Dutch Financial Supervision Act, asks for sound and controlled business operations, with the AFM as conduct supervisor and DNB as prudential supervisor. Handling client data with care is part of controlled business operations, and when asked you want to show which agreements exist and that they work. What that means at the typing moment is in AI in financial services and the AFM.
DORA has applied since January 2025 and asks for the management of ICT risk and of the ICT services that third parties provide, with a register of those services. An AI service that employees use in the browser is such a service, even if no contract was ever signed for it. How that lands in ICT risk management is in AI and DORA.
The GDPR applies to every prompt in which a client appears: purpose limitation, data minimisation, a data processing agreement with the vendor, and the extra protection of special categories of data. The AI Act has required measures for the AI literacy of everyone who works with AI since 2 February 2025. Annex III lists AI that assesses the creditworthiness of natural persons and AI for risk assessment and pricing in life and health insurance as high-risk; the obligations for those apply from 2 December 2027 and concern underwriting, not the chatbot an adviser uses to rewrite a letter. What that distinction means in practice is in the EU AI Act for employers.
What does an approach look like that survives a working day?
Do not start with the policy document, start with what is being used.
An advisory firm has allowed Copilot and recorded that in the policy and the annual training. When it looks for the first time at which AI services are opened from the browser, ChatGPT and Perplexity turn out to be in use next to Copilot, plus three specialised tools: a transcription tool for advice meetings, a summariser for PDF files and an add-in that writes spreadsheet formulas. Two appear in no register. Nobody did anything wrong: nothing had been decided about those two. What it shows is that a quarterly inventory falls behind as soon as it is finished.
Then comes the decision, per tool and by the firm itself: allowed, limited use with a condition the firm writes down (business account only, no client data), not allowed with an alternative next to it, or honestly no decision yet. That last one is where every new tool starts. How you build such a list is in how do you build a list of approved AI tools.
The decision only works when the adviser sees it at the moment the tool opens, not on the day of the training. For a tool without a decision a calm notice: public information only, you can continue. For a tool that is not allowed, the approved alternative as the first button.
And then look, quarterly and at firm level: which share of AI use runs through allowed tools, how many tools with real use still have no decision, how often did someone choose the alternative after a notice. Those are figures about tools, not about advisers. They are usable in an audit, a DPIA and a question from the supervisor, and they say honestly what they do not cover: the conversation someone had on a private phone falls outside them.
BeeSensible links a catalogue of 865 assessed AI tools to the use observed in the firm: only the domain of an opened tool, at most once a day per device, with no user id and no page content. An admin sees which tools still have no decision and records the decision in the AI Tools module. If the firm has switched notices on, that decision appears in the browser when someone opens the tool, never as a block.
