At a quarter to five, a mortgage adviser still has a meeting note to write up before the application goes to the lender. She pastes her notes into a chatbot and asks for a tidy report. On the claims desk, a colleague asks a chatbot to summarise a claim, with the medical description and the policy number still in it. Both are done in two minutes.
That is what AI governance for a financial services firm is about. Not whether the firm may use AI, because it already does, but which tools are in use, what the firm has decided about them, whether the adviser knows that decision while the note is sitting in the text box and whether the firm can show afterwards that the policy was applied. What AI governance means in general is set out in our article on what AI governance is. This piece covers what a regulated firm needs on top of that.
What do advisers and the back office do with AI?
More than the policy says. Writing up a meeting note, drafting the explanatory note for a mortgage application, responding to a complaint, filling a spreadsheet with formulas, answering a client's question in plain language. The back office adds transcriptions of advice meetings, summaries of long files and the AI features built into the advice software and the CRM, which nobody thinks of as a separate tool.
The first layer is usually known: Microsoft 365 Copilot, procured and named in the policy. The second layer is made up of tools someone found because they make the work faster. That layer rarely features in any decision, and the data that ends up in it is no less sensitive than in the first. Why it does not go away when you ban it is explained in our article on shadow AI.
Which client data goes in?
Almost everything a financial services firm processes is data that carries real weight under the GDPR, and the work AI helps with is exactly the work that contains it.
| Task | What the text can contain | What can come out before you paste |
|---|---|---|
| Summarising a meeting note | Name, citizen service number, household income, IBAN, the reason for the advice | Everything that identifies the client; the advice question remains usable |
| Explaining a mortgage application | Income, debts, employer, family situation, valuation | The story works with placeholders for the figures and the name |
| Summarising a claim | Policy number, medical description, claim amount | Medical data does not belong in a tool without a decision, even with the name removed |
| Answering a complaint | Name, file number, the complaint itself, sometimes an accusation against a colleague | The complaint in your own words, without the file number and name |
| Anti-money-laundering file for a business client | Beneficial owners, transaction patterns, source of wealth | This only belongs in a tool the firm has made a deliberate decision about |
The citizen service numbers and account numbers stand out most, but the medical data in claims and the anti-money-laundering files call for the most care: the former is a special category of personal data, the latter is covered by a duty of confidentiality. A list of what never belongs in a prompt, and what usually can go in, is in our article on what you may and may not share with AI.
Which frameworks apply to a regulated firm?
Four, each approaching the same use from a different angle. Exactly how they apply varies by firm and by licence; this is the map, not the route.
The Wft, the Dutch Financial Supervision Act, requires sound and controlled business operations, with the AFM as conduct regulator and DNB, the Dutch central bank, as prudential regulator. Handling client data with care is part of controlled business operations, and when asked, you want to be able to show which rules are in place and that they work. What that means at the moment someone types is covered in AI in financial services and the AFM.
DORA has applied since January 2025 and requires firms to manage ICT risk and the ICT services that third parties provide, with a register of those services. An AI service employees use in the browser is one of those services, even if no contract was ever signed for it. How that fits into ICT risk management is covered in AI and DORA.
The GDPR applies to every prompt in which a client appears: purpose limitation, data minimisation, a data processing agreement with the vendor and the extra protection for special categories of data. Since 2 February 2025, the AI Act has required measures to build AI literacy among everyone who works with AI. Annex III lists AI that assesses the creditworthiness of natural persons and AI for risk assessment and pricing in life and health insurance as high-risk; the obligations for those apply from 2 December 2027 and concern underwriting, not the chatbot an adviser uses to rewrite a letter. What that distinction means in practice is covered in the EU AI Act for employers.
What does an approach that survives a working day look like?
Start with what is being used, not with the policy document.
An advisory firm has allowed Copilot and included that in its policy and annual training. When it first looks at which AI services are opened in the browser, it finds ChatGPT and Perplexity in use alongside Copilot, plus three specialist tools: a transcription tool for advice meetings, a summariser for PDF files and an add-in that writes spreadsheet formulas. Two appear in no register. Nobody did anything wrong: nothing had been decided about those two. What it does show is that a quarterly inventory falls behind as soon as it is finished.
Then comes the decision, tool by tool and made by the firm itself: allowed, limited use with a condition the firm writes down (business account only, no client data), not allowed with an alternative alongside, or, honestly, no decision yet. That last status is where every new tool starts. How to build such a list is covered in our guide on building a list of approved AI tools.
The decision only works if the adviser sees it when the tool opens, not on the day of the training. For a tool without a decision, a calm notice: public information only, you can carry on. For a tool that is not allowed, the approved alternative as the first button.
Then look, every quarter and at firm level: what share of AI use goes through allowed tools, how many tools in real use still have no decision and how often someone chose the alternative after a notice. Those are figures about tools, not about advisers. They can be used in an audit, a DPIA or in answer to a question from the regulator, and they are honest about what they do not cover: a conversation someone had on a personal phone falls outside them.
BeeSensible links a catalogue of over 1,000 assessed AI tools to the use observed in the firm: only the domain of an opened tool, at most once a day per device, with no user ID and no page content. In the Inbox, an admin sees which tools still have no decision and records the decision. If the firm has switched notices on, that decision appears in the browser when someone opens the tool. BeeSensible does not block anything of its own accord; whether staff can carry on to a not-allowed tool after the notice is a setting the firm chooses.
