But the AI Said it Was Fine: The Future of AI Governance | DC Fintech Week 2025

Okay, everyone. Uh, welcome back. I hope you had a great lunch. We were able to make some connections. Uh, talk to friends and colleagues.

Uh, so our next panel discussion, the future of AI and AI governance. Uh, you know, as AI systems become more powerful, the stakes for management increase. Uh, explainability, model risk, consumer protection. Uh, these are no longer academic questions. Uh, these are relevant questions.

Uh relevant questions. Uh , regulators and companies need to solve them. We used to worry about rogue traders. Uh, now we're worried about cheating algorithms with better math skills. Uh, and now I turn to our esteemed panel, uh, to introduce myself.

Uh, let's start with Mike, and then we'll get to the point. Uh, thank you very much. Uh, Mike Sue, former acting Comptroller of the Currency. Hello everyone, I'm Vic. I am the CEO and co-founder of Dynamo.

Hello everyone. I am Amanda Estron Collis. I lead our payments practice at Proficient, and this is my first time at FinTech Week in Washington. So glad to be here. Uh, Melissa Quiet from Finnreg Lab.

Just for context, we are a Washington-based research organization specializing in technology and data in the financial services system. My name is Jim Doss. Uh My name is Jim Doss. Uh , I'm a senior managing director and board member of K2 Integrity, an anti- money laundering, counter- terrorist financing, and counter-terrorism financing consulting and investigative firm based in New York and Washington. Okay, thank you all.

Uh, okay, so let's dig in. Uh, we talked about the convergence of AI and finance, but the big question is, how do we manage it? Uh, I don't know if there are any answers, but we'll find out. Uh but we'll find out. Uh , but let's start with the distance.

Amanda, from your perspective, what is the most pressing governance challenge facing financial institutions with AI? Yes. Oh, what a question. Uh , you know, in the conversations that we have with, uh, financial institutions, there's always an assessment of how to use AI, uh to use AI, uh , and deploy the tool in the best way, right? Um, given the governance issues and things like that, um, I think the most pressing governance issue I would call is, um, data risk and bias, right?

Data bias, data discrimination, especially with respect to automated decision-making, right? Um, we're thinking about certain applications like credit decision making, right? Credit scoring or, um, scoring or, um, anything related to approving loans, like mortgages or small business loans, and even, um, insurance products, right? Considering underwriting with insurance. Um, it's a high risk, you know high risk, you know , any data discrimination, because bad data, yeah, will lead to bad data, right?

So it's really important that, um, institutions are very transparent about some of the data that's being collected, and, you know, that's, I think, the main thing when it comes to AI governance. And you know, of course, there are a lot of solutions to this, for example, we're not against AI solutions like data provenance, which we'll talk about, but, um, really bias, and you know, that's really the most pressing issue. Yes, I think that's a great wording of the rates, and you know, of course, the view from the regulator's side might look, um, quite different. Uh, Mike, uh, as a former Acting Comptroller of the Currency, you oversaw banking risks, model risks, regulatory compliance. How do you see the evolution of the traditional banking RI model, the risk management model, to take into account, you know, black box models, generative AI or AI systems that are constantly being tuned after deployment?

So I think the risk of category error is actually quite high. And what do I mean? Is GPT a chat model? Is this software or a third-party service? It's actually all three things, but each of them is risk-managed and regulated regulated differently within the bank and under supervision, right?

Model Risk Management, MRM 11-7, many people in this room are familiar with it. It is subject to a very specific set of requirements and expectations. Er requirements and expectations. Er , and a certain group of people in banking is different from software development , right? The SDLC life cycle is different from third-party risk management.

Where you put it is important. And I'm afraid that many risk managers and executives tend to fit the square peg of AI into a round hole, and it doesn't quite fit. And especially evolution happens very quickly. And I think we really need to rely on first principles. And what are the first principles of risk management?

Does the thing do what I want? Can I prevent a Can I prevent a thing from doing something I don't want it to do? Can I assess her vulnerabilities? And if something goes wrong, can I fix it? These four principles will simply remain in effect, no matter what.

And what's interesting is, outside of banking, in the broader space of artificial intelligence, the tools for this are: does it do what I want it to do? Assessment: Can I prevent his unwanted actions? Protective fences. Can I assess vulnerabilities? Red team.

Can I make him fix something? Practicality...These concepts are pretty straightforward, but translating them into something that regulators and banks can implement and deal with as the situation evolves is the really tricky part, and I think it will take a lot of work. So, Mike, if I may continue. What can regulators do to adapt to this?

On the one hand, you have certain safeguards and things from creators, but what are regulators doing to adapt to that? So the first thing you simply need to do is roll up your sleeves and get to work. I mean, work. I mean, in my opinion, nothing can replace using the tools yourself. You can read about it.

You can, you know, watch demos and things like that, but you just have to get there, and not only that, but it really helps, I think, inform, uh, how you understand and interact, and then you just have to be very open and meet a lot of people who know what they're talking about, uh, and just learn, learn. I think it's a really steep learning curve, but that's okay. I think that's where we are right now. Thank you. Um, Melissa, so you're right at the intersection of research and policy, where certain evidence meets regulation.

One of the distinguishing features of FINRA Lab is its combination of empirical research with policy implementation. Where do you see the biggest gaps between what technologists are creating and what regulators need to ensure fairness and transparency? Of course. And I always like to address Mike. Haha.

No, Mike has a really, really great vision for all of this. Um, and he publishes a number of really fantastic articles on these topics. So, if you haven't read them yet, check them out. I'm glad that what I have to say is completely complementary to what Mike is saying. I think it's also an important kind of sobering up, like, let's take a breath for a minute , because AI is developing so quickly.

Uh, just a year ago, there was some concern from regulators about the use of supervised machine learning techniques in some of our, frankly, most promising, but also some of our riskiest use cases, namely credit underwriting. And now, a year later, we live in a world of, I think, big ambition, obviously big money around non-deterministic AI tools and their capabilities in financial services. I will say that at FINRG Lab, we are very excited about what things like Genai and language models can do, even in contexts like credit underwriting, like retrieving information from language data from a transactional account. But it is worth recognizing that banks are directly regulated entities. Fintech entities.

Fintech companies, you know, were directly regulated entities or at least large institutions that were supervised. And this uncertainty about something that's more like a black box, whether it's a controlled model controlled model or something like a non-deterministic model like a language model, creates a lot of, uh, concerns about how to use them safely . And Mike is right: we are learning quickly what methods to actually use for research and evaluation. I don't know if this is explanatory. I do n't think we've solved the problem of explainability in the GenAI field, but I think we're looking, technically, at seeing how scientists come up with solutions for model reliability, confidence, and stability, and that's exciting.

But let's also not forget that, you know, even in the area of supervised machine learning, some regulators of the past, who will probably come back at some point, had a lot of concerns about how black box supervised machine learning models work . I will also say that we did a study, and we published it over the summer, where we looked at a much more traditional approach in horse racing - a loiter regression against an xg- against an xg- up model - both with and without alternative financial data, and the results were significant. I mean, you have a lot more options, a lot more power, both to accurately define credit risk, and to understand who is at risk and who is not, and to be able to say able to say no to people who are not going to work with access to credit with access to credit . And that's an important point from a stability, security, and reliability perspective, and it's also good for the consumer because they won't get something they can't perform. But we need to, you know, regulators, and we'll talk about that in a minute, and the financial services sector, including all the many vendors around the world that sell products to banks and others, stay on top of things and engage regulators with us.

And I would say that it's even enough to be familiar with methods of validity and explanation, even in something like a supervised machine learning model. Yeah, I mean, that 's a great point that you both made, which is that regulators need to learn, creators need to take these steps to show regulators what exactly we're doing, right? And they need space and the willingness of regulators to be open and listen. And, frankly , I think especially in the Trump administration regulatory community , there is, I guess, Travis said that yesterday, right? We know that we can get better performance with more complex models.

So there is room for such dialogue, but we must use it especially now. Yes. And I mean this tension between innovation and oversight, I know it's something that firms experience every day, especially those that are building with artificial intelligence and real systems. Uh, Vic, you know, at Dynamo.ai you build with artificial intelligence every day.

What are the most difficult management problems you face in practice? Yes, I mean, maybe this is a complicated question, but you know we work with a lot of big financial institutions and governments, right? So, the main thing we see is that everyone, for example, has identified risks. But how do you create the right operating model? That's right, because you interact with different, um, players in each organization.

Yes, there's legal , risk, compliance, who are the non-technical stakeholders who want to prioritize to prioritize , like, where could my AI systems go wrong ? You have, for example, machine learning and product development experts who are focused on how to get the best performance. So I think one thing we're seeing is that once you clearly identify the risks of what could potentially happen to your applications, will they leak sensitive data? So, or, for example, with artificial intelligence agents, we clearly see them deleting production databases. For example databases.

For example , unauthorized access, jailbreaking, is one of the most famous attacks that can now be done by almost anyone. Yes, it becomes very easy to hack these systems. So, as Mike said, it's really important to make sure important to make sure we have the right guardrails in place that, so to speak, are consistent with your organization's policies and definitions. Because how one business might perceive what is fair is likely to be different from how another organization would define what fairness is. So, I think at the regulatory and organizational levels, such clear definitions of these policies and workflows would be best.

And on the other hand, compliance teams are under pressure to make sure that AI enhances, not complicates, their oversight. So, you know, K2 Integrity focuses on compliance. Uh, how can AI itself help strengthen compliance, rather than undermine it? Yes, absolutely. Uh, the job I had before K was at K2 Integrity before K was at K2 Integrity was as the Director of the Financial Crimes Network, where I would regularly throw things, uh, and add entertainment to the people I worked with, uh.

Um, you know, uh, we've been hearing regularly from financial institutions about the costs of complying with anti- money laundering requirements that finance terrorism. Um, you know, we've heard from financial institutions that have expressed concerns about regulatory requirements, on the one hand, but also, uh, concerns about how their transaction monitoring systems, uh, and the rules-based approach that transaction monitoring systems, uh, were leading to numerous false positives at a rate of about 95%. Um, and that's a significant number of notifications that, uh, financial institutions have had to allocate significant compliance resources to be able to address all of those notifications and then consider whether they file suspicious activity reports. I think for us, from a Fininsen perspective, it was also a challenge because we just got more reports of suspicious activity suspicious activity than was probably useful, uh, for law enforcement. So the issue of implementing artificial intelligence artificial intelligence is something that has been ongoing for a long time for financial institutions to comply with anti- money laundering and terrorist financing requirements.

And I think there are several considerations are several considerations that we're hearing from regulators in the current administration regarding the effectiveness of combating money laundering, terrorist financing, terrorist financing. How to make anti-money laundering compliance programs aimed at combating financial intimidation financial intimidation more effective and reduce the costs for financial institutions to implement them? How and what role can innovative technologies play in increasing this efficiency? Part of this is figuring out how to redirect resources to higher- risk activities rather than lower-risk activities. And partly it concerns what the regulatory framework looks like for compliance with requirements for combating financial anti-money laundering financial anti-money laundering , aimed at combating financial anti-money laundering financial anti-money laundering .

I think there has been a long conversation and long reflection on the value of artificial intelligence algorithms in terms of identifying typologies and risks of financial crimes much more efficiently and effectively than a traditional rules-based system. And I think there are a few contradictions inherent in the progress that is being made in implementing artificial intelligence tools. This is clear from our experience at K2 Integrity, and we work with a firm called Consilient, which takes a federated analytics approach to applying artificial intelligence algorithms . But our experience shows that this really reduces the number of false positives. And then the question arises: how to effectively interact with regulators regarding the implementation of artificial intelligence?

How do you explain how it works and whether it exposes the right group of criminals? I think there is also a question of whether it is as effective, more effective, or less effective than the existing rules-based system, and what relevant metrics can be measured. So there are a number of considerations about how AI can be used. From my perspective, Mike and Melissa are right in and Melissa are right in saying that regulators need to engage more not just with financial institutions but also with providers, because I think they both play a key role in addressing some of the governance issues as well as some of the value issues. Yes, I think value issues.

Yes, I think Himbit raises an important question, because there are factors involved in the accountability of the model, right? Many of these financial institutions use multiple integrated partners. They work with other fintech solutions, and this also seems like an important issue. And so having the right structure around this would certainly be a possible solution. Yes, add this to that.

You also mentioned something, and I've started to hear this, especially from regulated financial institutions. Yes, in the back office we can achieve some efficiency, but I think there is a certain level of awareness, especially among banks, of how much a squeezed resource is worth, like how expensive is that squeezed resource? And what's happening on the other side, right other side, right ? Even internal chatbots, you know, does an employee really want to just rely on agents and machines to help them understand what they're doing? And that, and I think it's a doing?

And that, and I think it's a healthy period to go through, right through, right ? There is a lot of enthusiasm, trial and error, especially with respect to existing norms and rule-based systems. And then we will see more breakthroughs in what non-standard capabilities, especially genai AI language models, can present to the financial sector. Hmm, but I'm starting to hear things like this takes a lot of time, effort, money, and employee retraining, and does it really give us more than our existing processes and systems? Yes.

And I think if you think about it from a , you know, maybe regulatory perspective, you know, all this innovation is happening now. I mean, just lightning fast, right? How do you consistently implement this when you notify the regulator, right? I mean, you approach them with everything at once and say, "We have all these thousands of things." This will make it difficult to implement and launch things.

And that's just something that I think people need to consider when they're working on this they're working on this . But we have considered what . But we have considered what is difficult today. Uh, let's look ahead. Uh look ahead.

Uh , how will these governance issues evolve as artificial intelligence becomes more deeply embedded in payment identification and financial infrastructure. And Amanda, uh, given your experience in payments modernization and digital identity, where do you see the biggest gaps in today's governance systems when it comes to implementing AI LLM into payment and identity systems? For example, how well do current disclosure or risk control standards address payment fraud or consumer trust and identification decisions? Well, that's a difficult question. This is complicated...

question. This is complicated... I...I come...I come with a full set.

You come with a complete set. No, I, you know, I think one of the panelists mentioned the clarification, uh, and that's a huge, uh uh, and that's a huge, uh , you know, problem, especially with regard to identity verification, uh. And you know, we all know that we move money much faster, uh, and the requirements for, uh, user authentication are necessary, but the problem is that our, uh, regulatory framework lacks quite a bit of information regarding tracking, perhaps from a, uh, decision-making perspective. So either approve or block the user, and uh, that's where, you know, there's a gap. It's just an opportunity to explain where the traffic lies, the decisions behind those considerations, and what, you know, is what we're finding in terms of verification and identification.

Yes, we heard in the previous panel that you know your agent, and I think that's what's actually going to be an important thing. Hmm, that would be a big deal. Yes. Yes. Uh, Mike, I mean, you've seen firsthand how banks are implementing new technologies.

Do you know what worries you most about the implementation of artificial intelligence in finance? So this won't surprise people. I worry about everything. Hmm, it's simple, uh, but, uh it's simple, uh, but, uh , I'm going to focus on something that's maybe a little illogical. Hmm, for me it all comes down to trust.

Does deploying something that helps build trust or undermine trust? And now we are at the stage where we will get a little bit of both. And I think that, uh, naturally, I would focus on things that undermine trust. But, paradoxically, there is a risk of overpromising and underdelivering. So this is something we need to think about, especially given the hype around AI.

But on the other hand, there is a risk of being overly cautious. And there is a risk of confusing caution with unwillingness to change. So I see it in myself. Sometimes I just don't want to do things, right? And since I don't want to change, I say I'm being cautious.

And as a safety and reliability manager, it's the path of least resistance because traditionally it's safer to not change anything. Today with AI, I don't think that's the case. And it's going to be very difficult because, um, there was a time when cloud adoption started to pick up again , a lot of the standard surveillance attacks were that you don't know what the cloud is. This is risky. You have no control over this, for example, slow down the pace.

And there was a period when it was actually the right advice. But then things changed, and it changed, because now if you have an old, outdated system that runs on cobalt that's past its end of life, it's risky. It's riskier than working on something cloud- based. And so these things are really reaching a tipping point. And my concern about AI is that this tipping point is coming now, because these things usually develop over a longer period of time, and it happens very quickly.

And from your perspective, how did regulators intervene? So when I was acting as controller, " controller, " sandbox" was a four- letter word. You couldn't help but mention it because here in the States it's had a somewhat controversial history in terms of how it's been going. Whereas in other jurisdictions it was a mechanism, right? There was a mechanism that promised to create a safe space where industry would intervene, regulators would be present, and we would work on this together.

But I understood the criticism. The criticism was that in a sandbox, if you just let anyone do whatever they want, this Venn diagram might not intersect. And I think maybe a better analogy would be a gym, because I've heard of that with the development of AI agents. Some large institutions are developing these gyms. And the whole point of the gym is that you train the agent to do what you want them to do better.

And I think do better. And I think if regulators had that approach, it would be like you come in, you want to do an anti- money laundering investigation, and we'll do it faster, better, cheaper. Let us show you. I think regulators would be quite open to this because it's very targeted and it's something you can do in a safe environment. I think this approach will bring a lot of mutual benefit.

The main thing, I think you're absolutely right, you can't throw it out of order and say we want to do these 50 things. There must be an order of priorities. And I think it should be both a two-way discussion and a kind of group discussion. Yes. And whether we call it a gym or, uh, a sandbox, you know, regulators are either going to have to play in the sandbox with people in the sandbox or notice people in the gym, right?

I mean, I think that's right. They are part of it, and, um, that's a really great idea. Yeah, I want to add one more thing, why are we now moving towards a world of models with small languages ​​and more like task-specific models, right? Because with the large model, it's not only more expensive, but it also has more latency, right? And it's slower.

So, how do we make sure that we perform specific tasks as economically and quickly as possible, that is where the direction of the industry lies. And if I can just expand on V.'s point, of course, it changes so quickly. You know, if we calibrated to three months ago three months ago , we wouldn't be having this conversation, there would be a whole army of people, you know, marching in a certain direction, and then saying, wait a second, now we're going to change that. So, I think we're really going to be a lot more flexible than we have been in the past in terms of how we deal with these things.

Yes, the speed is impressive, and you know, I think that almost brings us to the bigger question. On the topic, Melissa, that you talked about earlier, about collective responsibility, how do we define what responsible AI really means, and what you mentioned earlier, you know, " Can we build it Can we build it ?" is a different question than "Should we deploy it?" What role do deploy it?" What role do you think collaboration between regulators, researchers, and firms plays in defining what responsible AI is?

Yes, I promise I'll get to it, but I'll get back to Mike, and I'll do it efficiently I'll do it efficiently . Um, my comment about the fact that there are certain comments from the financial sector, like, comments from the financial sector, like, "We're testing this, and it's expensive," etc., and Mike's point about things happening quickly, not just not being done because it's outside the norm. These are all important points. I think another component of this is realizing that we may need to start, and that answers your question.

We may need to start collectively thinking differently about what capabilities AI has, what solutions, what new capabilities the iPhone actually offers AI in the context of financial services. So a lot of institutions aren't necessarily thinking about, "Can we use this?" and not using this as an interface for our customers, but actually thinking, and I'm looking at you in the room, maybe about how the fact that we have a huge amount of personal data, financial data of our customers, and can we offer these language technology capabilities and actually help our customers as they try to navigate their short-term financial issues and their long-term financial lives. Now the bank might think, "Well, I'm not an asset manager, and this is not the place for me in the space." But the possibilities of technology and what it can offer in terms of real benefit to your end consumer, small business, customer, whoever it is, high net worth, you know, middle market, now is the time for creative thinking.

To your question, where, you know, is the need for cooperation on this issue? And I think you didn't mention the "jungle" that you didn't talk about last year at the AI ​​symposium, Mike, but I think you hit on something, but in the context of even identity and this need to know and track: Is a person who they say they are ? Is this a business? Or agent-based AI, which focuses on the question: "Do we have enough data to understand?" Is this person, or this agentic activity, really the kind of agentic activity that would likely benefit us all if we thought more holistically about shared data, intelligence, and ideas?

And we all know that we have a huge dilemma around 1033 and what's going to happen with it, but this is, I think, the path to real opportunities for AI, whether it's for personal financial advice and activity, not to mention AI agency issues and commerce, or just to make sure that we don't let bad guys into the system at all, right? So, there's a need for a collective effort around these data consortia so that individual firms can leverage their niche and expertise, offer products and differentiate themselves, but we're addressing some of these issues that are just fraud, scams, attackers. So there is a collective need here. Yes. What I mean is that governance only works if there is true alignment of incentives.

And it's asking you, you know, given risk-based oversight, what incentives, uh, both positive and /or punitive, uh, do you think would be effective in ensuring responsible behavior by companies that develop and deploy AI systems? Um, I think the first thing I have to say is that, um, responsible AI, like responsible compliance programs for combating financing, financing, financing, terrorism, shouldn't be limited to just avoiding fines. I think that, um, this is the gist of it, which is the key message over and over again for financial institutions, cryptocurrency exchanges, AI vendors, etc. This really should be, um, completely unclear when it comes to fines. It has to be about building trust, as Mike said, about building integrity, because that's what's critical to implementing AI.

I think I have a lot of observations based on what everyone has said so far. said so far. First, my favorite, um, analogy is that a rugby scrum is perhaps a little better than a gym, um, in terms of what interacting with regulators looks like and probably should look like. Um, with regulators looks like and probably should look like. Um, secondly, I think that, um, um, based on Melissa's point, um, regulators often take a, um, reactive stance towards financial institutions regarding AI.

I think in the area of anti- money laundering ( money laundering ( AML) there is actually, uh, an opportunity for regulators, and especially, uh, financial intelligence units and law enforcement, to collaborate to be proactive in how they use AI and also how they facilitate the use of AI by financial institutions. Uh, Fininsson regularly publishes recommendations and warnings for financial institutions about, uh, you know, different typologies and issues. They recently published one about Chinese money laundering organizations and how they facilitate cartel activity and, uh, the export of fentanyl precursors, uh... I think that like Fininsen, and regulators have the ability to meet with law enforcement and really get a good sense of what's going on , if you have a certain set of relevant typologies, you're on a mountain of data that actually has really positive results on a certain typology. Why can't regulators develop algorithms that, instead of just a list of, uh, red flags and typologies, develop algorithms and distribute them to financial institutions, uh financial institutions, uh , based on a trained dataset of , uh, truly positive outcomes?

I think that would be incredibly valuable. But to get to this point, I think it goes back to Mike's point, which is that regulators and, uh, law enforcement, financial institutions and vendors need to sit down at the same table to understand how this all works. Uh, you know, my second point is that point is that , you know, at K2 Integrity, we work, uh, with a number of small and medium-sized financial institutions that are doing model validation on, uh, AI tools that are provided by vendors. And, uh vendors. And, uh , you know, one of the problems is that vendors often have their own algorithms, and it's hard to get some level of transparency about those algorithms, um, and their notification models.

So, I think one of the questions, again going back to supplier management, is this: what is the relationship between supplier management and financial institutions? Where does the responsibility lie? Because, of course, financial institutions, in terms of using AI models, would feel constrained if they faced significant fines, uh, from regulators if they didn't properly, uh, manage the models. There are risks, uh, that arise from integrating artificial intelligence tools. So I think part of the conversation is not just about managing the AI ​​algorithm , but also a little bit of a conversation about managing the overall ecosystem from a vendor perspective, financial institutions perspective, and shared responsibility.

Hmm, thank you. Uh, Vic, you're already implementing some of these management principles and working products. Dynamo.ai tools include things like Dynamo Eval, Enhance, and Guard, which are aimed at evaluating, correcting, and improving production. Uh, in your opinion, what approaches to governance, whether technical, political, or legal, best ensure ongoing compliance, not just pre- employment review.

Yes, I think the first thing we should do is conduct a thorough analysis or assessment of AI risks, such as potential data leaks or security compliance issues. Uh, this is pre-employment pre-employment , right? But the most important thing here is actively monitoring and observing what your customers are actually using when they use your product, right? You need to know what different actions they perform, or what questions, answers, etc., they ask when they interact with the system.

So I think active monitoring and observation will help you make the next set of decisions, right? Because there are new attacks, new random threats that arise every time... arise every time... Okay. So it's not like, "Oh, once we do that, then everything will be ready, right?"

It's more of a constant, um, update that needs to happen, but the most important thing is that there needs to be a human presence in this process, right? Because I think it just can't be fully automated at this point. We're not there yet. So the person is in this process. So we have to think like this: How do we put these protective barriers or protections, um, and how do we make these decisions faster, but not completely automated?

Here's what I would recommend to all our clients. And yes, we're not there yet. One of the conclusions I made today, right? We are considering...No, no, no, no.

I think that's a good thought that I heard throughout the day, this is, you know, the last panel on artificial intelligence and stablecoins . They said . They said , you know, where are we at with fully automated money movement and everything, and they said, "Maybe the start of the second inning, right?" And I thought that was indicative, but then when people are involved in the process, it doesn't mean we won't achieve it, but there's still work to be done today . So maybe I'll just move on .

You have about two minutes for each. Uh minutes for each. Uh , what does audit-ready AI in financial services actually look like? That's the question, and then you can move on. Well, the answer to that is actually quite simple.

You just have to be able to track everything. Track, right? And that's easy to say, hard to do. Yes. Um, but I want to go back to your analogy with the second ending.

The advantage of starting early is that you can build something. So I want to come back to His idea of responsible AI. Usually people wait, asking what are the rules? What time should I brush my teeth? What time should I do this?

Habits, norms, culture – they have a much greater impact on outcomes than outcomes than anything a regulator can impose . And I think that's a really important moment right now. Everyone involved in artificial intelligence plays a role in setting norms. You can say that I think it's okay to do this. I do n't think it's okay to do that because things are changing and I think people may not be giving themselves enough power, whether you're in an organization or a conference or a group.

Um, I remember there group. Um, I remember there was this book, uh was this book, uh , Freakonomics, where Levitt talks about how there Levitt talks about how there was a time to pick up kids from some daycare, and it was just a norm that you picked up your kid on time, and then they would impose a $5 fine if you were late, and you know what? Everyone was late because they were willing to pay $5, right? So the cultural norm is strong, and I think that's what we should focus on: what is acceptable and what is out of the question ? And we need to talk about it .

You can't just hope that someone will talk about it; you have to talk about it , I have to talk about it. I think that's something we can all get involved in, uh, because it would shape accountability more than, you know, a bill or a rag from a regulator. You want to, yes, I think the main thing is to do a proper risk assessment of AI and then make sure you have the right set of demand controls, right? Because it's not just about identifying problems or understanding where something is going wrong, but also about potential solutions so you can bring AI to market faster. Yes.

I know, I like the thought process that it's a collective effort. I think this is extremely important. Um, and the human intervention aspect, right? You know, AI right? You know, AI is a tool, a productivity tool, but we still need control over some of the data that's being collected and a look at all the models that are being put together.

But I think if we continue this collective, uh, spirit, it will help address some of these decisions. I'm going to cross it out here. I don't have an answer to this question. I will say that in Finnreg Lab as a study Finnreg Lab as a study , or we want to study this and come back next year with some thoughts. Perfectly.

I feel like I should just pick up the microphone. Um, you know, I think from my perspective, it's a collaborative exercise between regulators and financial institutions, vendors and AI developers in terms of trying to figure out what "audit-ready" means in a particular context, because I do n't think it's the same in every context. Um, and this is the key point, that we have to be flexible in terms of circumstances, and then we have to test it. Um, from a regulatory perspective, again, I would support Mike's point about the issue of, uh Mike's point about the issue of, uh , governance and focusing on governance first. Because ultimately, the reliability of the overall structure and system depends on individual providers, individual financial institutions, in terms of whether they do the right things and whether they communicate, uh, to financial institutions and regulators what is right, and then you will see positive developments in that direction.

Yes. Um, does anyone have anything else? No. What do you think? What do you think?

Well, you know, uh, that's a great question. I don't know. I...small, small, small, small, turn around. Listen, I mean, I always think that, uh, you know, you have to evaluate the regulatory environment, and this regulatory environment, there's an openness to discussion that maybe wasn't there before.

Uh, whether it's AI, whether it's cryptocurrency, whether it's blockchain, you know, last time you could go and talk, but you might get subpoenaed. Um, I think things are a little different now, maybe on the other end of the extreme. But there is so much innovation happening. And I think, Mike, I think on your first point, you know, regulators should embrace it and use it, but it's the responsibility of the market and those who create it to provide that correct information to regulators, because they don't know what they don't know. And I think there is a desire to learn and understand.

So, I don't know if I answered your question, but I said something. And, uh, Chuck has... Okay, we have time for one question. Chuck one question. Chuck , but not Chuck.

The point is , you have to work. Yes. The question is, what about liability? So I think a good model to start with is the cloud. So when I was in charge of oversight, there was a working group on cloud issues to define a model for the accountability of cloud service providers to banks, recognizing that banks cannot provide cloud services on their own.

They have to rely on cloud service providers. So, there was a shared responsibility model between cloud providers and banks, which implied that depending on the model approach, whether infrastructure as a service or SAS, different parts of the stack would belong to different parties. And it was relatively simple, as it's just a cloud service provider and a finance division. I think the point that Melissa made is that the world is going to be very fragmented right now ; This is not a two-party system, this is a multi-party system. But we're going to need something, some model of shared responsibility that distributes that, that puts it in terms that we can all agree on, to say, "Okay, you're responsible for this, you're responsible for that you're responsible for that ."

Otherwise, it's going to be a lot of blame when something goes wrong, and it won't work in the long run. I also want to add and maybe go back to the question, uh, what was the train of thought, uh, and it went away, it'll come back to me, you know, I can chime in here, just from a Fininsson perspective, I think that, uh, law enforcement around this. In fact, I would view it the other way around, which is that currently in a rules-based system, you are losing a lot. Uh, and that's why there's an under- representation of law enforcement on financial crime, uh, because, uh, it's incredibly expensive, and you don't uncover as many real positives as you should as you should . And in this case, you get into a different incentive regime where increased AI adoption will lead to increased, uh, investigations, increased prosecutions, and I think that's generally a positive thing.

So there is a certain balance here in terms of the consideration of law enforcement agencies versus oversight agencies on governance issues and how they are implemented. But the flip side is that there are significant positives, uh, to the broader law enforcement regime . Good. Just remembered. Yes.

We say that we need to talk to regulators, and that's important, but resolving these issues, you know, regarding liability, multilateral bilateral agreements. This will require work between industry stakeholders, and yes, involve regulators when possible, but getting more clarity on this in anticipation of future regulators who will have a different perspective will be very important. And so we, you know, argue that we need to talk to regulators, but I think there's real work to be done because there's a lot of concern that I'll go talk to them now and I'll be a little bit, you know, four years from now. Yes, some collaboration between these various industry stakeholders outside of the regulatory realm would also be very valuable. And that means involving data storage locations, data and fraud.

That means big tech companies, but there's a lot of work to be done in that direction, I would say. Yes, that's a great idea. Often we see that the biggest problems are that people start working too early and are not ready yet. So that's a great idea. And with that we are finally done.

Uh, I want to thank my panelists Mike Wick, Amanda Melissa, thank you very much. Uh, we're on a 35-minute break now. Uh, we'll start our next session on designing the future of scalable entrepreneurship at 3:30 p.m. Thank you.