624 uses of AI, across 23 financial services and credit licensees.
That's what the corporate regulator counted when it looked at how firms in banking, credit, insurance and financial advice were using AI. The report, ASIC's REP 798, came out in October 2024. It is two years old at the time of writing, and the regulator's point has only sharpened since: governance was trailing behind use.
This post is written to one person. The responsible manager, or the partner who ends up holding compliance, at a smaller firm. Someone who has never bought anything with "AI" in the product name, and has just noticed that three of the platforms the firm relies on added AI features in the last year without asking.
Why AI in financial services is already in your platforms
Most people picture AI in financial services as something the big banks do on purpose. Credit models. Fraud detection. Chatbots.
They do. The more common version, for a firm of this size, arrived through software updates. The CRM that now drafts client emails. The advice platform that summarises file notes. The research tool that writes a first pass of a statement of advice. The identity checks inside onboarding software.
ASIC's review found that about 30% of the use cases it examined used models developed by third parties, and that some firms did not have adequate arrangements to manage them. At the smaller end I would expect that share to be far higher. Almost all of your AI is someone else's.
What the regulator actually expects
The useful thing about REP 798 is how unglamorous its central finding is. ASIC expected the firms with the most AI to have the most mature governance. Instead, most were updating their governance at the same time as they increased their AI use, rather than before.
That is what happens in every business when a new capability turns up faster than the paperwork, and I have a fair bit of sympathy for it. The regulator's position is still that your existing obligations are technology-neutral. Adequate risk management. Not misleading clients. The duty to act "efficiently, honestly and fairly". Remaining responsible for outsourced functions. None of that pauses because the function sits inside a vendor's model.
There is a second thread coming. From 10 December 2026, organisations covered by the Privacy Act have to disclose in their privacy policy where computer programs make or substantially shape decisions that significantly affect people. The OAIC's examples include credit scoring, lending, fraud detection and insurance pricing.
Beware: "The vendor's model, not ours" isn't an answer ASIC recognises. You remain responsible for functions you outsource, and an AI feature inside a platform is a function you're relying on.
Mending the fence before the storm
There's an old habit on farms. You mend the boundary fence in autumn, before the weather turns. Not because a storm is coming on any particular night. Because when one comes, it'll be at 2am in the rain, and nobody is fixing fences then.
Governance over AI in financial services is that fence. The moment it matters is a client complaint, an incident or a letter from the regulator. That is the worst possible time to be emailing three vendors asking what their software does.
What I'd do in your position
Four things, and none of them need a consultant to start.
Build a register. Every platform the firm uses, and for each one, whether it now has AI features, whether they're switched on, and what client information they touch. Vendors will tell you if you ask in writing. Keep the replies.
Sort the register by consequence. A tool that drafts internal meeting notes is in a different class from one that scores a client's risk profile. Put your attention where a wrong answer would hurt a client.
Check your vendor arrangements. For the high-consequence tools, what does the contract say about the AI feature, data use, where processing happens, and what the vendor will tell you when something goes wrong? Anyone who has been through an incident knows the first hours depend on what you already knew about your suppliers.
Write down who's accountable. One name per tool. And one person who owns the whole register and reports on it to whoever governs the firm.
Tip: Send each of your main platform vendors the same three questions in one email: which features in our account use AI, what client information those features process and where it goes, and how the vendor will notify you when they change. The vendors who answer quickly and clearly are telling you something. So are the ones who don't.
The slow replies are data too. A vendor who can't describe their own AI features in a fortnight is unlikely to warn you before changing them.
Where we fit, and where we don't
We're not compliance consultants, and we don't sign off your risk management framework. That stays with you and your compliance advisers.
What we do is the part that turns out to be hard in practice: working out what the technology actually does. That's an IT question, and for a lot of firms it's the whole gap between the policy and reality. Our virtual CIOs run that inventory as part of strategic planning.
Where a process is worth automating properly rather than left to a vendor feature, our team can build the automation with the governance designed in.
What this won't fix
Here's the limit, and it deserves saying before anyone promises otherwise. A register and a set of vendor letters will not turn your platforms into open books. Some vendors will give a vague answer. Some will give a good answer that changes in six months without notice. Part of this still rests on their word.
The good news is that you'll be relying on that word in writing, with a date on it, and you'll know exactly which parts of the business depend on it. That is not certainty, and I wouldn't sell it as certainty. It is defensible, which is what a complaint or a regulator's letter actually tests.
Think of the register like the fence line in autumn. Dull work, done on a quiet afternoon, so that the 2am version never happens. If you'd like it built properly, it's the first deliverable of our AI Discovery Workshop, written so you can hand it straight to your compliance committee. For a quicker first look at the privacy side, the ADM checker takes a few minutes.
Where these numbers come from
- REP 798 Beware the gap: Governance arrangements in the face of AI innovation, ASIC, 29 October 2024
- ASIC report on AI governance: learnings for licensees, Hall & Wilcox
- Ten weeks to go: OAIC releases guidance on new automated decision-making transparency obligations, Maddocks, 7 October 2026
Yener
