In banking, wealth management and any regulated business, the question is never only whether AI works. It is who answers for it.
Accountability is a design decision
In Camunda's September 2026 survey, 40% of organisations said they had an AI-related compliance or governance issue in the past 12 months, and process-related challenges contributed to 84% of those incidents. Compliance and risk operations was also the process organisations most wanted to redesign, named by 68%.
Read together, those numbers say something specific. Most AI governance failures are not caused by a rogue model. They are caused by a workflow where nobody wrote down who decides what.
The three-tier control model
For every workflow, agree three lists with the business owner and compliance before anything is built:
- AI does alone: reading, matching, ranking, summarising and recording. Reversible steps with a log.
- AI drafts, a person approves: anything a client, customer or regulator will see, and any decision with money or risk attached.
- AI never: decisions written down in advance as human-only.
The third list matters most. It is short, it is specific, and it is the first thing an auditor will ask for.
Three use cases that put a person at the decision
The relationship manager's client pack
AI drafts the client review pack before the meeting, with a source on every line and the lines compliance would question flagged. The RM edits and owns the pack, and compliance reviews the flagged lines. Every version is kept, so the pack that was actually used can be found a year later.
Regulatory change: from new rule to gap list
AI monitors an agreed list of official sources, summarises each change with a link to the text, compares it with current policies and drafts a ranked list of gaps. The compliance officer decides whether a change applies and assigns every action. AI never marks a rule as not applicable and never closes a gap.
An AI register and audit trail
One register of every AI use: its owner, purpose, risk level, model and prompt versions, overrides, escalations and incidents. Every AI use has a named owner, and risk signs off before go-live. Each new workflow updates the register automatically, so it shows what happened rather than what was planned.
What a regulator will ask
Expect four questions about any AI-assisted decision. Who owned it? What did the AI do? Who approved the outcome? What changed since? If the workflow was designed with the three lists above and logs every action, each answer is a lookup, not an investigation.
Get the use cases
The short guide below covers these three workflows. Newsletter subscribers get the full playbook, with the before-and-after workflow, the control points, a baseline sheet and a readiness checklist written for regulated firms.