The AI Control Architecture: Professor Kai London on Governing AI in Regulated Finance
By the Swiss Times Business Desk
Nowhere is the promise of artificial intelligence greater — or the tolerance for uncontrolled failure lower — than in banking and insurance. Fraud detection, credit decisions, anti-money-laundering, customer service and trading all now lean on models. And that, says Professor Kai London, a senior CISO and board advisor to financial institutions, is precisely why finance needs an architecture for governing AI, not just enthusiasm for deploying it. “In a bank, an ungoverned model is not an innovation. It is a liability waiting for a regulator,” he says.
“Regulated finance is where the AI reckoning arrives first. The institutions that can prove how every model is owned, tested and controlled will move faster than the ones that merely claim to be innovative.”
Why finance is the hardest test
Financial services combine three pressures that make AI governance non-negotiable, London argues: consequential decisions that affect people's money and lives, dense regulation with real enforcement teeth, and adversaries actively trying to manipulate the systems. “A retailer's recommendation engine getting something wrong is a nuisance,” he says. “A bank's model getting a lending or fraud decision wrong is a legal, financial and reputational event. The bar for control is simply higher.”
A seven-layer control architecture
London advocates treating AI governance as an architecture — a connected set of layers rather than a single policy. It starts with a charter that defines what the organisation will and will not do with AI. It assigns ownership, so every model has a named, accountable human. It builds navigation and documentation, so the organisation knows what models exist and what they do. It establishes trust and testing, so models are validated for accuracy, bias and robustness before and during production. It designs for resilience, so failures are contained. It runs operations that monitor models continuously. And it converts all of this into leverage — the ability to deploy AI where the value is highest. “Each layer is unremarkable on its own,” he says. “Together they are what let a board sleep at night.”
Model risk is not new — but AI raises the stakes
Banks have long practised model risk management. London's point is that generative and machine-learning models stretch those disciplines in new directions: models that change behaviour over time, that are harder to explain, that can be manipulated through their inputs, and that increasingly act with autonomy. “The good news is that finance already has the muscle memory of model governance,” he says. “The challenge is extending it to systems that are less transparent and more dynamic than the models that came before.”
Mapping to the regulation
The architecture, London notes, is not abstract — it maps directly onto the rules bearing down on the sector. The EU AI Act's obligations for high-risk systems, the international management-system standard for AI, established model-risk expectations, and operational-resilience regimes such as DORA all ask, in different words, the same questions: who owns this model, how do you know it works, and can you prove it? “If your governance is designed well,” he says, “the regulatory response is a report you can already produce, not a project you have to launch.”
Winning contracts on the strength of governance
London returns often to a commercial argument that resonates in finance: demonstrable control is a route to growth. Institutions that can evidence responsible AI can adopt it in the highest-value, most regulated processes — and can satisfy the due diligence of partners and clients who will not touch an ungoverned system. “In finance, trust is the product,” he says. “Governance is how you manufacture it at the speed AI now demands.”
A pragmatic starting point
For institutions early in the journey, London counsels focus. Inventory the AI already in use — often more than leadership realises. Assign owners to the highest-impact models first. Put a readiness gate in front of anything that touches customers, money or regulated decisions. And build the evidence trail from the outset, rather than reconstructing it under examination. “You do not need to govern everything on day one,” he says. “You need to govern the models that could hurt you — and prove it.”
For a financial centre whose reputation rests on trust and prudence, the message from one of the field's senior voices is fitting: the winners in AI will not be the boldest experimenters, but the institutions that built the architecture to govern intelligence as carefully as they govern capital.
About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with more than 25 years of board- and C-suite leadership across banking, aviation, defence, government and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing, and a UCL researcher, holding CISSP, CISM, CCISO, ISO 27001 Lead Auditor, ISO 42001, DORA and NIS2 credentials. He is available for board advisory, NED and interim or fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.
