Linkedin
Facebook
Email
more
For the last two years, most conversations about AI in financial services have centred on opportunity. Faster onboarding. Better fraud detection. Smarter customer service. More efficient operations.
The conversation is now changing.
Ireland’s framework for supervising AI has become significantly clearer. The Central Bank of Ireland was designated in 2025 as the market surveillance authority for certain high-risk AI systems used in connection with financial services. The Regulation of Artificial Intelligence Act 2026 subsequently established the broader Irish institutional and enforcement framework for the EU AI Act, including provisions supporting the Central Bank’s supervisory and enforcement role.
The question is therefore no longer "Should we adopt AI?" It is increasingly becoming "Can we demonstrate that we are using AI responsibly, safely and in compliance with regulatory expectations?"
Who does this apply to?
Many firms assume the AI Act is aimed primarily at large technology companies, and that assumption could prove costly.
The framework may be relevant across banking, insurance, payments, e-money, investment and asset-management businesses where a regulated financial institution places on the market, puts into service or uses a high-risk AI system directly in connection with the provision of financial services. As a practical governance matter, firms should look beyond internally developed tools and identify AI functionality embedded in outsourced services, third-party platforms and existing vendor solutions.
In practice, this means organisations may already be using AI that falls within the scope of future regulatory scrutiny without fully realising it.
What is the regulator worried about?
The Central Bank's message is not anti-AI, rather, it is concerned that adoption is accelerating faster than governance.
Many firms have introduced AI tools into customer interactions, risk management, financial crime monitoring, operational processes and decision-making workflows. However, regulators increasingly want assurance that firms understand:
- Where AI is being used;
- What decisions AI is influencing;
- How outcomes are monitored;
- Whether appropriate human oversight exists; and
- How customer harm, bias, accuracy and data quality risks are being managed.
In short, the regulator appears less interested in the technology itself and more interested in whether firms remain accountable for decisions made with its support.
The biggest risk may not be non-compliance
The greatest challenge facing many firms may be visibility.
Ask a typical organisation today how many AI-enabled solutions it uses across its business and the answer is often uncertain. Teams may be experimenting with generative AI tools. Vendors may be incorporating AI functionality into existing products. Business units may be deploying solutions without a central inventory or governance process.
By the time regulators start asking questions, identifying where AI is used should not be the first step in the process.
Colm Laird, Partner
“The firms building AI governance today will avoid spending the next three years playing catch-up.”
What should firms do now?
Drawing on the EU AI Act and the Central Bank’s stated supervisory focus on AI governance, data, risk management and oversight, firms should consider five immediate priorities:
| Build an AI inventory | Create a central record of AI use cases across the organisation, including third-party and embedded solutions. If a firm cannot identify where AI is being used, managing associated risks becomes extremely difficult. |
| Identify potential high-risk use cases | Not every AI application will be treated equally under the EU AI Act. Firms should assess whether any existing or planned use cases could fall within high-risk classifications. |
| Clarify ownership | Every significant AI use case should have a clearly accountable owner. Governance works best when responsibility is explicit rather than shared across multiple teams. |
| Introduce governance before scale | Firms should establish approval, testing, monitoring and change management processes before AI adoption becomes widespread. Retrofitting governance later is significantly more difficult. |
| Focus on data and human oversight | AI outcomes will only ever be as reliable as the data and oversight supporting them. Firms should be able to demonstrate appropriate controls around data quality, model outputs and human review. |
Click here to access the full PDF version of our Financial Services Perspectives briefing - November 2026.
