Governance: breaches nobody sees
Sensitive customer and financial data flows into external AI services inside everyday work. The people doing it do not know, and the people responsible cannot see it.
The problem
Institutions are breaching data rules without knowing it
AI has entered the enterprise faster than the controls around it. Regulated institutions cannot answer the question their regulator will ask: how is AI used, by whom, and with what data?
The invisible breach
An analyst downloads a credit report, pastes it into an LLM for a quick summary, and in doing so transmits personal financial data to an external server, outside every control the institution has in place.
- The analyst does not know they are breaching.
- The compliance team cannot see it happening.
- The risk owner has no record that it ever occurred.
Adoption has outrun oversight
AI agents are already running inside mainstream enterprises, touching real systems and real customer data. But the tools that deploy them were never built to answer the questions a regulator asks: what data went where, under whose authority, and can you prove it.
Second line is no longer asking whether an AI workflow works. They are asking for proof that it cannot do the wrong thing. Without that proof, sign-off stalls.
Three gaps
Where governance breaks down today
Accountability: no answerable audit trail
There is no record of who is using AI, in which department, on what data. When the regulator, or the accountable senior manager, asks to be shown, there is nothing to show.
Cost: spend without attribution
Token and credit consumption is compounding across teams with no visibility into which team, workflow or use case is driving it.
The scale of the problem
AI is in production. Confidence is not.
80% of Fortune 500 companies are already running AI agents.1 When we surveyed more than 30 regulated firms directly, the gap between adoption and oversight was stark.
already have AI agents running in production.2
are confident they have full visibility into what those agents are doing.2
are already using AI for mission-critical processes.2
1. Microsoft Cyber Pulse 2026. 2. Senni AI Agent Usage & Governance Survey, 27 May to 4 June 2026.
Why now
Major markets are moving to regulate AI, and deadlines are near
Without proper AI governance, financial institutions face steep penalties, and personal liability for named executives. Obligations that already applied to models and outsourcing are being extended explicitly to AI.
FCA, PRA and SM&CR
- PRA SS1/23 puts model risk on the board agenda
- FCA Consumer Duty requires explainable AI in customer-facing decisions
- SM&CR creates personal, career-ending liability for the named individual accountable for AI governance
EU AI Act and DORA
- High-risk AI in credit scoring, underwriting and risk assessment must comply with the EU AI Act, with obligations from 2 August 2026 (a proposed extension would move this to 2 December 2027)
- Penalties can reach €35m or 7% of global turnover
- DORA has been in force since January 2025, imposing third-party AI tool oversight obligations on financial institutions
Fed, OCC and FDIC
- The Fed, OCC and FDIC issued AI risk guidance in April 2026
- Federal rules remain less prescriptive than the EU, but expectations continue to tighten
- Existing fair lending, consumer protection and model risk rules already apply to AI-enabled credit and underwriting models
Sources: EU AI Act, Regulation (EU) 2024/1689, high-risk classification Art. 6, penalties Art. 99 · DORA, Regulation (EU) 2022/2554 · PRA SS1/23 · FCA Consumer Duty (PS22/9) · SM&CR · The White House, Executive Order 14409, 2 June 2026. Provided for general information only and not as legal or regulatory advice.
FAQ
A question we get asked often
We already have security and compliance teams, so why do we need this?
Existing security tooling was built for people accessing applications, not for AI systems interacting with multiple models and internal systems on their own. Traditional controls can monitor infrastructure; Senni governs AI behaviour, data movement and model usage, creating the visibility and evidence those teams need to sign work off.
Get in touch
Find out what AI is doing inside your institution
We work with risk, compliance and technology leaders in regulated institutions. Tell us what you are running and we will show you what governance looks like around it.