As the EU enforces the AI Act, American regulators are crafting sector-first mandates. Banks and fintechs must shore up model governance or pay steep operational and reputational costs.
Illustration by IMF Alpha editorial · Reviewed by Pedro Marini
Regulatory whiplash is real. Brussels can move with a single, tidy statute. Washington is doing the opposite: piecemeal, sector-by-sector, and occasionally contradictory. It feels very American — incremental fixes, layer upon layer, and some messy overlaps.
For financial firms the question has shifted. It’s no longer whether AI will be regulated but who will do it and on what timeline. Expect the SEC to press on disclosure and market-manipulation angles; the CFPB and state attorneys general to focus on consumer harms; and banking supervisors to try fitting familiar model-risk rules to new generative systems. History is a useful lens here. After 2008, regulators retrofitted existing frameworks to address novel risks. That pattern is repeating: guidance like SR 11-7 is being pressed into service for large language models and automated decision systems. The demands will look familiar — documentation, validation, vendor oversight — but they’re being applied to systems that learn and change over time. That twist matters.
Why this matters for investors and customers
What firms are actually doing on the ground
But compliance alone isn’t a strategy. Tech teams and boards must decide what to automate, what to keep under human review, and how to measure the leftover, or residual, risk. There’s rising appetite for internal red teams that run adversarial prompts and probe failure modes — a practical hedge against both surprises and enforcement actions.
The political tightrope
Lawmakers face a trade-off. Heavy-handed federal rules would standardize obligations and reduce arbitrage, but they risk slowing useful adoption in small banks and fintech startups. Leave things to market forces and you get fragmentation, litigation and uneven consumer protection. Neither extreme is attractive.
A likely near-term outcome is a hybrid regime: sector-specific standards for financial services sitting on top of broader rules around generative content and deepfakes. In practice that will resemble existing model governance plus new requirements — provenance, watermarking and incident reporting among them.
Keep an eye on
Practical checklist for boards and execs
The headline: regulation will come, but not as one neat federal law. For finance the immediate task is harmonization — translate the EU’s baseline-safety thinking into executable, risk-weighted controls that regulators can actually audit. Firms that treat governance as strategic won’t just survive compliance; they’ll use it as a competitive advantage.
I’m not arguing for paralysis. The right balance keeps useful innovation moving while protecting consumers and markets. The wrong balance hands enforcement a blunt instrument. Choose carefully.
From fraud models to credit scoring, financial firms increasingly prefer synthetic customer data to train AI — a pragmatic fix that raises fresh privacy and accuracy questions.
From Wall Street simulations to synthetic patient charts, U.S. firms are using fake data to train serious AI — and investors, compliance teams, and regulators are taking note.
Local models, smarter silicon, and privacy demand are driving a shift from remote AI to the handset. Here’s who wins, who loses, and why it matters now.