Durham University Business School has published a study calling for a dedicated regulatory framework to govern the use of artificial intelligence in financial services. The research concludes that a bespoke set of rules is needed to limit the risks AI poses to consumers and to strengthen oversight across the sector, finding that current approaches vary widely from one jurisdiction to another.
The study argues that gaps in existing regulation could expose customers and institutions to harm. Some regions, including the European Union and China, have already passed AI-specific legislation, while others - such as the UK and the US - rely on a more relaxed, principles-based approach.
Why generic AI rules fall short
Professor Habib Ahmed of the university's Department of Finance contends that financial services should not be governed by generic AI rules and instead need a model built around the sector's particular risks. He points to the EU's AI Act as a possible template for such a framework.
The study identifies several risk areas tied to AI adoption in finance: mishandling of personal data, biased outcomes in automated decision-making, overreliance on external technology suppliers, and exposure to cyber threats. These issues could undermine core regulatory goals such as safeguarding consumers, preserving financial stability, and maintaining market integrity, with consequences that could ripple outward from individual users to the broader financial system.
A four-tier framework for finance
To build his proposed framework, Professor Ahmed first mapped the main risks financial institutions face when deploying AI, then assessed existing governance models, drawing heavily on the EU AI Act's approach to risk management and oversight. The resulting framework sorts AI use into four tiers.
Systems considered unacceptable, such as unauthorised harvesting of facial data or manipulative applications, would be banned outright. High-risk systems, including those affecting access to essential services, would face strict regulation. Limited-risk uses, such as AI-generated video or text, would require transparency so users know they are engaging with AI. Minimal-risk applications, like spam filters, would fall outside the framework entirely.
Finance professionals working with AI governance will find this tiered structure familiar territory. It maps closely to the risk-management frameworks most banks and asset managers already use for compliance, and it gives a clear sense of where AI-specific oversight is heading.
Why this matters for finance professionals
The study anticipates that AI will play a far larger role in financial services, making regulation increasingly urgent. Professor Ahmed suggests policymakers should adapt existing models, such as the EU AI Act, for the finance sector specifically. That would let institutions capture the benefits of AI while limiting consumer risk and preserving trust in the financial system.
For finance professionals, the practical takeaway is straightforward: the regulatory environment for AI is about to tighten, and the EU's approach is likely to become the reference point. Teams working on AI for Finance should begin mapping their current AI use cases against the EU AI Act's four-tier framework now, before regulators force the issue. That assessment will show which systems need immediate compliance work and which fall outside the scope - and it will put you ahead of colleagues waiting for guidance.
Those in leadership roles, especially AI for CFOs and finance executives, should treat this as a board-level risk conversation, not an IT issue. AI governance will affect capital requirements, consumer protection obligations, and vendor contracts, and the institutions that plan for it now will be better positioned to adapt.
Your membership also unlocks:
