By James Renshow, CEO Luminos Software
As AI moves beyond experimentation and becomes part of everyday business, from analysing information and supporting employees to interacting with customers and influencing decisions, ISO/IEC 42001's importance grows. For the financial services sector, the question is no longer simply whether to use AI, but how to use it responsibly and with the right level of control. AI may change how work is carried out, but it does not change the organisation’s underlying responsibilities for risk, regulation, security, data and customer outcomes. The technology may be new, but the accountability isn’t.
Published in December 2023, ISO/IEC 42001 is the first international management system standard specifically designed for artificial intelligence, providing organisations with a structured approach to governing how AI is selected, developed, and used, covering areas such as accountability, risk, data, oversight, and ongoing monitoring.
ISO/IEC 42001 provides a management framework; certification does not by itself establish compliance with all applicable laws or guarantee that individual AI outputs are accurate or safe.
The challenge for business leaders across the finance sector is therefore not whether AI should be governed, but how to govern it in a way that is proportionate to the risk. Done well, governance should support responsible adoption without unnecessary delays and give organisations greater confidence about where they can move quickly, where stronger controls are needed and where the consequences demand greater scrutiny. Therefore, ISO/IEC 42001 could be useful to the finance sector as a practical framework for making those decisions consistently.
The 2024 Bank of England–FCA survey of UK financial services found that 75% of responding firms were already using AI, with a further 10% planning to use it within three years. The survey received 118 responses and covered uses ranging from internal process optimisation and customer support to risk management and automated decision-making.
Rather than seeing ISO/IEC 42001 as another compliance exercise or certificate to achieve, organisations should consider what the standard can provide in practice - a framework for deciding where AI can be adopted quickly and where greater scrutiny is justified.
The FCA has made clear that it does not currently plan to create a separate set of AI regulations. Instead, businesses are expected to consider AI within existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime and established expectations around governance and controls.
The challenge for business is working out what proportionate governance looks like. One way of approaching that question is to think about AI use across three broad stages – Assist, Recommend and Act.
At the Assist stage, AI helps somebody perform a task. It might summarise a lengthy policy document, extract information from correspondence, draft a customer email or help an employee find information across internal systems.
At the Recommend stage, AI starts influencing a judgement. It might identify risk, prioritise a case, flag unusual activity, suggest a product or recommend the next action an employee should take.
At the Act stage, the system can do something with a business or customer consequence: communicating a decision, updating a customer record, initiating a workflow, or taking another action without somebody approving each step.
These are not rigid regulatory classifications, but they offer a useful way to think about proportionality.
Consider an insurance broker using an approved AI system to summarise a 100-page policy wording for an experienced employee. Questions about accuracy, confidentiality, and data handling remain, but a person remains responsible for reviewing the information and deciding what happens next. Using AI to recommend a particular product based on a customer's circumstances is different. Allowing it to make that recommendation directly to the customer without meaningful human review is different again. The underlying technology could be identical. What changes is its purpose, its autonomy and the consequence of getting something wrong.
Before organisations create elaborate AI committees and policies, they must answer a more basic question: where are we already using AI?
AI adoption does not happen only through formal technology projects – employees use generative AI tools themselves, departments buy specialist applications, and existing SaaS providers introduce copilots, automated recommendations, and generative features into products that may already be approved.
The Bank of England and FCA report illustrates the scale of this issue. A third of AI use cases reported by financial businesses were third-party implementations, up from 17% in their previous 2022 survey. In areas including risk and compliance, the proportion was considerably higher. For many businesses, therefore, their largest AI exposure may eventually come from systems they did not build.
So, where to begin? An AI inventory is a useful place to start: which AI systems are being used, for what purpose, by whom, using which data, and supplied by whom?
From there, governance becomes far more logical and practical.
For lower-risk use cases, it might mean an approved set of tools, clear rules around data and a simple review process, which allow teams to experiment without seeking permission every time. The objective is not to put every use case through the same process, it is to apply controls that make sense.
Another question businesses should be asking is - what happens to the information we give the AI? A system may appear to perform a straightforward task, but its data journey can be less straightforward. Where is the information processed? Is it retained? For how long? Who can access it? Are sub-processors involved? Can inputs be used to improve the service or train models? Can information be deleted when required?
The ICO's guidance on AI and data protection emphasises that organisations need to understand their processing and apply appropriate security and data-minimisation measures. It also identifies third-party AI systems as part of procurement due diligence.
Asking an AI system to summarise a document is easy. Understanding where the contents of that document go afterwards is part of responsible governance.
The technology landscape is also giving businesses more architectural choices. Public cloud AI services remain compelling for many applications, but private deployments and increasingly capable local or self-hosted models create alternatives for some workloads. For the right use case, keeping sensitive information within infrastructure controlled by the organisation can change the risk calculation.
That does not mean self-hosted AI is automatically safe, as organisations then become responsible for configuration, access, patching, monitoring, model provenance, and infrastructure security.
This does, however, give organisations a choice that was far less accessible not long ago. For the right use cases, keeping the model close to the data can be preferable to sending sensitive data to the model. The important point is not that one approach is inherently better, but that architecture should form part of the risk decision.
There is a danger that organisations respond to AI risk by creating so much process that employees work around it, which would be a failure of governance, not a success.
A well-designed framework should enable a faster “yes” for lower-risk applications because teams already understand the boundaries, and they know which applications need deeper assessment because they could materially affect customers or the business.
This is where ISO/IEC 42001 can become more useful than the certificate itself, as it provides a structure for making those decisions consistently and revisiting them as technology, suppliers and use cases change.
The FCA's approach points in a similar direction – support innovation while remaining focused on accountability, governance and customer outcomes rather than attempting to prescribe every acceptable application of AI.
AI will continue to evolve faster than most corporate policy cycles. Trying to control it through an ever-growing collection of technology-specific rules is unlikely to work.
A more durable approach is to understand the use case, understand the data, assess the potential consequences, establish ownership, apply proportionate controls and monitor what happens in practice.
ISO/IEC 42001 becomes valuable when it moves beyond the certificate on the wall and starts influencing how AI is selected, built, deployed and monitored. Governance and innovation shouldn’t be opposing forces. Done properly, governance establishes the boundaries within which people can experiment, adopt new technology and move faster with confidence.
As AI moves from assisting people to recommending decisions to taking action itself, those boundaries will matter more, not less.