When the regulator says “show us it works”

What the cheat sheet covers

A practitioner’s guide for financial services firms on what a supervisor actually looks at when asking to see AI governance working. Under principles-based supervision there is no checklist for the examiner to tick and none for a firm to hide behind. Consumer Duty, SM&CR and operational resilience all resolve to one question: show us your AI governance working in practice, not on paper. The burden of proof sits with the firm.

The guide turns on one distinction. A control that is written down is documentation. A control that demonstrably changes what a person or a system does at the point of decision is governance. Most firms can produce a control library; far fewer can show that one control in it ever changed an outcome.

Key points

• What fails the question: a policy that names a control but cannot show it firing, sign-off that is a click at speed near 100% approval, a model risk owner on the org chart but absent from decisions, guardrails described in a deck rather than enforced at runtime, and an audit trail assembled after the examiner asks for it.
• Five questions documentation cannot answer, covering provenance, accountability, scope, review and runtime constraints. SM&CR needs a named person who understands and controls the risk, and the test is whether that person can be shown making or overturning a decision.
• Weak signals worth looking for: approval rates near 100%, reviews completed in seconds, reviewers also on delivery, and scope that grew because it worked in a pilot, with no reversal ever recorded.
• A self-check for one customer-facing AI-assisted process across Evidence, Accountability, Scope, Review, Constraint and Stop. Every box you cannot tick with an event rather than a document is documentation, not governance.
• The trap: the Treasury Committee has accused the regulators of a wait-and-see approach, and the regulators have pushed the same test back onto firms. Adoption has raced ahead of anyone’s ability to evidence it.
• The one that matters most: if you cannot point to a moment where a competent check actually stopped the wrong thing from shipping, you have the control’s description, not the control. The guide is framework-neutral and built from composite patterns.