Banks and Enterprises: Navigating AI Compliance and Governance

The article discusses the early stages of AI adoption within large organisations, particularly in regulated industries like banking, highlighting challenges such as measuring Return on Investment (ROI) and the preference for "boosting" existing systems over building new ones, as noted by Matthew Barnard, executive director of BBD, on the Tech Unboxed with BBD podcast.

For legal practitioners, this development is significant as it underscores the evolving regulatory landscape surrounding AI, especially in highly regulated sectors like finance. The observation of "pockets of excellence" rather than consistent enterprise capability means that legal and compliance teams must grapple with fragmented AI implementations, potential data governance gaps, and the imperative for robust frameworks to ensure ethical AI use, data privacy, and adherence to financial regulations. The difficulty in measuring ROI also suggests that legal departments might increasingly be asked to quantify risk reduction or compliance benefits, which presents a unique challenge.

While the excerpt does not explicitly cite specific statutes, the reference to "regulated industries like banking" and "security, compliance and governance requirements" immediately brings to mind South African legislation such as the Protection of Personal Information Act (POPIA), the Financial Intelligence Centre Act (FICA), the National Credit Act (NCA), and various prudential standards issued by the Prudential Authority under the Banks Act. These frameworks impose strict obligations on financial institutions regarding data handling, risk management, and operational resilience, all of which are profoundly impacted by AI adoption. The current lack of specific AI legislation in South Africa means existing laws must be interpreted and applied to novel AI use cases.

The primary entities involved are large enterprises, specifically banks, and technology providers like BBD, represented by Matthew Barnard. Internal stakeholders such as "risk teams, finance and the board" are grappling with AI implementation challenges. Regulators, though not explicitly named, are implicitly central due to the "non-negotiable" compliance requirements in the banking sector.

Attorneys advising banks and large enterprises should proactively engage with their clients' AI strategies, focusing on developing comprehensive AI governance frameworks. This includes reviewing data privacy impact assessments, ensuring compliance with POPIA and FICA, addressing potential algorithmic bias, and establishing clear accountability mechanisms for AI-driven decisions. Practitioners should also closely monitor the development of AI-specific regulations, both domestically and internationally, and advise on contractual implications when engaging with AI vendors (the buy, build, or boost decisions). The challenge of ROI measurement suggests a need for legal teams to articulate the value of compliance and risk mitigation in AI adoption.