· Business
It is already here.
- The SEC has made AI controls a focal point of its examination priorities and has already brought AI-washing enforcement actions.
- NYDFS has issued AI cybersecurity guidance and is requiring documented asset inventories and data minimisation practices.
- In Australia, ASIC has already warned of a governance gap as firms adopt AI faster than their controls are maturing.
- In New Zealand, the FMA has published AI research for financial services and said firms need appropriate oversight to manage AI risk and deliver good customer outcomes.
- Guidance for organisations using commercially available AI products says the Privacy Act and IPPs apply to AI use.
For firms with millions of customer records, the exposure adds up fast. California’s CCPA amendments also allow penalties of $7,500 per intentional violation, per affected consumer.
The real question is not whether regulation is coming. It is whether your systems, controls, and policies are ready for the regulation already in force.
How ready do you think most firms really are for AI scrutiny right now?
If you want the full white paper, get in touch and I’ll send it over.
