FinanceAI Labs

🧭 The regulatory landscape is moving. In both directions. Anyone claiming certainty about AI regulation right now is selling something. The honest picture is movement in both directions at once. 🇪🇺 In the EU, the AI Act became fully applicable on 2 August 2026, but with significant recent relief: a political agreement reached on 7 May 2026, the AI Act Omnibus, extended compliance deadlines for high-risk AI systems. High-risk uses including credit scoring and employment move to December 2027, with AI in regulated products moving to August 2028. Transparency obligations still bite: watermarking requirements for generative AI systems apply from December 2026, with violations carrying fines of up to 15 million euros or 3 percent of worldwide turnover. 🇺🇸 In the US, the picture is fragmentation: a federal posture favouring light-touch rules and preemption, in active tension with a patchwork of state AI laws that remain enforceable unless actually struck down. For finance functions, our read is practical. Deadlines are moving; the direction of travel is not. Every regime converges on the same expectations: classify your AI systems, document them, ensure human oversight, manage data quality, evidence your reviews. ✅ Which means the winning strategy is to govern once and comply many times. A finance function with a proper AI inventory, control wrappers and evidenced sign-off is substantially ready for whichever rulebook arrives first. ⏳ Waiting for regulatory certainty is itself a decision. And it is the riskiest one available. 👉 Is your AI governance built for one rulebook, or for all of them? #EUAIAct #AIRegulation #Compliance #RegTech

🔄 The case for being model agnostic Which AI model should a finance function standardise on? In our view, that is the wrong question. The right question is: which model for which task, under which governance constraints? The frontier models differ in ways that matter to finance. - Reasoning depth for technical accounting analysis. - Context window for long document review. - Cost per token for high-volume workflows. -And, increasingly, data governance terms: retention policies and zero-data-retention eligibility now vary not just by vendor but by individual model. That last point deserves emphasis. When a model's retention terms can differ from its own vendor's other models, standardising blindly on "whatever is newest" is a governance failure waiting to be discovered by your auditor. ⚠️ There are also concentration risks in single-vendor dependence: pricing power, deprecation timelines, and terms that change beneath you. Multi-model platforms such as AWS Bedrock exist precisely because sophisticated buyers refuse that dependence. The opportunity in model agnosticism is real but it carries obligations. Each model in your stack needs its own entry in your risk assessment: capabilities, terms, retention, failure modes. 📋 A model inventory is now as fundamental as a fixed asset register. Our practice is to hold the workflow and the control wrapper constant while treating the model as a swappable component. The review discipline does not change when the model does. That is what makes swapping safe. Model loyalty is not a strategy. Documented model governance is. 👉 Does your organisation know, today, which models are running inside its finance processes? #ModelGovernance #AIStrategy #FrontierAI #FinanceTechnology

🌍 Data sovereignty: the first question every client asks Before any finance leader asks what AI can do, they ask where their data goes. They are right to. The distinctions are material and widely misunderstood. ⚠️ Personal AI subscriptions, even paid ones, typically default to training on your data unless you manually opt out. Client financials do not belong there. Full stop. Enterprise tiers are different: business data is contractually excluded from training, with configurable retention. API routes can go further, with zero-data-retention arrangements. And deployments through AWS Bedrock or Google Vertex keep traffic inside your own cloud boundary entirely. One nuance most teams miss: zero data retention does not automatically cover every model. Some frontier models now carry mandatory retention periods regardless of your contract. Model selection has quietly become a data governance decision. 🏛️ For firms in the Gulf, sovereignty carries regulatory weight. Some regulators require personal data to be stored and processed in the country or under strict cross-border conditions. The Central Bank requires prior approval for material outsourcing and requires every licensee to appoint a Data Protection Guardian. Sovereign cloud regions now make compliant AI deployment genuinely achievable, but only if the architecture is designed for it from day one. 🔐 Our own operating principle is simple: work inside the client's systems, on the client's AI accounts, under the client's access controls. Data protection is strongest when the data never moves. 👉 When your team uses AI on company information, do you know, with certainty, which tier of protection applies? #DataSovereignty #DataGovernance #AICompliance #GCC

⚖️ The accountability question: when an AI output is wrong, who is responsible? Sit with that question, because your auditor, your board and your regulator all will. "The model made an error" is not an answer any of them will accept. Accountability cannot be delegated to software. It never could be. A spreadsheet error was never the spreadsheet's fault. This is why the operating model we advocate is built on one line: AI drafts, a qualified human approves, and the approval is evidenced. Each word carries weight. ✏️ Drafts, because generative AI produces judgement-shaped output that reads confidently whether it is right or wrong. Reading well and being right are different things. 🎓 Qualified, because the reviewer must be capable of catching what the machine missed. Review by someone who cannot challenge the output is theatre, not control. 🔍 Evidenced, because a sign-off that leaves no trail does not exist as far as an audit is concerned. What did the reviewer check, against what source, and where is it logged? The uncomfortable implication for finance leaders: your team's most valuable skill is shifting from producing work to challenging it. That is a training question as much as a technology one, and in our experience it is the most underinvested part of every AI programme. The firms getting this right are not slower. Review by exception is faster than production by hand. They are simply defensible at speed. 👉 In your finance function today, could you name the accountable human for every AI-assisted output? #Accountability #AIinFinance #AuditDefensibility #FinanceLeadership

Governance is the operating system An AI enabled finance function does not fail at the technology layer. It fails at the governance layer. ✅ The good news: the frameworks have arrived. In April 2026, COSO released internal control guidance for generative AI, built on a six step roadmap: govern, inventory, assess, design, implement, monitor. It maps AI risk onto the control framework every finance professional already knows. The expectation from auditors is converging on one principle: AI assisted financial reporting must carry controls equivalent to manually prepared information. Documented review and sign off. Access controls. Change management when models update. Exception monitoring with clear escalation. In January 2026, the PCAOB reinforced the point, stressing that professional scepticism and responsibility must be preserved in an AI augmented environment. 🔑 Notice what none of this says. It does not say "do not use AI." It says "use it inside a control environment you can evidence." That distinction is everything. AI redistributes risk rather than removing it. Risk shifts from manual execution to system design, data integrity, and the ability to challenge machine output. The controller's job does not shrink. It moves up a level. 🛠️ Our practical starting point with any finance team: take one AI assisted output your team produced this month and ask three questions. Who reviewed it? Against what? Where is that evidenced? If any answer is unclear, that is the gap to close before scaling anything. 👇 Could your current AI outputs survive an auditor asking those three questions? #AIGovernance #InternalControls #Audit #CFO

The orchestration layer is being commoditised In the first half of 2026, Expensify, Digits, Ramp, Xero and Intuit all shipped integrations connecting their platforms directly to AI assistants. ⚠️ Read that list again. The finance platforms are building the orchestration layer into themselves. This matters for anyone whose strategy is "we connect your systems with AI." That capability is being given away by the vendors who own the systems. Competing with it means competing with the ERP itself. But here is what the platforms cannot commoditise: judgement. Which process should be orchestrated first? What does the control wrapper look like so your auditor accepts the output? Where must a human sign, and on what evidence? What happens when the agent meets an exception it has never seen? 🧠 None of that ships in a product update. It requires someone who has closed books, faced auditors, and answered to a regulator. Our view: the orchestration layer is becoming plumbing. Valuable, necessary, and increasingly invisible. The scarce asset is the design and governance of what flows through it. ✅ For finance leaders, the practical implication is simple. Before buying another integration, audit the AI capability you already pay for inside your ERP and reporting stack. Most teams are sitting on unused orchestration they have already licensed. Then invest the saved budget where the platforms cannot help you: process selection, control design, and the skills of the people doing the reviewing. 👇 Have you audited what AI capability already sits inside your existing finance systems? #AgenticAI #FinanceTechnology #ERP #DigitalFinance

Three operating models for AI in finance Every firm offering AI for finance is quietly choosing one of three operating models. Most have not noticed they are choosing. Model one: the AI enabled finance function as a service. The provider runs your close, your reporting, your FP&A, with AI doing the heavy lifting. Venture funded players are racing into this space at the small business end. Model two: the orchestration layer. Software that sits on top of your ERP and finance systems, connecting and automating workflows across them. Powerful, but increasingly being built into the platforms themselves. Model three: skills, governance and oversight. Training your team, embedding control frameworks, and providing qualified assurance over AI assisted processes, so the capability lives inside your function rather than outside it. 🔍 Here is our observation from working across all three: they are not really competitors. They are a sequence. Capability starts with people who know what good looks like. Governance makes the output trustworthy. Only then does handing a process to an agent, or an external operator, become defensible rather than reckless. Organisations that skip straight to model one or two without model three end up with impressive demos and unusable outputs. The 7 percent of CFOs reporting strong AI impact did not start with the most automation. They started with the most control. 💡 The right question is not "which tool should we buy?" It is "in what order do we build capability, control and automation?" 👇 Which model is your organisation actually pursuing, and was it a deliberate choice? #OperatingModel #AIinFinance #CFO #FinanceStrategy

The Pilot Trap Nearly every finance team has adopted AI. Almost none are getting real value from it. Around 60 percent of finance teams are piloting or implementing AI projects. Yet only 7 percent of CFOs report a strong impact from that investment. Consider what that gap means. Tools everywhere, results almost nowhere. We see three consistent causes. 1) Scope: Teams try to transform everything at once instead of proving one process end to end. 2) Data: AI applied to a messy process automates the chaos. It produces the wrong answer faster. 3) Trust: Outputs that nobody is accountable for do not get used. They get quietly ignored, and the pilot dies of neglect. The fix is unglamorous. Pick one high friction process with clean inputs and clear outputs. Reconciliations. Variance commentary. Board pack narrative. Build it with a control wrapper: documented review, named sign off, audit trail. Measure the hours saved. Then, and only then, move to the next process. Bain's research adds a useful reframe: when CFOs name their biggest AI win, speed leads at 48 percent, well ahead of headcount savings at 34 percent. The prize is a faster close and earlier insight, not a smaller team. The gap between the 60 percent and the 7 percent is not technology. It is discipline. What stalled your last AI pilot: the tool, the data, or the ownership? #CFO #FinanceLeadership #AIAdoption #FinanceTransformation

AI in accounting and financial reporting has moved from experimentation to an embedded capability. Grant Thornton published a piece on this three weeks ago and it deserves more attention from finance leaders. Their core point: risk is not eliminated by AI but it is redistributed. In accounting, risk shifts from manual execution to system design and data integrity. In auditing, risk shifts toward dependence on models, interpretability and the ability to independently challenge system-generated conclusions. This is the conversation most finance teams aren't having yet. Everyone is focused on what AI can produce. Almost nobody is asking who is responsible when it produces something wrong. Your auditors are already thinking about this. Auditors and regulators expect that AI-assisted financial reporting processes are subject to controls equivalent to those applied to manually-prepared information, documented review and sign-off at appropriate levels, access controls, change management for AI model updates, and exception monitoring with clear escalation protocols. The firms that get ahead of this will have a genuine advantage at year-end. The ones that don't will be scrambling to explain their AI outputs to an auditor who's asking questions they haven't thought about yet. Human sign-off isn't a weakness in an AI-assisted process. It is the thing that makes the whole thing defensible.

🧠 AI Economics, Part 9: What two weeks of breaking this down taught us. We have spent this series unpacking the economics of AI for finance professionals. A few principles stand out as the ones that matter most. → The token is the unit of everything. Output costs far more than input. → The visible token price is 28% of real cost. The other 72% is hidden — orchestration, integration, human review, compliance. → The industry is not profitable. Today's prices are subsidised. Model for them rising. → Costs are collapsing 1,000x in three years. Revisit your AI business cases annually. → Four levers — caching, batching, routing, self-hosting — routinely halve a bill. → Agents cost 50 to 500x more than chatbots. Budget accordingly. → Integration and change management make or break agent projects, not the AI. → Build, buy or hybrid is the decision that defines your cost structure. The finance profession has spent decades mastering the unit economics of traditional business. AI economics is the new frontier — and most of the profession has not been taught it yet. That is exactly the gap FinanceAI Labs is built to close. If this series was useful, follow FinanceAI Labs. There is much more coming. #AIEconomics #FinanceAI #CFO #FinanceTransformation #FinanceLeadership