The Bank for International Settlements' Financial Stability Institute published an FSI Insights paper examining how policymakers and supervisors are approaching data use and data-related risks in financial institutions’ artificial intelligence applications, with a particular focus on generative AI. The paper frames data privacy, quality, security and governance as core determinants of whether AI adoption can scale safely in deposit-taking, credit and insurance underwriting, and payments. It highlights persistent barriers such as fragmented legacy data, rising use of alternative and synthetic data, and heightened third-party dependencies, which are compounded by market concentration among major AI, data and cloud providers. Cross-sectoral data protection obligations and emerging data-protection-authority guidance are presented as a baseline, but the paper notes practical tensions for AI across the model life cycle, including lawful basis, purpose limitation and data minimisation, individuals’ rights (notably rectification and erasure), and transparency. On the supervisory side, it finds financial authorities largely rely on established, often non-prescriptive frameworks for data management, model risk management, operational resilience and outsourcing and third-party risk management, with international standards such as the Basel Committee on Banking Supervision’s Principles for effective risk data aggregation and risk reporting serving as a key reference point, and it observes early signs of convergence in expectations on data privacy, quality, security and governance across jurisdictions. The paper identifies areas where more tailored supervisory guidance could be beneficial, including clearer expectations on AI data governance and accountability, data quality standards and monitoring, AI-specific data security and incident response, and strengthened oversight of third-party dependencies through greater transparency on data lineage and provider monitoring. It also points to the need for closer collaboration between financial authorities and data protection authorities to reduce uncertainty and cross-border fragmentation.

Original source View in tracker