{
  "apiVersion": "v1",
  "topic": {
    "id": "regulated-ai",
    "title": "How do banks and other regulated organizations use AI within the rules?",
    "group": "Control and oversight",
    "summary": "What regulated organizations allow, audit and keep away from AI, and how they show regulators who approved what.",
    "passages": 6,
    "url": "https://the-ai-record.com/topics/regulated-ai",
    "json": "https://the-ai-record.com/api/v1/topics/regulated-ai.json"
  },
  "passages": [
    {
      "id": "klarna-while-continue-utilize-well-established-ml-techniques-2026",
      "text": "While we continue to utilize well-established ML techniques in our underwriting processes, we do not use generative AI for credit underwriting.",
      "context": null,
      "speaker": null,
      "speakerId": null,
      "speakerUrl": null,
      "speakerLevel": null,
      "role": null,
      "voice": "organization",
      "organization": "Klarna",
      "organizationId": "klarna",
      "organizationUrl": "https://the-ai-record.com/organizations/klarna",
      "aiVendor": false,
      "work": {
        "title": "SEC filing (the company's own regulatory report)",
        "type": "filing",
        "date": "2026-02-26",
        "publisher": "SEC filing (the company's own regulatory report)",
        "url": "https://www.sec.gov/Archives/edgar/data/2003292/000200329226000007/klar-20251231.htm"
      },
      "grade": "A",
      "gradeMeaning": "A filing or earnings call the organization answers for.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "finance-legal-operations",
        "regulated-ai"
      ],
      "functions": [
        "risk"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/klarna-while-continue-utilize-well-established-ml-techniques-2026",
      "json": "https://the-ai-record.com/api/v1/passages/klarna-while-continue-utilize-well-established-ml-techniques-2026.json"
    },
    {
      "id": "monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026",
      "text": "Again, we are a bank. We live in a regulated environment. So, we want to make sure that the non-determinism from the agents is controlled. But at the same time, we want to have an environment where we can let it run loose and develop.",
      "context": "Felisola Caso is explaining why Monzo's agents run in a sandbox in an isolated namespace, separate from production infrastructure.",
      "speaker": "Felippe Felisola Caso",
      "speakerId": "felippe-felisola-caso",
      "speakerUrl": "https://the-ai-record.com/people/felippe-felisola-caso",
      "speakerLevel": "practitioner",
      "role": "Monzo (conference affiliation, 2026)",
      "voice": "person",
      "organization": "Monzo",
      "organizationId": "monzo",
      "organizationUrl": "https://the-ai-record.com/organizations/monzo",
      "aiVendor": false,
      "work": {
        "title": "A Bank Built Its Own Coding Agent. It Took Off (talk, AI Engineer)",
        "type": "talk",
        "date": "2026-10-20",
        "publisher": "AI Engineer (conference organizer) YouTube channel",
        "locator": "6:50",
        "url": "https://www.youtube.com/watch?v=adfw3xJBx1o"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-06"
      },
      "topics": [
        "where-agents-run",
        "autonomy-and-oversight",
        "agent-permissions",
        "regulated-ai"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026",
      "json": "https://the-ai-record.com/api/v1/passages/monzo-we-are-bank-regulated-environment-non-determinism-agents-controlled-2026.json"
    },
    {
      "id": "ramp-architecture-agentic-reasoning-used-intake-context-gathering-2026",
      "text": "With this architecture, agentic reasoning is used for intake and context gathering, but every autonomous risk decision is still made by an auditable model, governed under an approved policy.",
      "context": null,
      "speaker": "Blake Williams",
      "speakerId": "blake-williams",
      "speakerUrl": "https://the-ai-record.com/people/blake-williams",
      "speakerLevel": "practitioner",
      "role": "Product Manager",
      "voice": "person",
      "organization": "Ramp",
      "organizationId": "ramp",
      "organizationUrl": "https://the-ai-record.com/organizations/ramp",
      "aiVendor": false,
      "work": {
        "title": "Ramp engineering blog",
        "type": "post",
        "date": "2026-06-30",
        "publisher": "Ramp engineering blog",
        "url": "https://builders.ramp.com/post/agentic-risk-operations"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "autonomy-and-oversight",
        "finance-legal-operations",
        "regulated-ai"
      ],
      "functions": [
        "risk"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/ramp-architecture-agentic-reasoning-used-intake-context-gathering-2026",
      "json": "https://the-ai-record.com/api/v1/passages/ramp-architecture-agentic-reasoning-used-intake-context-gathering-2026.json"
    },
    {
      "id": "ona-agent-approve-review-person-always-clicks-merge-2026",
      "text": "The AI agent can approve the review, but a person always clicks the merge button. That merge is the traceable approval event for SOC 2: the agent handles the review workload, the human controls what ships.",
      "context": null,
      "speaker": null,
      "speakerId": null,
      "speakerUrl": null,
      "speakerLevel": null,
      "role": null,
      "voice": "organization",
      "organization": "Ona",
      "organizationId": "ona",
      "organizationUrl": "https://the-ai-record.com/organizations/ona",
      "aiVendor": true,
      "work": {
        "title": "How auto-approving low-risk PRs with AI cut our lead time by 74%",
        "type": "post",
        "date": "2026-04-09",
        "publisher": "Ona blog",
        "locator": "Governance",
        "url": "https://ona.com/stories/auto-approving-low-risk-prs"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-04"
      },
      "topics": [
        "autonomy-and-oversight",
        "code-review",
        "ai-approves-code",
        "regulated-ai"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/ona-agent-approve-review-person-always-clicks-merge-2026",
      "json": "https://the-ai-record.com/api/v1/passages/ona-agent-approve-review-person-always-clicks-merge-2026.json"
    },
    {
      "id": "legora-traces-no-access-customer-data-evals-2026",
      "text": "we can't look at any traces basically. We can't look at any data because it's all super confidential. And that's, like, extremely frustrating to work with because you you basically don't know what people are doing.",
      "context": null,
      "speaker": "Jacob Lauritzen",
      "speakerId": "jacob-lauritzen",
      "speakerUrl": "https://the-ai-record.com/people/jacob-lauritzen",
      "speakerLevel": "executive",
      "role": "CTO",
      "voice": "person",
      "organization": "Legora",
      "organizationId": "legora",
      "organizationUrl": "https://the-ai-record.com/organizations/legora",
      "aiVendor": true,
      "work": {
        "title": "Building AI for Lawyers - Jacob Lauritzen, CTO of Legora",
        "type": "podcast",
        "date": "2026-11-02",
        "publisher": "Latent Space",
        "locator": "transcript, around 25:30",
        "url": "https://latent.space/p/building-ai-for-lawyers-jacob-lauritzen-cto-of-legora/"
      },
      "grade": "C",
      "gradeMeaning": "An interview or press quote.",
      "verification": {
        "status": "verified",
        "meaning": "An independent second reader re-fetched the source and confirmed the wording.",
        "reviewedOn": "2026-11-06"
      },
      "topics": [
        "measuring-impact",
        "ai-evals",
        "regulated-ai"
      ],
      "functions": [
        "legal"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/legora-traces-no-access-customer-data-evals-2026",
      "json": "https://the-ai-record.com/api/v1/passages/legora-traces-no-access-customer-data-evals-2026.json"
    },
    {
      "id": "nordic-corporate-bank-agent-tried-to-get-customer-data-2026",
      "text": "How do we dare to do this in a bank? Well, we have the rules built in, and he doesn't have access to the customer data … And then he really tried to get the customer data. He tried to look at the … infrastructure and construct the connection string and all that, but we don't have secrets in our connection strings … managed identity to connect to the database, and his service principal … not have access to the database, so he couldn't get any data.",
      "context": "Asked how the team dares to run an autonomous agent in a bank, the speaker describes a test in which he tried to get the agent to hand over production customer data.",
      "speaker": "Hallstein Brøtan",
      "speakerId": "hallstein-brotan",
      "speakerUrl": "https://the-ai-record.com/people/hallstein-brotan",
      "speakerLevel": "practitioner",
      "role": "Senior consultant, Novanet; developer on Nordic Corporate Bank's system",
      "voice": "person",
      "organization": "Nordic Corporate Bank",
      "organizationId": "nordic-corporate-bank",
      "organizationUrl": "https://the-ai-record.com/organizations/nordic-corporate-bank",
      "aiVendor": false,
      "work": {
        "title": "How We Built an Autonomous Development Workflow at Nordic Corporate Bank",
        "type": "talk",
        "date": "2026-06-29",
        "publisher": "NDC Conferences (YouTube); talk recorded at NDC in Oslo",
        "locator": "23:32",
        "url": "https://www.youtube.com/watch?v=p8M8--12h1Y"
      },
      "grade": "B",
      "gradeMeaning": "The organization's own post, paper or talk.",
      "verification": {
        "status": "reported",
        "meaning": "Not yet confirmed against the source by an independent second reader."
      },
      "topics": [
        "agent-permissions",
        "regulated-ai",
        "security"
      ],
      "functions": [
        "engineering",
        "security",
        "risk"
      ],
      "figures": [],
      "url": "https://the-ai-record.com/passages/nordic-corporate-bank-agent-tried-to-get-customer-data-2026",
      "json": "https://the-ai-record.com/api/v1/passages/nordic-corporate-bank-agent-tried-to-get-customer-data-2026.json"
    }
  ],
  "notice": [
    "Every passage is reproduced word for word from the cited source.",
    "Check the verification status: \"reported\" means not yet confirmed by an independent second reader.",
    "Organizations flagged aiVendor sell AI tools or services and have a reason to publish flattering numbers.",
    "An empty result means the archive holds nothing on it, not that nobody has said anything."
  ]
}