Topics / Control and oversight
What regulated organizations allow, audit and keep away from AI, and how they show regulators who approved what.
Explore with your AI assistant
ChatGPT (opens in a new tab)Claude (opens in a new tab)Perplexity (opens in a new tab)Grok (opens in a new tab)
Opens a new chat with a prompt that points the assistant to this archive. What it writes is its own, not the archive's: check any quotation on its passage page before you rely on it. Or add the archive to your assistant as a connector: https://the-ai-record.com/mcp (how).
6 passages from 6 organizations; 5 checked against the source. The page states no conclusion: these are the organizations' own words.
While we continue to utilize well-established ML techniques in our underwriting processes, we do not use generative AI for credit underwriting.
KlarnaPublished by the organization itself (regulatory filing), no named author
Regulatory filing: SEC filing (the company's own regulatory report), SEC filing (the company's own regulatory report), February 26, 2026.
Again, we are a bank. We live in a regulated environment. So, we want to make sure that the non-determinism from the agents is controlled. But at the same time, we want to have an environment where we can let it run loose and develop.
Felippe Felisola CasoMonzo (conference affiliation, 2026) · Practitioner, 
Monzo
Context. Felisola Caso is explaining why Monzo's agents run in a sandbox in an isolated namespace, separate from production infrastructure.
Talk: A Bank Built Its Own Coding Agent. It Took Off (talk, AI Engineer), AI Engineer (conference organizer) YouTube channel, October 20, 2026, at 6:50.
With this architecture, agentic reasoning is used for intake and context gathering, but every autonomous risk decision is still made by an auditable model, governed under an approved policy.
Blake WilliamsProduct Manager · Practitioner, 
Ramp
Post: Ramp engineering blog, Ramp engineering blog, June 30, 2026.
The AI agent can approve the review, but a person always clicks the merge button. That merge is the traceable approval event for SOC 2: the agent handles the review workload, the human controls what ships.
OnaPublished by the organization itself (post), no named author
Post: How auto-approving low-risk PRs with AI cut our lead time by 74%, Ona blog, April 9, 2026, at Governance.
we can't look at any traces basically. We can't look at any data because it's all super confidential. And that's, like, extremely frustrating to work with because you you basically don't know what people are doing.
Jacob LauritzenCTO · Executive, 
Legora
Podcast: Building AI for Lawyers - Jacob Lauritzen, CTO of Legora, Latent Space, November 2, 2026, at transcript, around 25:30.
How do we dare to do this in a bank? Well, we have the rules built in, and he doesn't have access to the customer data … And then he really tried to get the customer data. He tried to look at the … infrastructure and construct the connection string and all that, but we don't have secrets in our connection strings … managed identity to connect to the database, and his service principal … not have access to the database, so he couldn't get any data.
Hallstein BrøtanSenior consultant, Novanet; developer on Nordic Corporate Bank's system · Practitioner, 
Nordic Corporate Bank
Context. Asked how the team dares to run an autonomous agent in a bank, the speaker describes a test in which he tried to get the agent to hand over production customer data.
Talk: How We Built an Autonomous Development Workflow at Nordic Corporate Bank, NDC Conferences (YouTube); talk recorded at NDC in Oslo, June 29, 2026, at 23:32.