Blog The coming wave of AI regulation: turning compliance into competitive advantage

The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members.
The faster artificial intelligence develops, the more obvious the need for rules that govern its use becomes. But while the technology itself has raced ahead, regulation is still catching up.

Now, between the EU's AI Act and various jurisdictions developing their own legal frameworks, AI regulation is becoming a highly fragmented field for companies that operate across borders.

With no single global standard in sight, businesses face a clear challenge: how do they pursue AI innovations responsibly without falling into one compliance pitfall or another?

Navigating a fragmented landscape

The EU AI Actintroduces strict, risk-based rules: high-risk systems will face heavy obligations around transparency, oversight, and data quality. In contrast, we also have the UK, which decided to adopt a lighter touch - a principles-led regimeinstead of rigid laws. That strategy empowers sector regulators to intervene in a more tailored, context-specific manner when there is an identifiable risk.

For financial institutions that seek to work globally, this difference in regulatory approaches can feel like a minefield. And for now, the best way for them to prepare is by trying to find a universal baseline in governance that would be able to fit most countries. That means defining what data can be used, establishing clear accountability for AI projects, and setting up systems for monitoring and incident reporting.

Naturally, these rules can't just be a one-off thing, either - as regulation evolves, you need to update them regularly to keep up with the changing rules. Firms that take a proactive stance will be able to adapt faster.

AI risks in the payments industry

With AI-powered deepfakes and synthetic identities on the rise, the amplification of existing fraud occurring at an increased pace. Nowhere are these risks more immediate than in payments. AI has further reduced the barriers to entry for threat actors. AI-powered attacks are sophisticated, allowing threat actors to polish language in phishing emails and deepfakes, consistently testing industry defences. While threats are mitigated through interaction of existing multi-level checks, there are ways to set up active defences, which are proactive rather than reactive. Regular liveness checks, ongoing document verification, and AI-powered anti-fraud monitoring that learns from evolving attack patterns - all of these can help reduce and mitigate dangers.

Another challenge comes in the form of AI bias. Poorly tuned models can unfairly block transactions or disadvantage certain customer groups. To mitigate this risk, firms should combine fine-tuned training with human oversight, especially if a questionable case comes up. AI still lacks the ability to make nuanced decisions guided by morality and empathy, which means a human touch remains necessary.

Transparency is also highly helpful in this regard. By keeping detailed logs of AI decision-making and allowing manual review on request, firms can maintain both accountability and customer trust.

Finally, the use of third-party APIs raises concerns about data leakage. To my mind, the way forward here is to host models in-house where possible, ensuring sensitive information doesn't leave the organisation.

Why early action pays off

Firms that embed compliance into their AI practices from the start will be in a stronger position than those who treat it as an afterthought and an unwanted burden that "they simply have to deal with."

There are clear benefits to consider: greater trust from clients and partners, fewer costly reworks later on, and the ability to meet regulators head-on and get their respect for trying to follow rules as best you can.

Finding a balanced approach will allow firms to innovate without exposing themselves to unnecessary regulatory or reputational risk. In a competitive market, gaining and retaining trust may very well be one of the most valuable advantages you can have.