AI Governance Moves Into Regulatory Examinations Across the US, UK and UAE
Financial regulators in the United States, the United Kingdom and the United Arab Emirates are increasingly treating artificial intelligence governance as part of existing supervisory and examination frameworks rather than waiting for a separate body of AI-specific financial regulation.
A recent ACA Group analysis highlights a common direction across the SEC, FINRA, FCA and Dubai Financial Services Authority: firms remain responsible for governance, risk management, third-party oversight, recordkeeping and supervisory controls when AI is introduced into regulated activities.
US regulators are bringing AI into examination and supervision
The US Securities and Exchange Commission’s Division of Examinations has included technology and emerging financial risks within its 2026 examination priorities, while FINRA’s 2026 Annual Regulatory Oversight Report contains a dedicated section on generative AI. FINRA states that its existing rules and the securities laws continue to apply when firms use GenAI, just as they do when firms use other technologies.
FINRA’s guidance identifies several practical areas firms should be able to demonstrate: formal governance and approval processes for GenAI, testing for accuracy and reliability, ongoing monitoring of prompts and outputs, human-in-the-loop controls, documentation of model versions and decisions, cybersecurity controls, and due diligence over third-party AI vendors. It also notes that firms may need to retain AI-related communications and records where existing recordkeeping rules apply.
Third-party accountability is particularly important. FINRA’s 2026 report recommends initial and ongoing due diligence on vendors supporting mission-critical systems, including assessing vendors’ use of GenAI and ensuring contracts address regulatory and data-protection obligations.
FCA continues to rely on existing regulatory frameworks
The UK Financial Conduct Authority has taken a principles-based approach. The regulator has said it does not intend to introduce additional AI-specific rules simply because a firm uses AI, instead relying on existing regulatory frameworks while testing how AI is deployed in practice.
The FCA’s AI Live Testing programme allows firms to test AI systems in real-world conditions with regulatory support and oversight. Its Mills Review, launched in January 2026 and published in July, examines the longer-term effect of advanced AI on consumers, firms, markets and regulators. The FCA has also said it plans to publish examples of good and poor AI practice later in 2026.
DFSA is also strengthening governance expectations
In the Dubai International Financial Centre, the DFSA has similarly emphasised governance, accountability and risk management. Its 2025 AI survey found that 52% of authorised firms were using AI, up from 33% a year earlier, while 21% of firms still lacked clear accountability or oversight mechanisms. In June 2026, the DFSA issued regulatory expectations on AI risk management for authorised firms in the DIFC.
The underlying supervisory message is increasingly consistent: senior management cannot delegate responsibility for AI risks entirely to technology teams, and firms remain accountable for third-party models and tools used within regulated processes.
ACA Group’s recent survey of more than 200 compliance and operations professionals, 62% of them chief compliance officers, also found that 84% use desktop AI tools at work, while the average firm uses AI in fewer than two of 20 surveyed business functions. That combination of broad access and uneven governance helps explain why AI oversight is moving higher on regulatory examination agendas.
For compliance teams, the practical issue is therefore less whether an AI-specific rule exists and more whether existing governance, supervision, vendor oversight, recordkeeping and risk controls remain effective when AI is introduced into day-to-day workflows.
