Consulting · AI Systems
Governance and Compliance
AI a regulator can examine.
Financial firms already know how to govern models: model risk management frameworks have covered pricing, credit and risk models for years. Language models fit that discipline with adjustments for their nature, and regulators in every major jurisdiction have made clear they expect the discipline to apply. Wesvel helps firms build governance that satisfies examiners without stalling the work.
Model risk management
Inventory of every model in use and its purpose. Validation before deployment against the firm’s evaluation set, with documented limitations. Ongoing monitoring for drift, error rates and misuse. Change control on models, prompts and retrieval sources. Clear ownership for each system. The framework exists; it needs extending to systems whose behavior is probabilistic and whose inputs are natural language.
Human oversight
The level of human review is set by the consequence of an error. Drafts and research can be reviewed after the fact; anything that reaches a client, a counterparty, a regulator or a system of record is approved by a person before it does. The approval is recorded. Automation bias, the tendency to wave through what the machine produced, is addressed by design: sampling, second review, and outputs that show their sources.
Records and disclosure
Prompts, retrieved context, outputs and approvals are records, subject to the same retention and supervision rules as any other business communication. Clients and counterparties are told where AI is used in ways that affect them. Marketing and investor materials produced with AI go through the same compliance review as any other.
Vendors and jurisdictions
AI vendors are third parties and receive third-party risk diligence: data handling, security certifications, sub-processors, incident history, financial stability, exit terms. Jurisdiction matters: emerging AI-specific regulation in some regions, existing securities, banking and data protection law everywhere. Governance is designed with counsel to the strictest regime the firm operates under.
Practice
How Wesvel approaches it
- 01The firm’s existing model risk framework is extended to language models rather than replaced.
- 02Human approval is required for any output that reaches a client, counterparty, regulator or system of record, and the approval is recorded.
- 03Prompts, context, outputs and approvals are retained under the firm’s records policy.
- 04AI vendors pass third-party risk diligence and are reviewed on a schedule.
More in AI Systems
- Legacy LLMs vs Open-Weight ModelsWhat hosted frontier models and open-weight models each do well, what they cost in money and control, and how to use both without being captured by either.
- Own Your DataKeeping proprietary data inside the firm’s perimeter, understanding what vendors may learn from it, and building retrieval so models use your knowledge without absorbing it.
- Training Your Own ModelsWhen to fine-tune or distill an open-weight model on internal data, how to do it without leaking it, and how to prove the result is better.
- Building Internal SystemsThe architecture around the model: orchestration, tools, retrieval, evaluation, monitoring, security and the infrastructure to run it.
- AI in Financial OperationsThe use cases that hold up in investment, lending and advisory operations, and the ones that do not, drawn from how Wesvel uses these systems itself.