AI Governance & Compliance

Control your data. Evidence your oversight.

Gain visibility into AI activity, maintain control over sensitive data and infrastructure, and generate evidence to support regulatory compliance.

Five regulatory drivers

Five Advantages of AI Governance

Protect sensitive data

Process confidential client, investor, and business information without routinely sending it to external AI providers.

Control data residency and sovereignty

Keep AI processing in approved infrastructure and jurisdictions, with controls on outbound transfers.

Reduce third-party risk

Limit dependence on external AI providers and unnecessary third-party access to confidential information.

Support regulatory compliance

Access controls, monitoring, AI governance, and audit trails that demonstrate appropriate oversight.

Strengthen operational resilience

Keep locally operated AI running through external cloud disruptions, backed by local security and recovery controls.

AI governance in practice

AI Governance in Practice

How AssetArx's three services help financial institutions address common regulatory expectations. The highlighted service plays the leading role in each example.

AssetArx Supports AI Governance and Compliance

Control Plane maintains approved AI configurations and model records, while Monitoring & Reporting captures usage and activity. Secure AI provides a controlled deployment environment, supporting AI traceability, cybersecurity, and human oversight requirements.

Business Use Case — Banking: AI Creditworthiness Assessment

An EU bank deploys AI to assess individual creditworthiness. AssetArx records approved model configurations, tracks AI usage, and provides audit evidence to support governance and oversight of the high-risk application.

Relevant frameworks: EU AI Act — High-Risk AI Systems (EU) · GDPR · DORA.

Relevant Report PacksPack 01 — EU AI Act Governance & TransparencyPack 06 — AI Governance & CompliancePack 09 — AI Model Risk & Fairness

AssetArx Supports AI Transparency and Accountability

Secure AI provides a controlled environment for AI-powered client interactions, while Monitoring & Reporting tracks AI activity. Together, they support oversight of AI-assisted client services and provide records for governance reviews.

Business Use Case — Wealth Management: AI Client Assistant

A wealth manager introduces an AI assistant to answer client questions about portfolios, investment products, and financial reports. AssetArx keeps confidential client information within approved infrastructure and records AI activity, while the firm informs clients when they are interacting with AI.

Relevant frameworks: EU AI Act — AI Transparency Requirements (EU) · GDPR · MiFID II.

Relevant Report PacksPack 01 — EU AI Act Governance & Transparency

AssetArx Protects Sensitive Data

Monitoring & Reporting identifies unapproved AI services, users, and data activity. Secure AI provides a controlled alternative for sensitive workflows, helping institutions protect confidential information and demonstrate data protection controls.

Business Use Case — Investor Relations: Secure Investor Communications

A firm discovers employees drafting investor communications using public AI chatbots. It moves the workflow to Secure AI, restricts unapproved services, and tracks adoption of the approved environment.

Relevant frameworks: GLBA · SEC Regulation S-P (US) · GDPR (EU) · UK GDPR · Saudi & UAE PDPL · Hong Kong PDPO.

Relevant Report PacksPack 02 — Sensitive Data & Shadow AI ExposurePack 10 — AI Data Protection & Privacy Evidence

AssetArx Supports Data Sovereignty

Secure AI processes sensitive information within approved jurisdictions, while Monitoring & Reporting tracks AI service usage and external connections. Together, they help institutions control cross-border data exposure and demonstrate where AI processing occurs.

Business Use Case — Asset Management: Secure AI for Client Analysis

A DIFC-licensed asset manager deploys Secure AI in the UAE for confidential client analysis, with processing-location and connection records supporting data protection reviews.

Relevant frameworks: GDPR Chapter V (EU) · Saudi & UAE PDPL · DIFC & ADGM Data Protection · Singapore PDPA · Australian Privacy Principles.

Relevant Report PacksPack 03 — Data Sovereignty & Cross-Border Transfers

AssetArx Reduces Third-Party Risk and Strengthens Resilience

Secure AI reduces reliance on external AI providers, while Control Plane and Monitoring & Reporting provide visibility into AI dependencies and availability. This supports third-party risk oversight and business continuity requirements.

Business Use Case — Insurance: Resilient Claims Processing

An EU insurer moves claims analysis to Secure AI, reducing external provider exposure and maintaining AI availability during public service disruptions. Dependency and availability records support DORA oversight.

Relevant frameworks: DORA (EU) · PRA/FCA Operational Resilience (UK) · SAMA & CBUAE Outsourcing · MAS Technology Risk (Singapore) · APRA CPS 230 (Australia).

Relevant Report PacksPack 04 — AI Third-Party Risk & DependenciesPack 08 — AI Operational Resilience

AssetArx Strengthens Security and Accountability

Control Plane manages approved AI access, while Monitoring & Reporting records actual usage and identifies anomalies. Together, they help institutions demonstrate access controls, investigate incidents, and produce audit-ready evidence.

Business Use Case — Private Capital: AI Security Incident Investigation

During due diligence for a potential acquisition, AssetArx detects an unusual increase in data transfers to an external AI service. The private equity firm uses AssetArx to identify the users, AI services, and activity timelines involved, investigate potential exposure of confidential deal information, and support regulatory reporting decisions.

Relevant frameworks: GDPR & DORA (EU, where applicable) · SEC Regulation S-P (US, for covered registered investment advisers).

Relevant Report PacksPack 05 — AI Security & Incident InvestigationPack 07 — AI Access Control & Accountability

Regulatory report packs

Regulatory Report Packs

Ready-made reports from AssetArx Monitoring & Reporting. Each pack answers one or more questions a regulator or auditor asks about AI use, and comes as an executive summary, a detail extract, and alerts.

Evidence from actual AI use, not from what people fill in.

Every pack is built from AI activity AssetArx monitors on workstations, servers, and the Secure AI environment, so it shows what really happened. No surveys and no self-declared registers. Where a pack needs a decision your firm records, such as a risk classification, AssetArx checks it against observed use and flags the gaps.

Pack 01

EU AI Act Governance & Transparency

Can we evidence our EU AI Act obligations for every AI system we use?

For: Chief Compliance Officer · AI governance committee · Data Protection Officer

EU AI Act Arts. 4, 5, 26, 27 & 50 · Annex III high-risk uses (creditworthiness, life & health insurance pricing, employment)

PreviewRequest sample report

Pack 02

Sensitive Data & Shadow AI Exposure

Is confidential data reaching unapproved AI services?

For: CISO · Data Protection Officer

GLBA · SEC Reg S-P · GDPR & UK GDPR · Saudi & UAE PDPL · HK PDPO

PreviewRequest sample report

Pack 03

Data Sovereignty & Cross-Border Transfers

Where did AI processing happen, and did anything leave approved jurisdictions?

For: Data Protection Officer · Legal & Compliance

GDPR Ch. V · UK GDPR · Saudi & UAE PDPL · DIFC & ADGM · Singapore PDPA · APP 8

Request sample report

Pack 04

AI Third-Party Risk & Dependencies

Which AI providers do we depend on, and how much?

For: Chief Risk Officer · Third-party risk & Procurement

DORA register of information · PRA SS2/21 · SAMA & CBUAE outsourcing · MAS outsourcing · APRA CPS 230 · NYDFS 500.11

Request sample report

Pack 05

AI Security & Incident Investigation

What happened, who was involved, and what must we notify?

For: CISO · Incident response team · Data Protection Officer

NYDFS 500.17 · SEC Reg S-P · DORA incident reporting · GDPR Art. 33 · APRA CPS 234

Request sample report

Pack 06

AI Governance & Compliance

What AI do we use, is it approved, and how is it governed?

For: Chief Compliance Officer · AI governance committee · Model risk

EU AI Act classification · SR 11-7 · FINRA 24-09 · SDAIA AI Ethics · MAS AI risk guidance · HKMA, SFC & IA

Request sample report

Pack 07

AI Access Control & Accountability

Can we prove only authorized people used AI with sensitive data?

For: CISO · Internal Audit

GLBA · NYDFS 500.7 · SAMA CSF · APRA CPS 234 · MiFID II, AIFMD & UCITS records

Request sample report

Pack 08

AI Operational Resilience

Can AI-dependent processes survive an external outage?

For: COO · Head of Operational Resilience · Chief Risk Officer

DORA · PRA SS1/21 & FCA PS21/3 · APRA CPS 230 · SAMA & CBUAE · MAS TRM

Request sample report

Pack 09

AI Model Risk & Fairness

Are AI models inventoried, monitored, and used fairly?

For: Head of Model Risk · Chief Risk Officer · Chief Compliance Officer

SR 11-7 · PRA SS1/23 · NAIC bulletin & NYDFS CL7 · EU AI Act · MAS FEAT · HKMA AI principles · FCA Consumer Duty

Request sample report

Pack 10

AI Data Protection & Privacy Evidence

Can we show how AI processes personal data?

For: Data Protection Officer · Privacy team

GDPR Arts. 30 & 35 · UK GDPR · Saudi & UAE PDPL · DIFC & ADGM · Singapore PDPA · Australian Privacy Act

Request sample report

Sample reports

Sample reports, in three formats

An executive summary for the board, a detail extract for compliance and audit teams, and alerts for security operations, all generated from monitored AI activity.

EU AI Act Governance & Transparency Pack 01

Executive summary
EU AI Act Governance & TransparencyQ3 2026
8AI systems in the inventory1 found by monitoring
3high-risk systems (Annex III)logs kept ≥ 6 months
2high-risk systems with open gapsdue by 31 Oct

AI systems by risk class

  • High-risk3
  • Transparency1
  • Minimal or not high-risk3
  • Not yet classified1

0 prohibited practices · AI literacy training: 86% of AI users

Obligation matrix
High-risk systemsDeployer obligations
ObligationCredit scoringPricingCV screening
Human oversight assigned✓✓✗
Authorized users only✓✓◐
Logs kept ≥ 6 months✓✓✓
Workers informed✓✓◐
Rights impact assessment✓◐n/a

✓ evidenced · ◐ partly evidenced · ✗ missing. Each row links to its evidence source.

Alerts
EU AI Act gapsQ3 2026
  • HighNo human oversight ownerThe CV screening tool is a high-risk system with no oversight owner assigned.
  • MediumImpact assessment in progressThe fundamental rights impact assessment for the life & health pricing model is due 31 Oct.
  • MediumUnclassified AI in useAn AI note-taker used by 4 people has no EU AI Act risk class yet.

Sensitive Data & Shadow AI Exposure Pack 02

Executive summary
Sensitive Data & Shadow AI ExposureSeptember 2026
87%AI use on approved services↑ from 72% in June
46users on unapproved services↓ from 118
6unapproved services seen2 new this month

Approved share of AI interactions

3 open exceptions · highest exposure: Investor Relations

Detail extract
Unapproved AI eventsCSV · 1,284 rows
TimeUserDept.ServiceData
24 Sep 09:12U-4F2AInvestor RelationsPublic chat assistant38 KB
24 Sep 10:47U-91C3OperationsOnline translation AI212 KB
24 Sep 11:05U-27DELegalAI note-taker1.4 MB
24 Sep 13:30U-4F2AInvestor RelationsPublic chat assistant22 KB
24 Sep 15:18SVC-RPT-07FinanceHosted AI API3.1 MB

Also includes device or server, channel, approval status, and exception ID.

Alerts
Shadow AI alertsSeptember 2026
  • HighLarge upload to unapproved AIServer SRV-RPT-07 sent 3.1 MB to a hosted AI API that is not on the approved list.
  • MediumNew AI service detectedAn AI note-taker is now used by 4 people in Legal & Compliance.
  • InfoException expiringException EX-0112 for Online translation AI expires in 7 days.

Illustrative sample data. Names, users, and figures are fictional.

Regulations by region

How AssetArx helps, region by region

Key regulations, who they apply to, and how Secure AI supports them.

RegulationHow AssetArx helps
GLBAProtect nonpublic customer information and limit disclosure. Customer-record AI in controlled infrastructure: encryption, role-based access, blocked unapproved model endpoints, and access evidence.
SEC Regulation S-PCustomer-information safeguards, incident response, and service-provider oversight. Secure AI processing of portfolio and investor documents, with user and model activity logs, unauthorized-access alerts, and incident support.
NYDFS 23 NYCRR 500Cybersecurity, protection of nonpublic information, and third-party oversight. Segmented AI workspaces, egress control, model-access monitoring, and security-review evidence.
HIPAAProtect health information where covered. Isolated health records for claims analysis, access logs, and no unauthorized external prompts.
State privacy laws (e.g. CCPA/CPRA)Consumer rights, security, and disclosure, subject to financial-data exemptions. Data classification with purpose-based access, retention, and deletion in AI workflows.
SR 11-7 model risk managementInventory, validation, and ongoing monitoring of models, including AI, at US banks. A central record of approved AI services and models, with usage and configuration history to support model inventory and monitoring.
NAIC AI Model Bulletin · NYDFS Insurance Circular Letter No. 7Governance, risk management, and fairness testing for insurers' AI systems and external data. An inventory of AI used in underwriting and claims, with records of where and how it ran to support governance and testing.
FINRA Regulatory Notice 24-09Supervision of generative AI use by broker-dealers. Visibility of generative AI use across the firm, with records to support supervisory review.
RegulationHow AssetArx helps
UK GDPR · Data Protection Act 2018Lawful, secure processing of personal data and safeguards for international transfers. Secure AI processing in approved locations, with records of AI use involving personal data.
PRA SS2/21 outsourcing and third-party riskOutsourcing and third-party risk management for PRA-regulated firms. An inventory of external AI providers in use, approved access paths, and reduced dependence through Secure AI.
PRA SS1/23 model risk managementModel risk management principles for banks, including AI models. A central record of approved AI models and services, with usage and change history.
Operational resilience: PRA SS1/21 · FCA PS21/3Important business services must stay within impact tolerances during disruption. Secure AI on dedicated infrastructure keeps AI-dependent services running through external outages.
FCA Consumer DutyGood outcomes for retail customers, including where firms use AI. Oversight of AI used in customer-facing processes, with records to support outcome reviews.
RegulationHow AssetArx helps
GDPR Arts. 5, 25, 32Lawful, minimized, and secure processing, with privacy by design. Secure AI inference and retrieval over approved data, with restricted permissions, minimized prompts, and documented processing.
GDPR Chapter VSafeguards for transfers outside the EEA (not a blanket EU-hosting mandate). Prompts and outputs stay in approved regions, with restricted outbound connections and egress logs.
DORAICT risk, resilience, incident reporting, and ICT third-party risk. Fewer external AI dependencies, plus provider records, service-health monitoring, recovery testing, and audit evidence.
EU AI ActRisk-based AI obligations, including creditworthiness and life/health insurance pricing systems. AI inventory, model versions, logs, oversight, and evaluation records. Secure AI hosting alone does not satisfy the Act.
MiFID II · AIFMD · UCITS · Solvency II · IORP IISector governance, record-keeping, and outsourcing oversight. Restricted access to client, fund, claims, and beneficiary records, with auditable AI-assisted processing.
RegulationHow AssetArx helps
Saudi PDPLPersonal-data protection and conditions for cross-border transfers. Saudi-controlled AI processing, with foreign endpoints restricted and access and transfers recorded.
SAMA outsourcing and information securityCustomer confidentiality and controls on regulated outsourcing, including overseas. Banking data processed locally, with reduced overseas vendor access and approval, risk, and audit documentation.
UAE Federal PDPLPersonal-data security and transfer controls. AI data flows kept in approved locations, with egress rules and processing logs.
CBUAE outsourcingGovernance and confidentiality for licensed institutions. Controlled AI vendors and customer-data access, with third-party review support and logs.
DIFC DP Law 2020 · ADGM DP Regulations 2021Personal-data security and international-transfer safeguards. Segregated client and fund workspaces in Secure AI, with auditable access, retention, and transfer controls.
SAMA Cyber Security FrameworkCybersecurity governance and controls for SAMA-regulated institutions. Monitoring of AI activity on workstations and servers, with controlled access paths and audit records.
SDAIA AI Ethics PrinciplesSaudi principles for responsible AI, including privacy, accountability, and transparency. Inventory and oversight records of AI use, with sensitive processing kept in an approved Secure AI environment.
RegulationHow AssetArx helps
Singapore PDPAPersonal-data protection and overseas-transfer limits. Approved Secure AI processing, minimal personal data in prompts, and logged cross-border transfers.
MAS technology risk, outsourcing, and AI guidanceSecurity, vendor oversight, and AI governance. Approved models with controlled access, model inventory, monitoring, and third-party assessments.
Hong Kong PDPOPrinciples for data use, security, and retention. Controlled personal-data retrieval and retention, access logs, and no unapproved sharing.
HKMA · SFC · Insurance AuthoritySector technology and outsourcing expectations. Controlled AI deployment, access monitoring, and documented outsourcing-risk decisions.
Australia Privacy Act · APPsPersonal-data protection and cross-border disclosure rules. Restricted AI data exports, approved data sources, and documented handling of client data.
APRA CPS 234 · CPS 230Information security, operational risk, and service-provider management. Controlled AI operations, continuity testing, security monitoring, and documented vendor dependencies.
MAS FEAT PrinciplesFairness, ethics, accountability, and transparency in the use of AI and data analytics. Records of which AI services and models are used, where, and by whom, to support accountability reviews.
HKMA high-level principles on AIGovernance, accountability, and data protection expectations for banks using AI. Central oversight of approved AI services and evidence of controlled use.
Official sources

Regulatory references

Keep AI inside your perimeter, and the evidence in your hands.

Explore use cases Discover the product