Artificial intelligence is evolving at a break-neck speed. The technology is on what feels like an exponential growth curve, being implemented across businesses’ operations in industries far and wide. Despite this, there is a yawning chasm opening up: the regulatory environment surrounding it.
LexisNexis Regulatory Compliance recently published a report that mapped the state of AI regulation across the UK, EU, US, China and Australia. RegTech Analyst Editor Daniel Willis spoke to Daveena Suri, UK/EU Content Manager at LexisNexis about how businesses should stop focusing on whether regulation can keep pace with every technology breakthrough and instead concentrate on building effective governance, accountability and oversight. To read the full report, you can download it here.
One of the key findings in the report was a growing gap between AI deployment combined with regulatory oversight. As mentioned, AI is evolving and expanding every day – and the ability to keep up with new innovations is becoming harder and harder. This is especially true for regulators.
This poses a billion-dollar question: is regulation now structurally incapable of keeping pace with AI?
Suri said she would distinguish between keeping pace with every technical development and remaining compliant.
For Suri, trying to match every technology development is the wrong benchmark. The more important measure is whether firms understand who is accountable when systems fail and whether governance frameworks adapt as risks evolve
The AI governance balance
In the ongoing AI race, we’ve seen the UK and EU taking different approaches to AI governance.
With differing approaches considered, will such a move create a more competitive advantage for some financial markets, or just increase compliance costs?
In these examples, Suri believes that both are possible. “The UK’s approach can create a bit more flexibility, whilst the EU’s risk-based framework can support more consistent expectations across the market.”
She is also clear in suggesting that neither automatically guarantees faster innovation or faster progress, but businesses do require predictable supervision and clarity about what acceptable practice looks like.
However, the competitive advantage for Suri will belong to the firms who can establish a system that can be used across multiple jurisdictions. Regulatory clarity can shorten the route from a promising pilot to a service that you can deploy into organizations.
How to demonstrate an AI system is compliant
A question to be considered is how financial institutions can demonstrate that an AI system is compliant when its decision-making processes cannot be fully explained.
For Suri, it’s going to be more about a particular use of a system. What does she mean by this? In practice, she doesn’t think there will be a universal model that works for all; however, she believes its key to understand what kind of AI is being used in a system and why.
She explained, “Is this AI able to evidence a system’s purpose, data, validation? Is it showing you what your limitations are, or what is the risk matrix or what is the performance? Then you provide an explanation required for the decision concerned.”
Suri cited a recent legal case where the EU Court of Justice confirmed that for automated decisions within the relevant GDPR provisions, individuals must receive an intelligible explanation of the procedure and the principles that are applied to their data.
“What is that actually showing?” said Suri. “It’s showing how does evidence support purpose, but also how does it demonstrate where AI is effective? Data is an important way to mitigate risk, because it can provide strategy to identify and resolve aspects of risk .
Where to draw the line on human oversight
As AI moves from assisting compliance teams to making indecisions more autonomously, where should firms draw the line on human oversight?
In the view of Suri, a key watchword here is trial and error. “If there’s a consequence and an error follows, how quickly can harm occur to the business? Can the action be reversed or corrected? These are key issues where human oversight is needed.
“Whilst AI tools are used in-house, you must look at the consequences. As you see more consequences, you will then have to have tighter permissions, stronger validation, and clearer escalation thresholds, so the human oversight has to be real. If you don’t have human-in-the-loop, these issues aren’t going to be corrected,” a key theme referred to.
The human oversight allows such thresholds to be extended, as well as allowing escalation and validation to occur. As AI is a technology that is doing the activity, Suri believes accountability has to remain identifiable.
She added, “Someone must own the decision to deploy the system, its operating limits, and a response when those limits are breached. If we don’t have that, that’s a risk in itself for the business.”
The challenges with regulatory fragmentation
The whitepaper also identifies overlapping regulation as a major challenge. With the financial industry fast evolving, regulations are struggling to keep pace with technological innovation.
Could this lead to considerable regulatory fragmentation becoming a major concern and obstacle to AI adoption more than the technology itself?
Suri raised the example of scaling. “A firm can demonstrate that a technology works and then struggle to establish how it can be deployed across products, entities and different jurisdictions. What we need is to distinguish those of overlapping obligations from genuinely conflicting ones.”
She gave the example of how the EBA has already mapped out AI requirements against banking and payments legislation, including DORA, and that firms need to assess the relationship between these frameworks.
She continued, “We need to make sure that whilst these analogies are being scaled, they’re being scaled correctly. So, if regulation is fragmented, we need to adopt technology in the same kind of stance, but also making sure the connection is shared within divisions of an organisation, connectivity and culture are important here.”
This presents a strong use case in her view for online platform tools, where she raises platforms like LexisNexis Regulatory Compliance that can offer ‘expert-authored obligations’, where the connection point is made for the organisation.
“There needs to be a layer of contingency between human in the loop but also regulatory fragmentation, and then dealing with the obstacles of deploying technology through the organisation,” Suri remarked.
How self-regulation works
Many businesses rely on voluntary AI governance frameworks. What would convince Suri that self-regulation is working rather than simply giving firms cover against future scrutiny?
She stresses that she would look for evidence that it changes decisions, especially when its doing so is ‘commercially inconvenient’.
Suri explained, “If a firm has delayed a launch because testing revealed unacceptable outcomes or products not doing what they should, we need to look at the independent challenges that have led to narrower permissions or a different model.”
Another thing key to look at is whether customers are able to challenge decisions and obtain meaningful remedies. This for Suri is the answer to whether AI governance is working or not.
“Once you have that evidence and you have those results, then you’re able to have some form of escalation procedure or a plan,” she commented. “Therefore, a low instant count is not persuasive if the organization has weak detection or is discouraging reporting because, simply, you’re not getting that data.”
The role of RegTech in AI regulation
What role should RegTech play in turning evolving AI regulations into continuous operational controls rather than periodic compliance exercises? This is a key question for many in the RegTech sector, and one that Suri has an interesting answer for.
“I think RegTech needs to help close the gap between regulatory change and a verified change in how the business operates,” she said. For Suri, this requires a sensible, connected process.
She explained, “You need to identify the development, assess applicability, locate affected systems and controls and assign responsibility, because larger organisations have many divisions that are doing that.”
After this point, firms need to retain the evidence that it works. Alerts and streamlining intelligence are valuable, she claims, but the operational outcome matters because this is what the business is recording.
“Firms almost need to connect that regulatory understanding to their own governance workflow, system monitoring and assurance, and AI can be implemented in that through interpretational mapping,” exclaimed Suri. She added that you do need source traceability and appropriate review, but companies need to realise that the commercial opportunity from this is significant.
It’s less about repeated interpretation for the LexisNexis content head, and she believes that companies want to be channelling more consistent decisions and better visibility of outstanding actions.
She said, “I personally would measure success by how reliably a firm turns a relevant change into an effective control, but how sustainable also is that process? Because if you’ve got a sustainable process in place operationally, it’s going to work a lot smoother.”
The future of AI regulation
Looking ahead to 2027, what are the biggest changes in AI regulation that financial institutions need to be preparing for today?
To this question, Suri’s expectation is a stronger emphasis on proving that AI remains controlled throughout its operational life, especially as systems gain permission to act with autonomy.
She gave the example of approval to use AI models, suppliers changing, services updating and data shifts. “Firms almost need evidence that their original assessment still holds,” said Suri.
“You need an AI inventory, which is what I would call it, in the best case scenario, where you connect an organisation’s obligations towards compliance, controls, monitoring and evidence, and you have data to support this, or you’re looking at trends and analysing those trends, and you can almost see what is acceptable and how it remains in certain boundaries,” said Suri.
Suri concluded by stating her belief that this is about ‘adopting scale with confidence’, but also within a remit where you can control it and evolve as well.
“Because, as we go through time, scalability will only increase,” she finished.
Download the full report here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
