AI is no longer sitting quietly in the background of workplace tools. Assistants, meeting notetakers and agentic AI are now active contributors to business communications, yet the governance needed to oversee them is lagging well behind the pace of deployment.
Theta Lake’s 7th Annual Digital Communications Governance Report, which surveyed 500 IT and compliance leaders, shows the scale of the problem.
While 99% of financial services firms intend to expand their use of AI, 88% say they are already facing AI governance and data security challenges, a major barrier to further adoption. Firms that put governance in place early, whether regulated or not, stand to accelerate their AI ambitions.
The first shift is that AI will be treated as a genuine participant in workplace conversations. As firms embed AI deeper into Unified Communications and Collaboration (UCC) platforms, the volume of “aiComms” is set to surge. AI already drafts client emails, retrieves data on request and summarises client meetings.
Because these exchanges evolve over multiple prompts, reviewing isolated prompt-response pairs misses vital context. Where AI interactions relate to regulated activity, they must be captured, supervised and archived in the same way as human communications.
Second, oversight will extend to how people interact with AI, and how AI systems interact with each other. Employees are increasingly attempting to bypass guardrails using techniques such as “Jailbreaking” to reach restricted information or manipulate outputs.
Even with controls in place, AI can unintentionally expose PII, client data, MNPI or confidential documents. Firms will need full visibility into prompts, outputs and behaviours, with content inspection capable of spotting leaked data, injection attempts and unsanctioned tools.
Third, buyers are losing patience with “AI-washing”. Vendor promises are giving way to demands for independent verification, driving interest in ISO/IEC 42001, one of the first international standards for AI management systems. The certification offers auditable evidence of responsible AI practices and aligns closely with regulation such as the EU AI Act.
Fourth, regulators are making their expectations explicit. FINRA’s 2026 Annual Regulatory Oversight Report includes a dedicated section on generative AI, confirming that firms remain accountable for communications whether produced by humans or machines. The FCA has likewise stated that existing UK frameworks apply to AI-enabled activities.
Supervisors will expect firms to archive regulated AI communications, review AI outputs as rigorously as human content and maintain firm controls over AI usage. Accuracy and compliance of AI-generated content, already the leading concern among firms, will attract closer scrutiny.
Finally, AI sprawl demands a unified approach. With 82% of organisations using four or more UCC tools, and AI now built into Microsoft Teams, Zoom, Webex and RingCentral, governing tool by tool creates blind spots. Consistent, cross-platform oversight will be essential as AI systems increasingly interact with one another.
The message for 2026 is clear, in that firms that close the visibility gap now will be best placed to capture AI’s value while meeting regulatory expectations.
Read the full Theta Lake post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
