Every bank that touches a large language model these days likes to say it is giving its systems an "AI brain." That phrase came up almost word for word on a recent episode of the Fintech Garden Podcast, episode 172, where Igor Tomych and Novafin's own Dumitru Condrea talked through what actually happens when a bank wires an AI agent into its core systems. The conversation was upbeat about the opportunity. It was also honest about how little most institutions have thought through what comes next.
Here is the uncomfortable part nobody puts in the press release: giving a model access to your core banking stack is not a feature switch. It is a new category of operational risk, and the regulatory clock on managing it is already running.
The access problem is bigger than the model
Most AI rollouts in banking start the same way. Someone wants an agent that can read account data, check a balance, flag a reconciliation gap, maybe draft a response to a customer. The model itself gets most of the attention: which vendor, which context window, how good the reasoning is. The part that gets skipped is the access layer, the thing that decides what the agent is actually allowed to touch once it is live.
OWASP's Top 10 for LLM Applications has a name for the resulting failure mode: excessive agency. It is the single biggest risk category when you hand an AI system standing permission to call tools or APIs, because the model will use whatever scope you give it, and most teams give it more than they meant to. A read only reporting agent quietly ends up with write access somewhere in the stack because nobody revisited the permission set after the pilot.
The fix is not complicated in principle. OAuth 2.0's client credentials grant pattern gives you scoped, short lived tokens instead of a standing key, and the rule of thumb worth repeating to any engineering team is blunt: write capable tokens should live for minutes, not hours. Pair that with a tool broker layer that only exposes narrow, typed functions, never a generic database query interface, and route everything through a structured messaging format like ISO 20022 instead of bolting the model straight onto an old core. None of this is exotic. It is just discipline that tends to get skipped under deadline pressure.
DORA does not care how good your demo was
The Digital Operational Resilience Act has been in force since January 2025, and it is already the real constraint on how fast banks can move with AI vendors, more than the EU AI Act gets credit for. Under DORA Article 28, any third party ICT function classified as critical or important, which an Anthropic or OpenAI API channel feeding customer facing output almost certainly is, triggers a full lifecycle of obligations: pre contractual risk assessment, a documented exit strategy, an entry in the Register of Information. Article 30 then dictates what the contract itself has to say about service levels, data location, sub outsourcing notice, and audit rights.
If your AI vendor contract reads like a standard SaaS agreement, it probably has not been through a proper DORA criticality assessment yet.
The EBA's existing outsourcing guidelines, EBA/GL/2019/02, already supply the methodology for that assessment. Nobody needs to invent a new framework. They need to apply the one that exists, specifically to the AI vendor relationship, before the system goes into production rather than after.
Human oversight is becoming a hard deadline, not a nice to have
The EU AI Act's Article 14 requires that high risk systems, which include credit scoring and other creditworthiness decisioning squarely inside Annex III, let a human understand, oversee, override, and stop the system through something like a functioning stop button. The bulk of these obligations for Annex III systems apply from August 2026. That is not a distant planning horizon anymore. It is a live compliance window banks are already inside.
The hard part is not writing the policy that says a human reviews the output. The hard part is keeping that review real. Internal research on human in the loop guardrails flags a pattern worth taking seriously: approval workflows that start as genuine oversight tend to degrade into rubber stamping within twelve to eighteen months, once reviewers get comfortable and volume climbs. A checkpoint that always shows a confidence score and a rationale, and that escalates rather than silently auto approving on a timeout, holds up better than one that just asks for a click.
There is also a structural requirement that gets missed: the people reviewing the model's decisions need to be organizationally independent from the people who built or are incentivized by it. That is not a new idea. It is the same effective challenge principle the Federal Reserve's SR 11-7 has required of model validation since 2011. AI did not change the logic, it just raised the stakes of ignoring it.
A phased approach beats a big bang rollout
The teams getting this right are not the ones deploying an agent everywhere at once. They are running a tiered pilot: start with read only reconciliation or reporting agents, build out the compliance dossier and risk classification alongside that pilot rather than after it, and only then move to a write capable stage where a human confirms every state changing action on separate credentials from the read only path. Each tier earns the next one. None of them skip the regulatory gate to get there faster.
That sequencing matters because reclassification is not a one time event either. Every time you widen an agent's permissions, you should be re running the risk classification, not assuming the original sign off still covers the expanded scope. Scope creep is where most of the real incidents start.
The part worth remembering
An AI brain is a good line for a podcast title. In production, what a bank is actually building is a new operational system with its own failure modes, its own access model, and its own regulatory obligations that started counting down well before most compliance teams noticed. The institutions that treat the access layer, the audit trail, and the human checkpoint as the actual product, rather than as paperwork around the model, are the ones that will still be running this time next year without an incident report to explain.