What regulators actually want
Edition 2. Two more industries on the map, the last three traps, what regulators ask for, and the banking numbers.
Welcome back. Edition 1 mapped banking’s two AI frontiers and the first three traps that stall AI programs. This edition adds two more industries, finishes the traps, and turns to the regulators.
One idea runs through all of it: the gap between what organizations send regulators and what regulators actually want to see.
The map: insurance and public sector
Two more industries since the first edition.
Insurance, where the threat frontier quietly siphons profit away and the adoption frontier is where the enforcement is. California’s regulator settled for $2.1 million over app-based claims handling that ran without the licensing and oversight controls the law already required, and in the courts, claims over automated denials and fraud screening are going forward.
Public sector, the one industry that regulates AI while deploying it. Institutional trust decay is the one cell on that map that makes every other cell worse.
The framework: the last three traps
Fragile foundations. If you actually follow your own data governance, policies and security rules, you’re 60 to 70% of the way to mature AI governance. The trap is that many organizations don’t, and that gap is cultural before it’s technical.
Deciding from a place of lack. When cost savings is the first metric on the dashboard, you get a small, safe program that pays for itself and changes nothing.
Explainability gaps. When nobody can explain a recommendation, the person accountable overrides it. The override rate is the cheapest trust metric you already have.
All six traps share one thing. None of them is a tooling problem. Every one is a governance decision nobody made.
The regulators: accountability over algorithms
This month I started a series on what regulators actually want. The first two answers: give them a phone number, and show them your dashboard, not your framework. The questions are strikingly consistent. Who is responsible? What are you monitoring? What happens when it goes wrong? They don’t expect perfect AI. They expect responsible, accountable management of imperfect AI.
The banking numbers
From the SAS and IDC research on banking (453 banks, fall 2025): 65% have used AI for more than three years, yet only 1 in 4 report an integrated, organization-wide AI strategy. Revenue loss tops their concerns about responsible AI, at 50%. And 83% say they’re increasing investment in trustworthy AI, driven by agentic AI.
Read those together. Banks aren’t short on experience or intent. They’re short on integration, which is exactly where a regulator’s questions land.
The thing I got wrong
For years I talked about banking’s three lines to health systems and life sciences companies using a name its authors had retired in 2020. The Institute of Internal Auditors took “defense” out of it for a reason: the word pushed organizations toward pure risk reduction instead of balancing risk against value. It’s the 3 Lines Model, and it’s a structure for making good decisions quickly, close to the people with context. Not a perimeter.
One ask
Forward this to whoever prepares your organization for its next regulatory exam, and tell me in the comments the question you most dread a regulator asking. I’ll take on the best ones in a future edition.
Referenced in this edition
- Edition 1: The two AI frontiers every board is missing (banking map, traps 1 to 3)
- Insurance’s two AI frontiers
- Public sector’s two AI frontiers
- Trap 4: fragile foundations
- Trap 5: deciding from a place of lack
- Trap 6: explainability gaps, with all six traps
- 3 Lines is leaving banking (Sibos week)
- What regulators want, part 1: give them a phone number
- What regulators want, part 2: show them your dashboard
Autonomy Is Earned is published here first and also runs as a monthly LinkedIn newsletter, for boards, CAIOs and regulators. Read this edition on LinkedIn.
