Summary
AI agents are advancing faster than many investment firms’ governance frameworks. Asset managers can prepare for greater regulatory scrutiny by extending existing compliance principles to AI: defining agent authority, controlling data access, monitoring behavior, preserving audit trails, and building explainability into a unified data and governance foundation from the outset.
The national conversation about AI has taken a sharp turn in recent weeks as its own creators are sounding the alarms about the macro dangers and risks of moving too fast without strong governance and guardrails.i When we talk about AI governance in asset management, we are not talking about existential danger. But the scenarios can be costly and damage hard-earned trust. Perhaps a firm shaved 50 basis points off a client’s return because the AI agent was incorrectly sweeping cash from one account to another. Or it buys a security the client’s mandate explicitly prohibits.
It is only a matter of time before financial regulators develop a Dodd-Frank-style AI regulation that will be an extension of data governance and audit disciplines which the industry already practices. Firms that treat agentic AI governance as a "get ahead of it" rather than a "wait and comply" turn a future compliance cost into a risk management and trust advantage today.
In 2011, the SEC discovered the first-ever incident of a material error in a quantitative investment model when quantitative investment manager AXA Rosenberg concealed an error in the computer code which impacted more than 600 client portfolios and caused approximately $217 million in losses. The firm was penalized $240 million, a risk management failure that led to the firm’s collapse.
“The governance breakdown that led to the unraveling of AXA Rosenberg had its roots in a technology migration project... The migration, which was intended to take no more than a few years, ended up stretching out over a decade and effectively became a continuous work in process. Part of the problem was the way the project was managed; rather than upgrade the model in its totality all at once, the model was upgraded piecemeal. As the research center was constantly rewriting code to optimize its investment strategy and to keep up with rapid growth and new product development, the migration was unable to keep pace with the continuous revisions.” — Risk Management Breakdown at AXA Rosenberg: The Curious Case of a Quant Manager Trusted Too Muchii
As cautionary tales go, the AXA Rosenberg case is more than a little relevant to firms’ AI operationalization journeys. The fact that its programmer incorrectly programmed the risk model so that some of its calculated risk elements were too small by a factor of10,000 did not absolve the firm of fiduciary responsibility. Despite AI agents’ autonomy, regulators will not send the machines the bill for mistakes. Further, blaming third-party enterprise model providers for incorrect regulatory submissions will not shield a firm from liability and remediation costs that can reach millions of dollars. Institutions need governance frameworks that address the unique challenges of third-party foundational models.iii
Firms that deployed AI tech stacks without considering extensions of existing financial compliance laws have found that retrofitting is more expensive than if they had baked it in from the beginning. Firms should scope agentic AI for access to sensitive data, by default. And that access should be limited to the minimum data surface needed for the task instead of blanket data access. AI models risk inadvertently processing or leaking sensitive personal data, trade secrets, counterparty details, or material non-public information (MNPI) if they cannot differentiate sensitive information from public data. General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) data privacy laws remain in effect, but now they have become more difficult to comply with.
We have been urging clients that embedded AI governance architecture be top priority because AI errors could run undetected at scale, creating severe liability when firms fail to monitor or disclose problems.
Building operational workflows at high speed with AI agents makes it impossible to catch every mistake without systematic monitoring and reporting mechanisms. The recent rash of rogue AI incidents in the news has certainly brought the issues of governance and oversight to the forefront.iv Imagine if agents within a hedge fund or asset management firm went rogue and decided to engage in trade abuses like spoofing, flooding the market with orders to create a favorable market without tipping off the regulators.
As institutions advance from chatbots and generative AI pilots to autonomous AI agents capable of executing real-world actions such as updating position records or executing cash sweeps, they must oversee the workflows to prevent actions performed incorrectly, unexpectedly, or without human authorization. Governance architecture should precede multi-step agentic operations and should be a tentpole of the overall rollout.
There will be no shifting of responsibility to our platoons of AI agents. Ironically, AI, and the mechanisms that make it work on our behalf, do not introduce probabilistic processes to a business. It is the people who are probabilistic. Therefore, the regulatory burden on human behavior is a good model for how AI governance and compliance will be implemented. The regulatory burden that's likely coming will be focused on how your firm is using agents to trade, evaluate trading, or consume market signals. One can assume that new AI in financial services laws will mirror existing financial services laws based on the regulatory principle “same activity, same risk, same rules.” Therefore, rules aligned with the EU’s Markets in Financial Instruments Directive II (MiFID II) will include rigorous reporting and disclosures and compliance rules, including firms being “required to specify their monitoring and risk control mechanisms...expected to demonstrate how compliance, risk management, and internal audit frameworks capture the use of AI in both client-facing and internal processes.”v
Firms can look to other major regulatory bodies for hints into future rules. The Monetary Authority of Singapore published its 50-page Artificial Intelligence Model Risk Management recommendations paper in 2024, advising that institutions, when developing AI, pay close attention to “data management, model selection, robustness and stability, explainability and fairness, as well as reproducibility and auditability.”vi
Even though national and state policymakers are deliberating on what a viable AI governance framework for financial services will look like, firms must act now not only to prepare for the inevitable frameworks but also to contain operational risk and model risk, foster stakeholder confidence, and ensure reliable performance.
However, compliance leaders don’t need to construct an entirely separate compliance system. They can adapt their core compliance frameworks, applying existing compliance playbooks and surveillance principles to monitor AI agents just as they do SaaS solutions and human employees. Data classification rules apply the same way, regardless of whether a human or a model queried the record. Every data boundary that exists for human analysts (client-confidential separation, PII handling rules) should be enforced identically but more mechanically for AI agents and model context protocol (MCP)-style connectors.
Stout external compliance is propped up on a foundation of internal compliance. Fundamentally, firms need to be thinking about agentic AI governance in terms of explaining why an agent did something, which data it had access to, how the firm came to program it a certain way, and how the problem was detected.
To become AI audit-ready, firms must develop a compliance framework based on clear agent accountability, observability, and explainability to ensure transparency and reliable performance. If an action can't be traced back to the input, the model version, and the authorization that permitted it, it isn't audit-ready — regardless of how good the output was.
Everything above is to ensure a compliance team can reconstruct and document what an AI agent knew and performed. Every autonomous action must be defensible later, at any point in time. The real differentiator isn't having AI capabilities or being the first to have AI in the front office. It is having already built the guardrails (data scoping, documented authority, audit trails) that regulations will eventually require everyone to prove, and meeting clients’ expectations for firms to demonstrate superior sophistication in deploying AI.
Neil Visnapuu
Neil describes his role as focused on product with a splash of engineering. Neil has spent more than two decades in FinTech building compliance strategies and solutions for the financial services industry.
Sources:
i Fast Company, Sept. 10, 2026. https://www.fastcompany.com/91605381/companies-deploying-ai-agents-have-no-idea-how-to-manage-risk-ai-safety-expert-warns
ii Stanford Business, May 2013. https://www.gsb.stanford.edu/faculty-research/publications/risk-management-breakdown-axa-rosenberg-curious-case-quant-manager
iii Thomson Reuters, Jan. 13, 2026. https://www.thomsonreuters.com/en/institute/articles/ai-risk-management-challenges
iv The Verge, Sept. 19, 2026. https://www.theverge.com/ai-artificial-intelligence/997795/google-gemini-rogue-ai-hack
v Azzutti, A. AI governance after MiFID II: beyond (mere) technological neutrality?. ERA Forum 27, 7–31 (2026). https://link.springer.com/article/10.1007/s12027-026-00871-1
vi MAS, Dec. 2024. https://www.mas.gov.sg/-/media/mas-media-library/publications/monographs-or-information-paper/imd/2024/information-paper-on-ai-risk-management-final.pdf
No spam. Just the latest releases and tips, interesting articles, and exclusive interviews in your inbox every week.
