AI Governance Institute
← News
Research2026-10-08

Deloitte Finance Webcast Frames ISO 42001 and EU AI Act as Audit Evidence Anchors

What happened

Deloitte published AI compliance and governance frameworks for finance leaders, a practitioner-focused webcast directed at finance and risk executives. The session covers how organizations should structure oversight programs, assign governance accountability, and build the evidence trail auditors will expect. Deloitte explicitly cites three primary reference frameworks: ISO/IEC 42001:2023 - Artificial Intelligence Management System, the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook, and the EU AI Act (Regulation (EU) 2024/1689). The webcast follows a period of growing scrutiny on finance-sector AI governance. Relevant publications include those from BIS, interagency model risk management guidance, and the Financial Stability Board. All signal that point-in-time compliance will not satisfy regulators.

Why it matters

  • ·Regulators examining financial institutions are increasingly asking for documented governance programs, not just policy statements. Deloitte's framing of ISO/IEC 42001:2023 - Artificial Intelligence Management System as an audit-evidence anchor means finance teams without a certified or equivalent management system now carry heightened examination risk.
  • ·The webcast explicitly addresses agentic processes, signaling that governance programs limited to traditional model risk management will be considered incomplete. Finance organizations deploying AI agents need documented control boundaries and human oversight rationales, not just model inventories.
  • ·The EU AI Act (Regulation (EU) 2024/1689) obligations cited by Deloitte apply to any financial institution serving EU markets, regardless of where the institution is headquartered. US-based finance teams that have not yet mapped EU requirements to their existing controls face a cross-border compliance gap that Deloitte's framing makes harder to ignore.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

BRD-009Unified Multi-Framework AI Risk RegisterALC-005Regulatory Audit ReadinessHOC-001AI System Risk ClassificationMGV-002AI System Intake and Approval WorkflowCMP-007EU AI Act Conformity Assessment and FRIA Process

What to do now

  • ☐Ask your AI governance lead whether your current program can produce documented evidence of control design, testing, and review cadence, not just a policy document, if an examiner asked today.
  • ☐Confirm whether your AI inventory distinguishes between traditional models and agentic processes, and whether each category has separately documented oversight controls and human approval requirements.
  • ☐Map your existing model risk management program against ISO 42001 clause requirements and identify which clauses lack documented procedures or audit evidence.
  • ☐Identify every AI system your finance function uses that falls within EU AI Act scope, including vendor-hosted tools, and confirm whether conformity documentation exists for each.
  • ☐Schedule a cross-functional review with legal, risk, and internal audit to agree on what constitutes sufficient audit evidence for AI governance, before an external auditor or regulator defines it for you.

What to watch next

Finance regulators in the US and EU are moving toward expecting AI governance programs to meet model risk management evidence standards. This includes documented testing, version control, and board-level escalation. The interagency model risk guidance updated in 2026 will sharpen examiner expectations. Ongoing EU AI Act (Regulation (EU) 2024/1689) enforcement activity, including EU AI Office inspections targeting credit and financial services AI, will do the same. Teams should monitor whether ISO 42001 certification becomes an explicit examiner expectation in banking supervisory letters or examination handbooks over the next 12 months.

Related Coverage

Research2026-10-21

NHIMG's AI Governance Guide Turns Four Frameworks Into One Operating Model

The National Health Information Management Group published the AI Governance Guide: Policies, Inventories and Oversight on October 16, 2026. The guide translates the NIST AI RMF, ISO/IEC 42001, the EU AI Act, and US federal guidance into a single operating model covering registration, risk tiering, oversight, monitoring, and decommissioning. Recommended controls include a named-owner AI register, discovery across procurement and SaaS environments, impact assessments, escalation paths, quarterly committee reviews, and internal audit.

Research2026-10-24

FCA Finds UK Firms Deployed AI Before Governance Was in Place

The UK Financial Conduct Authority published findings in October 2026 showing that regulated firms routinely deployed AI systems before establishing accountability, risk management, or oversight structures. Deloitte's analysis of those findings identifies five control gaps that supervisors will now use as a benchmark. FCA-regulated firms face direct supervisory exposure if they cannot demonstrate these controls exist.

Research2026-10-18

BCS ISO 42001 Certification Shows What Auditable Agentic AI Governance Looks Like

BCS, the UK's chartered institute for IT professionals, received ISO/IEC 42001 certification. An independent BSI audit assessed its AI management system across policy, accountability, risk assessment, testing, and human oversight. The certification covered agentic AI governance specifically. The experience provides a concrete implementation reference for organizations pursuing the same standard.