When AI projects are discussed, the word “regulation” usually comes up in a tone that suggests an obstacle. The AI Act, GDPR, retention duties, sector supervision – tiresome obligations that slow down innovation.
I see it differently, and that has to do with where I come from.
What banking teaches you
In banking, regulation is everyday life. Every calculation must be traceable, every decision documented, every model explainable and verifiable. That costs – time, money, patience. But anyone who has seen what a wrong impairment, a data breach or an unexplainable model can do knows: these rules are not bureaucracy for its own sake. They protect customers, the company and ultimately the people who carry responsibility.
Regulation as a design input
Compliance becomes expensive mainly when it comes afterwards – when a finished system suddenly needs provenance, deletion concepts or human oversight that its architecture never anticipated. Considered from the start, much of it is simply good engineering:
- Traceability: every value has a source, every decision an audit trail.
- Human oversight: where an AI is uncertain or much is at stake, a person decides – and the system records who.
- Data minimisation and purpose limitation: only the data that is needed, with clear deletion and a clear storage location.
- Transparency: anyone working with an AI system should know that, and how, it is involved.
The AI Act follows a risk-based approach: the greater the risk of an application, the higher the requirements for documentation, data quality and oversight. Systems built this way anyway need little retrofitting.
Costs worth paying
Yes, compliance costs. But a loss of trust, a data breach or a system that has to be switched off because nobody can explain what it does costs many times more. Regulation protects reputation and resources – and good architecture makes it affordable.