AI Infrastructure Isn't IT
It's Risk Containment and Auditability.
The most common AI risk event does not begin with malicious intent. It begins with convenience: someone pastes client information into a consumer AI tool to polish a letter. Someone uses a personal account to try a summarisation tool. Someone uses an unapproved service because the approved one is slower.
Each instance feels like a minor workaround. In a regulated firm operating in a trust-based jurisdiction, each one creates an unmanaged third-party processing route, an evidence gap, and a governance precedent that spreads.
The Infrastructure Question Leaders Are Getting Wrong
Most AI infrastructure conversations in financial services get framed as IT questions: which platform, which vendor, which endpoint configuration. The correct framing is different. AI infrastructure exists to deliver four governance outcomes:
- Visibility — Can you see which AI services are being used, by whom, from what device, against what data?
- Enforcement — Can you technically restrict non-approved AI routes, not just policy-restrict them?
- Data protection — Can you demonstrate, with evidence, what data left your controlled environment and when?
- Auditability — Can you produce an evidence pack—exceptions, incidents, oversight cadence—on demand?
PwC's 2025 Channel Islands research found that regulatory and data protection concerns are the primary blockers to outsourcing in technology, operations, compliance, and risk. Uncontrolled AI usage recreates exactly that risk profile—without the contracts, due diligence, or oversight that formal outsourcing would require.
A Vignette Worth Sitting With
Consider a scenario occurring, in some variation, across financial services firms in every jurisdiction. A relationship manager, under time pressure, pastes a client's investment summary into a consumer AI tool to polish a quarterly update letter. The output is good. They do it again. A colleague notices and asks how. Within a month, the behaviour is normalised across the team.
No one intended harm. No one acted in bad faith. But the firm has created: an unmanaged third-party data processing arrangement with no contract; an evidence gap with no demonstrable record of what was processed; a regulatory exposure under Jersey's data protection framework; and a precedent that is actively spreading.
In a jurisdiction where reputation is a primary competitive asset—and where the JFSC is actively developing AI guidance—this is the kind of incident that triggers regulatory scrutiny not because of outcome, but because of the absence of controls.
Treat AI as a Governed Enterprise Service
Gartner's CIO research is consistent: value in the AI era will come from orchestrating AI as a governed enterprise service, not from managing a collection of isolated tools. A governed enterprise AI service has characteristics that individually approved tools do not:
- Approved routes with technical enforcement, not just policy guidance
- Managed endpoints where access is conditional on compliance posture
- Cloud application governance that discovers shadow usage in real-time
- Data loss prevention aligned to your data classification framework
- Monitoring with a named reviewer acting on signals on a defined cadence
A Practical 90-Day Control Plane Roadmap
Days 0–30: Establish the boundary
Define the approved baseline and explicitly prohibited routes. Stand up usage visibility—understand what is being used today before you can govern it. Implement restrictions for the highest-risk unmanaged routes immediately. Create an exception register with named owners and enforced expiry dates.
Days 31–60: Enforce and protect
Enforce managed endpoint posture and conditional access controls. Implement data classification rules aligned to your risk appetite. Activate monitoring dashboards with a named reviewer and weekly review cadence. Publish the minimum boundary policy in plain, repeatable language.
Days 61–90: Tune and prove
Tune controls to reduce false positives that drive workarounds. Run a pilot with business owners and generate the first quarterly evidence pack. Finalise BAU runbooks and handover to the operating team. Produce your first artefact set: exception register, bypass attempt log, incident log.
Contracting and Commercial Control
Gartner's 2026 research flags a contracting problem that very few financial services executives have yet confronted: traditional effort-based pricing allows vendors to capture AI-enabled efficiency gains while the enterprise continues paying as if the work were still done manually. As AI adoption scales, regulated firms should be pushing for:
- Outcome-linked or hybrid commercial models rather than effort-based pricing
- Explicit data-use clauses covering training data, retention, and secondary use
- Portability and exit rights to prevent strategic vendor lock-in
- Consumption cost controls where token-based or usage-based pricing applies
- Shared accountability for monitoring, incident response, and controls effectiveness
The RACI That Prevents Multi-Party Confusion
| Role | AI Responsibility |
|---|---|
| Business owner | Workflow redesign, KPI outcomes, day-to-day exception handling |
| IT / security | Control plane configuration, enforcement, and monitoring |
| Compliance / risk | Oversight requirements, evidence standards, exception quality review |
| Vendor / partner | Agreed scope under change control, data obligations met |
| Audit / assurance | Independent effectiveness testing and board reporting |
Common Failure Modes to Watch For
- 'We blocked the website'—but staff switch to personal devices outside the managed boundary
- 'We turned on DLP'—but false positives are so frequent that staff route around them routinely
- 'We have monitoring'—but no one reviews it on a defined cadence
- 'We did a pilot'—but BAU runbooks and training were never completed before wider rollout
The Jersey Regulatory Context
The Jersey AI Playbook names data foundations and governance frameworks as 2026 priorities across public and private sectors. The JFSC is developing AI guidance for the financial services industry. The JOIC has placed AI governance at the centre of its three-year strategic plan, with a clear message: responsible AI and robust data protection must evolve together and cannot be decoupled.
The firms that build technical infrastructure now—before prescriptive guidance is finalised—will be better positioned to demonstrate compliance and scale faster when the regulatory framework clarifies.
Closing question: If you approved AI use across your firm tomorrow, could you enforce the boundary technically—or would you be relying entirely on policy and trust?
Next in the series — Part 3: Data readiness is the hidden cost that determines whether your AI programme delivers value or amplifies risk. Most firms have not budgeted for it.
Sources: PwC Channel Islands Wealth Management Insights 2025; Jersey AI Playbook, March 2026; Gartner CIO Value and AI governance research 2025–2026.
Professional disclaimer: The views expressed are my own and are shared for general informational purposes. This content is intentionally non-confidential and does not include proprietary, client-specific, or employer-sensitive information. It is not legal, regulatory, investment, or professional advice; readers should seek appropriate advice for their circumstances.
Financial services leader (20+ years) | Lean Six Sigma Green Belt | London School of Economics (LSE) AI Leadership Accelerator
See where your firm stands
The free diagnostic scores your firm across the twelve operating-model instruments in about eight minutes.
Take the diagnostic →A version of this article was first published on LinkedIn as part of the Sequence body of work. This is the canonical version.
The views expressed are the author's own and shared for general information. This content is intentionally non-confidential and does not include proprietary, client-specific or employer-sensitive information. It is not legal, regulatory, investment or professional advice. © 2026 Paul Soares. Sequence is the trading name of Sequence Advisory Limited (in formation) · hello@sequenceadvisory.com