From Pilot to Production: A Control Framework for AI in Regulated Finance

Briefing note. In regulated finance, an artificial intelligence (AI) pilot reaches production only when it clears five gates: security, third-party risk, model risk, adoption and cost. Each gate needs evidence and a named owner. Build the gates before the pilot starts, and the pilot becomes the first draft of the evidence pack.

Why pilots stall

A pilot proves that a tool can work. Production asks a harder question. Can the institution stand behind it every day, under supervision, with a way out if it fails?

Those are different questions. A pilot designed only for the first one will stall at the second. The fix is to design the production gate first and run the pilot against it.

Five gates and their anchors

Each gate maps to supervisory expectations that already exist. The Office of the Superintendent of Financial Institutions (OSFI) is Canada’s federal prudential regulator. The Digital Operational Resilience Act (DORA) is the European Union (EU) regulation on operational resilience in finance.

Gate 1: security and data

OSFI’s Guideline B-13 expects institutions to identify, classify and protect data according to its confidentiality. It calls for risk-based controls on data at rest, in transit and in use, for least privilege, and for regular attestation of access [1]. An AI service retrieves content at scale, so every weakness in those controls is amplified.

The security gate asks for:

• A permission review of every content source the service can retrieve from.
• Sensitivity labels and data loss prevention policies that cover prompts and outputs.
• Logging and retention of prompts and responses under the records policy.
• Test results for prompt injection, where hostile text inside a document tries to redirect the assistant.
• An access attestation cycle for high-risk sources.

Gate 2: third-party and outsourcing risk

OSFI’s Guideline B-10 has been in effect since May 1, 2024. It is direct: the institution retains accountability for services outsourced to third parties and for data that third parties can access [2]. It expects an assessment of concentration risk, including systemic concentration, management of subcontracting risk, audit rights, and contingency and exit plans with triggers for both stressed and planned exits [2].

AI adds a layer. The foundation model, the large general-purpose model behind the service, may be supplied by a subcontractor of the platform vendor. B-10 treats subcontracting risk as the institution’s to identify, monitor and manage [2].

For institutions with EU operations, DORA has applied since January 17, 2025 [3]. It requires a register of information covering all contractual arrangements for information and communication technology (ICT) services. It sets minimum contractual provisions and requires exit strategies for ICT services that support critical or important functions [3]. In November 2025, the European Supervisory Authorities published their first list of designated critical ICT third-party providers, which brings those providers into the DORA oversight framework [4]. Designation does not move the bank’s own obligations. Under DORA, the financial entity remains fully responsible for compliance [3].

The third-party gate asks for:

• A risk and criticality assessment that includes subcontractors.
• Contract clauses on audit and information rights, incident notification, data location and notice of model changes.
• A concentration view across every AI service that runs on the same provider.
• A tested exit plan: what happens to the process if the service is withdrawn tomorrow.
• A register entry, where DORA applies.

Gate 3: model risk and governance

OSFI’s Guideline E-23 takes effect on May 1, 2027 [5]. Its model definition explicitly includes AI/ML (machine learning) methods. It adopts the definition of an AI system from the Organisation for Economic Co-operation and Development, which covers systems that generate content [5]. Externally developed models are rated for model risk on a standalone basis [5].

In the United States, the picture changed in April 2026. The Federal Reserve, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency replaced SR 11-7 with SR 26-2, a revised Supervision and Regulation letter on model risk [6]. The revised guidance states that generative AI and agentic AI models are not within its scope. It adds that a bank’s own risk management and governance practices should still guide controls for tools the guidance does not cover [6].

For a bank that operates in both countries, the same assistant may sit inside model risk management in Canada and outside the model guidance in the United States. My advice is to govern it once, to the stricter standard, and map the evidence to each regime. Two parallel processes for one tool double the cost and halve the clarity.

The model risk gate asks for:

• An inventory entry with use, owner, foundation model and version.
• A risk rating with a written rationale.
• An independent review, including explainability for the intended use.
• A monitoring plan with thresholds for error rates, drift and fabricated answers.
• A rule that treats a model version change as a review trigger.

Gate 4: adoption

A service that people use carelessly is not in production. It is in exposure. The adoption gate asks for:

• Training completed before a licence is issued.
• An acceptable use policy that names prohibited data and prohibited uses.
• A defined human review step for any output that leaves the team.
• A weekly active use target, and a reclaim rule for idle seats.
• A feedback channel that feeds the monitoring plan.

Gate 5: cost accountability

In AI deployment and transformation work, the habit that matters most is simple. Every production service needs a named owner for its cost, the same way it has a named owner for its risk.

The cost gate asks for:

• Unit cost per weekly active user, and per transaction for metered services.
• Budgets and alerts on consumption-based charges.
• A renewal model that includes changes to base licences. Microsoft 365 suite list price changes took effect on July 1, 2026 [7].
• A business owner who signs the benefit case and reports against it.

Phase the move

Each phase ends with evidence, not with a date.

The evidence pack

One pack, one accountable owner, reviewed by the chief information officer and the chief risk officer together:

1. Use case statement and risk rating.
2. Data access review and sign-off.
3. Third-party assessment, contract clauses and exit plan.
4. Model inventory entry and review report.
5. Test results: accuracy, prompt injection and red-team findings.
6. Adoption plan and training records.
7. Cost model and cost owner.
8. Monitoring plan, thresholds and rollback trigger.

Pilots are cheap. Production is where accountability lives. Build for production on day one.

References

1. Office of the Superintendent of Financial Institutions, “Guideline B-13: Technology and Cyber Risk Management,” July 2022 (effective Jan. 1, 2024).
2. Office of the Superintendent of Financial Institutions, “Guideline B-10: Third-Party Risk Management,” Apr. 2023 (effective May 1, 2024).
3. European Parliament and Council of the European Union, “Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector,” Official Journal of the European Union, L 333, Dec. 27, 2022.
4. European Supervisory Authorities, “European Supervisory Authorities designate critical ICT third-party providers,” press release, Nov. 18, 2025.
5. Office of the Superintendent of Financial Institutions, “Guideline E-23: Model Risk Management (2027),” Sept. 11, 2025.
6. Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, “Revised Guidance on Model Risk Management,” SR Letter 26-2, Apr. 17, 2026.
7. N. Herskowitz, “Advancing Microsoft 365: New capabilities and pricing update,” Microsoft 365 Blog, Dec. 4, 2025.