In data we trust? Emerging policy and supervisory approaches to AI data use in financial services

What it contains

FSI Insights No 73, published on 26 March 2026 by Juan Carlos Crisanto, Adrien Currat, Johannes Ehrentraud and Wenguang Wu, starts from the fact that advanced AI, such as generative AI, depends on vast and diverse amounts of data across all stages of its life cycle, so sound data management is essential for reliable applications and for preserving trust in the financial system. Data problems are not new, but the sector identifies them as significant barriers to scaling generative AI: incompatible and fragmented sources, inconsistent quality and new challenges with synthetic and alternative data, with privacy, quality and security as the most pressing concerns, made worse by third-party dependencies.

The paper reviews data protection and AI frameworks: privacy principles (lawful basis, meaningful consent, purpose limitation, minimisation and retention limitation) are hard to uphold in AI systems that use large volumes of personal data; data quality (accuracy, completeness and representativeness) is central, although the statistical “accuracy” of AI and the accuracy required by data protection are understood differently; and data security is key to operational resilience. Data governance is the backbone, with accountability as the guiding principle. Financial authorities rely on general data protection frameworks and on non-prescriptive guidance on data management, model risk and operational resilience (including the BCBS 239 principles), with thematic reviews and information papers, and early signs of convergence are emerging.

Tensions persist between technological capabilities and data protection requirements, and frameworks designed for traditional uses may not capture the complexity of generative AI ecosystems; third-party dependencies complicate oversight because of limited data visibility across the AI supply chain and provider concentration. The FSI suggests that authorities could issue tailored guidance on data governance, quality, security and third-party dependencies (for example, data lineage and monitoring of providers), foster good practices through thematic reviews and strengthen collaboration with data protection authorities and industry.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 12 October 2026. It does not replace reading the official text and is not advice.

See all publications