What should be regulated?

By Rogério Melfi, IA4FIN ambassador.

There is a natural tendency when facing a technology capable of transforming entire markets: create specific regulation for it. Artificial intelligence has been no different. We discuss an AI law, competent authorities, high-risk systems, transparency, explainability and responsibilities.

But faced with this, I ask myself: do we need to regulate artificial intelligence as a new category, or understand the risks it introduces into an activity that is already intensely regulated?

The difference matters because highly regulated environments, such as the financial system, already operate within an extensive risk management architecture. Institutions must identify, assess, monitor and mitigate credit, market, liquidity, operational, cybersecurity, fraud, third-party and many other risks inherent to financial activity.

A model used in credit granting can affect credit risk and the consumer relationship. A data quality failure can compromise decisions and generate legal or reputational risk. A generative system used in customer service can give incorrect guidance and turn a model failure into a problem for the institution. Likewise, excessive dependence on a particular supplier can increase third-party risk.

This suggests there may not be a single “AI risk.” There are familiar risks manifesting themselves in new ways and at a different scale.

In its November 2025 Financial Stability Report, the Central Bank presented a survey on artificial intelligence use in Brazil’s National Financial System. Among the 162 responding institutions, 71.6% reported using technology solutions or services with AI models developed by third-party service providers. Use cases already included customer service, document analysis, fraud prevention, transaction monitoring, KYC, security and credit risk assessment.

At the same time, only 42.6% of institutions reported having complementary processes, practices or procedures specifically intended to manage risks associated with solutions using artificial intelligence. This reveals a significant gap between the speed of technology adoption and governance maturity.

Although there is still no approved national regulation or specific sectoral rule on artificial intelligence, the Central Bank is already monitoring its use by institutions.

This approach seems appropriate for a technology evolving faster than the regulatory process. The path involves monitoring use cases, identifying risks and assessing which are already covered by existing structures and which require new obligations.

One of the most relevant issues is third-party contracting. If many institutions use the same AI solutions and a particular provider encounters a significant problem, several institutions may be affected simultaneously. What initially looks like a technology decision becomes a matter of concentration and, potentially, financial stability.

For an individual institution, hiring a major AI provider may make sense. It is faster and cheaper than developing certain capabilities internally. The problem arises when dozens of institutions reach the same conclusion and become dependent on the same models, suppliers or infrastructures.

In this scenario, a failure no longer affects only the institution that contracted a particular solution. A shared vulnerability, an outage or unexpected behavior from a widely used model can affect different participants simultaneously. Artificial intelligence then becomes part of a discussion the financial market knows well: risk concentration.

This also helps show why treating every use of AI the same way would be a mistake. A tool used internally to summarize documents does not pose the same risk as a model participating in credit decisions. A customer service chatbot should not necessarily receive the same treatment as an agent authorized to execute financial operations. What matters is the use, the degree of autonomy, the people affected and the consequences of a possible failure.

Certain uses will certainly require specific obligations concerning security, documentation, transparency, monitoring or human review. Automated decisions capable of significantly affecting consumers also deserve treatment proportionate to their impact.

The greater the system’s autonomy and the greater the consequences of a decision or failure, the greater the institution’s ability should be to demonstrate how that system is governed.

This shifts part of the discussion from algorithms to responsibility. Does the institution know which models it uses and for what purposes? Does it know the data involved? Does it monitor performance? Can it identify failures? Does it have contingency procedures? Does it know which risks it transferred to third parties and which remain its responsibility?

The financial market has an advantage in this debate because it is not starting from scratch. Banks, fintechs, cooperatives and payment institutions already live with internal controls, auditing, risk management and supervision. The challenge is incorporating artificial intelligence’s particularities into this structure and creating new requirements where risks truly justify them.

This analysis, however, is not unanimous. The European Union followed this path with the AI Act precisely because it considered that data subject rights, explainability and nondiscrimination require a common floor regardless of sector, and that letting every sectoral regulator reinvent these requirements creates fragmentation and unequal treatment between, for example, a bank customer and a health plan customer assessed by equally opaque models.

Congress continues trying to complete the missing piece: Bill 2338/2023, the AI Legal Framework, approved by the Senate back in 2024 and stalled in the Chamber of Deputies since then. Proceedings are expected to advance in the coming months. When that happens, the challenge will be fitting this new layer into an existing risk management structure.

Therefore, technology may be manual, electronic, digital, internal or supplied by third parties. Responsibility for its effects remains with the regulated institution.

📌 Originally published in IA4FIN