Adoption has outrun control
Boards talk about AI governance. Far fewer fund it, inventory it or understand it. Each line below runs from what firms say to what they have actually done.
The governance gap
The deadline countdown
Each ring fills as the date approaches, on a three-year scale. Counted from your device's clock.
Seven years from principles to machinery
Tap a dot · tap a lane name to hide itThe eight dimensions a supervisor will test
Tap a dimension to see the red flag that gives a firm away.
Two passports, one flywheel
Every person carries a literacy passport. Every AI system and agent carries an identity passport. Each turn of the lifecycle adds evidence and makes the next turn cheaper. Tap a stage, or turn the wheel.
Identify
5 layers. 5 human checks. Zero blind spots.
The FCA will not write new AI rules. The Consumer Duty, SM&CR, SYSC and operational resilience already apply to every model you run. Flip the switch to see each layer with and without a named human.
What UK finance told its regulators
Bank of England and FCA survey, published 21 November 2024. Share of responding firms, or of AI use cases where marked.
Third-party AI doubled
Share of AI use cases implemented by third parties.
The top three providers supply 73% of named cloud and 44% of named model services to UK finance.
Six jurisdictions, one question
Who owns it, how do you know it works, and what do you do when it fails?
The convergence map
Hover or tap a row to trace it across bordersForms differ, substance converges. Colour shows how each expectation is set: in statute or binding rules, in supervisory guidance, or in a voluntary framework.
The more capable the machine, the more governance matters
An honest balance sheet for a regulated firm in 2026, then a stress test across three horizons of autonomy. Dates beyond today are forecasts, and experts disagree on them.
SStrengths
- SM&CR, model risk and Consumer Duty to build on
- Mature compliance and audit culture
- Deep data assets
- Recent experience of DORA and operational resilience
WWeaknesses
- Incomplete inventories and shadow AI
- Partial understanding of third-party models
- Uneven AI literacy at board level
- Validation that does not scale to agents
OOpportunities
- Sandboxes in London, Singapore and Hong Kong
- AI-driven fraud defence
- Faster, cheaper compliance
- Governance as a trust signal
- ISO/IEC 42001 certification
TThreats
- Deepfakes and AI-enabled fraud
- Concentration in a few providers
- Fragmented rules across borders
- Enforcement under existing law
- One agent failure going public
Slide through the horizons of autonomy
Controls light up as autonomy growsAgentic AI
Score your firm, then start on Monday
Rate each dimension from 1 (ad hoc) to 5 (optimised). The radar redraws as you go and names the gap to close first.
The 365-day plan
Tap a phaseThe seven-step readiness roadmap
The top ten AI vulnerabilities
Aligned with the OWASP Top 10 for LLM Applications 2025. Tap a card to flip it for the control and the owner.
Price the cost of waiting
Enter your group's worldwide annual turnover. For most undertakings the EU AI Act ceiling is the higher of the fixed sum and the percentage; for SMEs and start-ups it is the lower. In the UK, enforcement runs through the Consumer Duty, the Principles and SM&CR.
Ceilings only. Actual fines depend on the breach, its gravity and cooperation. Not legal advice.
Fines
AI Act ceilings, with GDPR and DORA on top.
Personal accountability
Senior managers must show reasonable steps.
Incidents
78% of firms have already had one.
Trust
One public failure can undo decades.
Market access
Clients now ask for governance evidence.
Earn your passport class
Ten questions drawn from the seven chapters. Each correct answer adds 10 XP. Your class follows the AI ID Passport flight tiers.
Seven chapters, one field guide
Each chapter opens with a story, works through the regulation and the data, and closes with a case study, a toolkit, five board questions and a quiz.
AI Governance
& Compliance
Dutira · AI compliance, built in
A governed AI workspace for regulated businesses. Staff use approved models; compliance teams run policies, training, attestations, approvals and monitoring in one place. The audit trail records which policy applied, which model answered, what was masked and who approved it.
Kah Tan is Dutira's Founder and Chief Product Officer; Dinis Guarda is Co-founder and Chief AI Officer. Dutira is not affiliated with or endorsed by the FCA, and use of a platform does not guarantee compliance.
A blockchain-verified, gamified AI literacy certification from Businessabc Academy and ztudium group. A ten-domain AI Readiness Wheel, five flight-class tiers from Economy to First Class and a 40/30/20/10 assessment model give firms role-based evidence for EU AI Act Article 4 and SM&CR.
Five plates by Dinis Guarda and Kah Tan
Go to the source
United Kingdom
European Union
Hong Kong and UAE
Standards and learning
- ISO/IEC 42001
- OECD.AI Policy Observatory
- Oxford AI Ethics, Regulation and Compliance Programme · five weeks online · cohorts from 4 November 2026 and 3 February 2027