Generative AI
GenAIAlso called genAI, gen AI
Generative AI is artificial intelligence that creates new content, such as text, images, audio or code, in response to a prompt. Most systems are built on large language models trained on very large datasets. Compliance teams use it to summarise regulation, draft reports and review documents, under data protection, model risk and AI rules.
How it works
In a compliance function, generative AI drafts suspicious activity narratives, summarises new rules, answers policy questions and extracts data from contracts. Firms usually connect a model to approved internal documents and keep a person reviewing outputs. Controls cover prompt and output logging, access limits, testing for hallucinations and checks that confidential or personal data is not sent outside approved systems.
The rules are spreading. Under the EU AI Act, providers of general-purpose AI models have had documentation and copyright duties since 2 August 2025. Since 2 August 2026, Article 50 requires disclosure when people interact with a chatbot. Machine-readable marking of generated content applies too, with systems already on the market given until 2 December 2026. US bank model risk guidance issued in April 2026 excludes generative AI, and the agencies plan a separate request for information.
The rules
Requires technical documentation, information for downstream providers, a copyright policy and a training-data summary, with extra duties for systemic-risk models.
Providers of general-purpose AI models placed on the EU marketRequires people to be told when they interact with AI. Generated content must be machine-readably marked; systems already on the market have until 2 December 2026.
Providers and deployers of chatbots and generative AI systemsGives individuals the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to safeguards including human intervention.
Controllers processing personal data of people in the EUReplaces SR 11-7 with principles-based model risk guidance; generative and agentic AI models are outside its scope.
US banking organisations, most relevant above $30 billion in total assetsCommon questions
How do compliance teams use generative AI?
Common uses include summarising regulatory updates, drafting policies and suspicious activity narratives, answering staff questions against internal policy, and extracting obligations or data from long documents. Outputs are usually reviewed by a person before use.
Does the EU AI Act regulate generative AI?
Yes. Providers of general-purpose AI models must publish training-data summaries and keep technical documentation. Article 50 requires chatbots to disclose that users are talking to AI and requires generated content to be marked as artificial.
What is a hallucination in generative AI?
A hallucination is a confident output that is false or not supported by the source material, such as an invented regulation or citation. Firms test for it and require source references and human review for compliance work.
Is generative AI covered by US model risk guidance?
No. The revised interagency model risk guidance issued on 17 April 2026 excludes generative and agentic AI models from its scope. The agencies said they plan a request for information on AI use, including these models.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech Post7 Essential ChatGPT Prompts for Busy Compliance OfficersRead the article →RegTech PostLLM Sanctions Screening Accuracy Put to the Test by Castellum.AIRead the article →
