Artificial Intelligence Regulation in Financial Services: Mapping Principles, Priorities, and Compliance Requirements

The growing demand for automation within the financial sector creates an ideal environment for utilizing artificial intelligence. However, stringent and intricate regulatory mandates alongside rapid technical progress present substantial hurdles for the creation and deployment of AI-driven financial services. To foster comprehension, safeguard consumers, and maintain service quality in this sector, the regulatory guidelines established by European authorities must be organized into highly detailed components. This categorization will offer deeper insights into regulatory priorities and provide a structured approach to engineering AI-driven solutions. This study introduces a classification framework based on a taxonomy designed to demystify current European regulatory tenets for academics, supervisory bodies, and financial enterprises. By highlighting the core thematic focal points of these regulations, our research aims to facilitate the engineering of compliant AI services.

The integration of AI into financial services has captured the attention of financial institutions seeking to optimize costs and enhance service quality [1]. This integration introduces distinct advantages as well as potential hazards for all stakeholders interacting with AI-powered services [2]. Additionally, the expansion of data volumes and computational capacities has established the groundwork needed to support advanced automation through AI. However, AI-enabled products and services can generate both financial and non-financial risks, prompting concerns regarding investor and consumer protection [3]. Consequently, regulatory bodies intervene within the financial market to safeguard market security, protect consumers, and maintain market integrity against unfair discrimination generated by automated systems [2, 4]. To maintain relevance and achieve broader public trust, these regulatory tenets are progressively updated and adapted in response to shifts in market structures and technological advancements, thereby ensuring safety alongside the necessary systemic flexibility.

Nevertheless, given the fundamental nature of these AI-driven systems, developing, implementing, and maintaining them remains a complex endeavor that demands intensive coordination with regulatory authorities [1]. Any structural or conceptual alterations made to these systems are typically non-standard, intricate, and capital-intensive [1, 5, 6]. This heightened complexity, paired with swift technological breakthroughs in AI, underscores the need for a comprehensive grasp of regulatory principles to satisfy legal duties and execute secondary strategic measures [1].

Furthermore, AI-powered applications cannot guarantee accurate outputs indefinitely; instead, they demand continuous oversight, adjustments, and repetitive periodic testing and validation. For instance, because of financial and cross-sectoral variances, using datasets gathered prior to the COVID-19 pandemic may no longer be appropriate during or after the pandemic [7]. Specifically, the financial health of an enterprise in the healthcare sector versus one in the travel sector diverged drastically from their pre-pandemic baselines. Regulatory and supervisory institutions anticipate these dynamic shifts, making it mandatory for financial firms to establish contingency plans and robust monitoring frameworks for their AI-driven systems [7-9]. Given that the regulatory landscape remains underdeveloped, identifying, assessing, and organizing core regulatory components and priorities is crucial for integrating these concepts into academic research and corporate operations. Additionally, the intricate nature of AI applications obliges financial firms to navigate a multitude of regulatory expectations spanning technological, organizational, and communicational pillars to guarantee the resilience, security, quality, compliance, and core functionality of their AI services.

The ambiguities of an evolving regulatory environment heighten the complexity of building compliant AI systems for industry professionals. Thus, the AI development lifecycle, which encompasses several distinct phases outlined by oversight bodies, must be managed systematically to formulate actionable and compliant strategies [8, 9]. Similarly, pinpointing the primary regulatory dimensions and priorities from existing guidelines is essential for researchers and financial corporations to design appropriate safeguards. Without a transparent definition of regulatory expectations, executing targeted research and engineering compliant AI applications becomes a significant challenge. Consequently, establishing a holistic regulatory overview of the financial sector can illuminate research gaps, which may subsequently aid in consolidating future policies. Motivated by the necessity of structuring regulatory guidelines to foster efficient and close collaboration between industry practitioners and supervisory agencies, we formulate the following research question:

RQ: How can European regulatory principles be classified into useful dimensions and characteristics for the development of AI applications in financial services?

In the subsequent sections, we first outline the theoretical foundation of the European regulatory landscape regarding AI-driven services. Next, we outline and adapt the methodological framework for taxonomy design established by Nickerson et al. (2013) before detailing our precise research workflow. We then delineate the development stages that culminated in the finalized taxonomy. Following this, we analyze our findings, address the limitations of the study, and provide a conclusion alongside directions for future research.

Because of the globalized nature of modern finance, incorporating the viewpoint of the Organization for Economic Co-operation and Development (OECD) is vital, as they have introduced AI guidelines intended to foster innovative and reliable AI deployment. Through these initiatives, regulatory bodies cooperate to set up and supervise cross-industry AI practices at international, European, and state levels. Furthermore, oversight agencies advocate for the creation of practical and flexible AI benchmarks capable of enduring over time [5, 10]. In light of accelerating technological shifts and the growing incentive to leverage smart, automated, and more efficient architectures in finance, European regulators view the creation of a foundational and progressive legal structure for AI adoption as a matter of priority [6]. To this end, the European Commission communicated its intent to deploy a standardized regulatory framework by 2024 as part of its Digital Finance Strategy [11].

This pioneering legal framework for AI is engineered to deliver explicit mandates and duties to developers, operators, and end-users regarding targeted applications of AI [11]. Recognizing the rising complexity and the potential opacity of AI algorithms, the European Commission identified the mitigation of AI-specific risks as an essential prerequisite. Consequently, they introduced a risk-based model categorizing AI applications into four distinct risk tiers: unacceptable, high, limited, and minimal or no risk [11]. In alignment with this strategy, the European Commission introduced the Proposal for an Artificial Intelligence Act in 2021 [12]. However, a granular examination of current regulatory principles reveals that the framework is still anchored to initial drafts, specifically the 2019 Ethics Guidelines for Trustworthy AI generated by the High-Level Expert Group on AI (AI HLEG) [13]. As a result, Europe’s ambition to anchor a forward-looking legal foundation remains a work in progress, leaving developers and financial corporations without a sufficiently structured system of explicit requirements.

A core ambition of regulatory institutions is to keep the sector secure, inventive, and progressive. For pioneering AI-based services, these foundational concepts and concerns were initially addressed by the OECD in 2019 [14]. Nevertheless, the challenges stemming from a lack of official regulatory frameworks and contradictions with standing policies have remained a subject of ongoing debate. This protracted deliberation over finalizing compliance standards has injected uncertainty into how AI-driven services should be designed and operationalized in the marketplace. Despite this, accelerated technological progress continues to drive financial firms to maximize the efficiency and standard of their financial products and services [1, 7]. Moreover, escalating risks must be balanced with legal mandates to encourage responsible AI design and deployment while ensuring consumer safety in real-world applications [15]. Contemporary academic literature indicates a consensus regarding the core objectives of AI governance across various industries, which can be consolidated into four pillars: fairness, sustainability, accuracy, and explainability [15-20].

Even so, financial firms must meticulously weigh the operational and financial investments required to provide these services [21]. Because the regulatory foundation is still maturing, approval and coordination processes between financial institutions and regulators can be lengthy. Consequently, a comprehensive cost-benefit analysis comparing AI system maintenance against realized operational upgrades is vital for firms to determine if the return on investment is sufficient [5, 22].

The design of a taxonomy intended to organize the regulatory tenets established by financial supervisory authorities for AI-driven applications utilizes the taxonomy development framework structured by Nickerson et al. [23]. This methodological approach offers a systematic pipeline to guide the categorization workflow. Mechanistically, a taxonomy (T) is composed of a collection of dimensions (D), where each dimension encompasses a set of mutually exclusive and collectively exhaustive characteristics (C), mathematically formalized in the following expression [23]:

The primary objective of this taxonomy is to arrange European regulatory principles to emphasize core regulatory themes and priorities, mapping out prevailing industry interests and concerns to guide future academic exploration. Furthermore, unique country-specific mandates across Europe must be integrated to formulate an exhaustive, overarching perspective. The specific objects of classification comprise both pan-European and nation-specific regulatory guidelines targeting AI-enabled mechanisms within financial services.

The baseline step requires defining the meta-characteristic of the taxonomy, which functions as the foundational criterion for selecting individual attributes. Consequently, the chosen characteristics emerge as a direct logical extension of this meta-characteristic, explicitly mirroring the ultimate utility of the taxonomy [23]. Operating under this framework, the meta-characteristic of this taxonomy is established as the core regulatory themes and priorities within financial oversight frameworks governing AI-based services.

As delineated by the development process, researchers can utilize either empirical-to-conceptual (inductive) or conceptual-to-empirical (deductive) cycles to iteratively mature the taxonomy. The conceptual-to-empirical trajectory (Step 4c) is deployed to conceptualize new dimensions and structural characteristics of the objects, whereas the empirical-to-conceptual trajectory (Step 4e) is used to identify a new subset of objects within the taxonomic architecture (Figure 1).

The execution of this methodology can be conceptualized as an ongoing search optimization process to locate a highly functional taxonomy [24]. To evaluate taxonomic utility, Nickerson et al. [23] establish objective and subjective ending conditions (Step 2) as crucial parameters to gauge performance (Table 1). This study adopts a specific subset of objective ending conditions focused on structural accuracy and process integrity, while utilizing subjective metrics to confirm that the final taxonomy remains practical and conceptually meaningful [23, 25].

The investigation initiates by cataloging the identified European regulatory bodies and executing a structured literature analysis. Following this mapping phase, specific iterative paths are selected for each consecutive design loop (Step 3). Because pan-European oversight bodies are currently spearheading the formalization of AI governance, an empirical-to-conceptual methodology is chosen for the baseline iteration to extract the elemental pillars of the taxonomy from core European regulatory manuals.

Subsequently, the taxonomy is expanded to incorporate nation-specific regulatory directives through a secondary empirical-to-conceptual loop (second iteration), which integrates localized reports and operational use cases. Finally, to re-evaluate and consolidate the classification matrix, a conceptual-to-empirical cycle is enacted to finalize the regulatory taxonomy (third iteration).

Review of european regulatory authorities and the literature

The initial phase involved identifying active European supervisory bodies across the financial ecosystem and evaluating their published regulatory guidance regarding AI deployment (Table 2). Due to the cyclical nature of this evaluation process, publications spanning several years were thoroughly cross-examined alongside their legislative contexts.

To ensure the framework is representative and broadly applicable, the analysis incorporates the prominent financial jurisdictions in Europe ranked by gross domestic product (GDP) to cross-verify and adjust the classification layout [26]. The investigation revealed that these specific nations primarily publish exemplary AI operational strategies for corporate adoption rather than instituting unique national legislative frameworks. Consequently, the list of independent country-level directives was not extended, as these jurisdictions systematically align with the overarching regulatory baseline dictated by the European Commission.

* It contains the overarching principles and perspectives in Europe. No specific regulatory principles are solely dedicated to the usage of AI in financial services.

Simultaneously, a structured literature synthesis was executed matching the methodological instructions of Cooper [48] and vom Brocke et al. [49] to embed current scientific insights. This query was run across prominent academic repositories, including the ACM Digital Library, AIS Electronic Library, Ebscohost, EmeraldInsight, Jstor, ScienceDirect, and SpringerLink. The core search matrix linked the following conceptual elements: “Regulatory principles”, “Financial Services”, “Artificial Intelligence”, and “Machine Learning”.

Filtering through titles and abstracts yielded 374 initial items, from which 38 distinct publications were identified as directly dealing with AI governance architectures in finance. Supplementing this selection with backward and forward citation chaining produced 16 additional academic sources, resulting in a finalized corpus of papers evaluating compliance models for AI-driven financial services.

First iteration E2C

Reflecting their foundational precedence, the first iteration executes an empirical-to-conceptual (E2C) approach utilizing the baseline European regulatory guidelines cataloged in Table 2 [27]. Deconstructing these texts serves to clarify the fundamental intentions of supervisory organizations focused on preserving market safety, consumer protection, and market systemic integrity (Step 4e).

First, the regulatory parameters are organized by their core objectives, yielding a conceptual model of European oversight priorities. However, these targets scale dynamically with specific institutional use cases, requiring enterprises to apply individualized, case-by-case strategies tailored to specific operational contexts. This fluidity generates diverse mandates whose compliance thresholds must be systematically verified. Because these underlying aims map the immediate priorities and pain points of regulators, "goals" is introduced as the foundational dimension of the taxonomy [12].

Consistent with the industry consensus on primary objectives, the following distinct characteristics were extracted from the regulatory source materials and integrated into the taxonomy: “explainability and accountability”, “fairness, privacy, and human rights”, and “accuracy” [15, 17, 18]. Furthermore, entire functional operations (spanning both front- and back-office pipelines) interacting with these automated architectures must implement robust controls to verify "sustainability and robustness" (Step 5e) [9, 12, 28].

Second, the analysis indicates that regulatory directives dictate a specific operational "approach" across all steps of the organizational value chain. The guidelines explicitly address technical and structural complexity, as a lack of transparent human oversight and specialized management can impede the deployment of novel AI platforms [27]. Consequently, the "approach" dimension is characterized based on sequential product development milestones, mapping across "design", "development", "training", "testing", and "validation" up to the official "deployment" phase of the target application [12]. Additionally, "cooperation with authorities" is established as a critical structural component of any proposed service architecture, leading to its inclusion as the seventh distinct characteristic under the "approach" dimension to address specific regulatory reporting mandates (Step 5e) [29].

Risk-insulated operations and systemic oversight are consistently prioritized within the manuals, justifying the inclusion of “risk management” as the third taxonomic dimension [12, 27]. Based on the European Commission's frameworks, financial entities are required to “estimate and evaluate the risks” linked to normal operations alongside conditions of reasonably foreseeable system misuse. Furthermore, the source principles emphasize “human oversight” as a mandatory mechanism to mitigate risks stemming from autonomous algorithmic determinations [29]. This design choice ensures that a natural person maintains structural supervision over the core functions of the AI system.

As an adjacent characteristic, the taxonomy captures the regulatory demand for explicit “control measures” to govern risks that cannot be architecturally eliminated. These "control measures," paired with "human oversight," act as critical components to counter potential adversarial attacks or systemic failures, protecting ongoing corporate operations via predefined failure protocols.

Additionally, the analysis isolated guidelines governing “conformity assessment” to mitigate threats to fundamental rights and guarantee that specialized oversight bodies maintain adequate operational resources. Finally, actionable “mitigation measures” [12] and continuous “maintenance” protocols [9] must be fully mapped out to suppress risks prior to commercial market entry (Step 5e).

The fourth extracted dimension centers on the “monitoring” of these automated systems, encompassing both organizational processes and technical controls within the source documentation. Here, “(technical) documentation” serves a vital role in unpacking the regulatory and computational engineering dimensions of AI applications. Comprehensive documentation is mandatory for supervisory agencies to evaluate system compliance and trace the data paths of underlying technical and organizational architectures running AI.

Furthermore, “logging” and “post-market” observation are classified as essential tracking components required for active validation, macro performance evaluation, and the deployment of necessary system alterations. Additionally, continuous observation of the “functionality (of the model)” is integrated as a critical metric for managing risk variations, such as through established threshold adjustments. In the reviewed literature, tracing functionality is also utilized to define the specific boundary conditions and performance limits of active AI models (Step 5e).

The fifth and final dimension addresses “data” parameters, establishing distinct characteristics for “governance”, “relevance and representativeness”, “collection”, and “preparation” [9, 12, 27]. The regulatory requirements governing data infrastructures are particularly rigorous, stipulating strict criteria to eliminate systemic discrimination, which justifies designating "data" as an independent taxonomic dimension. The baseline model resulting from this initial iteration is illustrated in Figure 2 (Step 6e).

The initial taxonomy is compact and structured, given that the extracted dimensions successfully categorize the foundational regulatory tenets of European oversight authorities. However, to satisfy the true scope of the study and guarantee practical utility, country-specific guidelines within Europe must be factored into the model. Engaging in a second iteration will serve to broaden, refine, and validate these identified characteristics. Consequently, because the objective ending conditions are not yet fully satisfied at this stage, a secondary design cycle must be initiated (Step 7).

 Second iteration E2C

During the second iteration, an empirical-to-conceptual method was adopted, leveraging the synthesis of country-specific regulatory principles detailed in Table 2, alongside an analysis of distinct use cases and reports to uncover supplementary dimensions and characteristics for the taxonomy. It is assumed that country-specific regulatory principles serve to validate or restructure existing dimensions and characteristics by integrating distinct national guidelines and interpretations, thereby yielding a more practical and robust taxonomy.

In this phase, we observed that several regulatory frameworks explicitly address the trade-off between explainability and performance as a vital consideration for AI-driven services [8, 32, 34, 38, 41], given that higher levels of explainability often constrain algorithmic performance [50]. Consequently, these frameworks frame the "accuracy" of AI models as a distinct challenge when contrasted with conventional, rule-based financial models that rely on fixed parameterization [3, 32, 34, 38]. Additionally, our analysis confirms that core characteristics such as "sustainability and robustness" [3, 34, 38], "explainability and accountability" [3, 34, 47], and "fairness, privacy, and human rights" [8, 34, 41] serve as central objectives within European regulatory principles. Specifically, safeguarding data assets and underlying IT infrastructure to enhance "sustainability and robustness" is treated as an ongoing investment within these frameworks, deemed essential for preserving the systemic resilience of AI-driven services [34, 47, 51].

The underlying "approach" was scrutinized more deeply through a use-case-focused assessment of country-specific regulatory tenets and priorities. Because model retraining possesses the potential to fundamentally alter outcomes overnight, the specific methodology governing "training" must be clearly justified [32]. Parallel concerns emerge regarding the "testing" [32, 47] and "validation" [8, 32, 34, 38] protocols implemented by financial institutions. Furthermore, owing to the necessity of evaluating impacts on both consumers and personnel, the challenges surrounding the "deployment" of AI-driven services are heavily emphasized in regulatory principles as a vital phase preceding commercial launch [34, 38]. Because any substantive alteration demands supervisory review, active "cooperation with the authorities" is indispensable for financial institutions to establish a streamlined evaluation framework [8, 32, 34].

Country-specific regulatory principles also highlight the "estimation and evaluation" of risks as a foundational element for delineating boundaries and identifying potential vulnerabilities in AI-driven services [32, 34, 41]. Similarly, "human oversight" is identified as a critical factor tied to the chosen degree of automation to mitigate algorithmic risks [3, 8, 34]. Interdependence between these two elements is vital for designing effective "control measures" intended to contain damages in the event of a system failure [38, 47]. Additionally, the systematic "maintenance" of AI-driven services is framed around ongoing model adjustments to guarantee that these systems adapt appropriately to revised or shifting datasets [8, 32]. We can likewise confirm that national frameworks treat "mitigation measures" as a suitable mechanism for minimizing adverse outcomes during operational failures [3, 8, 32].

Our findings indicate that every characteristic associated with "monitoring" was validated by country-specific regulatory frameworks, driven by the structural requirement for functional oversight and long-term performance assessments [8, 38]. Within these country-specific tenets, "(technical) documentation" is consistently viewed as a crucial prerequisite for AI-driven services to provide transparency for internal and external stakeholders alike [3, 8, 38]. Furthermore, systemic "logging" is mandated as an element of continuous monitoring to facilitate a clear understanding of operational dynamics [38, 47]. Correspondingly, country-specific frameworks emphasize "post-market" monitoring to support ongoing validation, holistic assessments, and iterative corrections [32, 38].

Finally, we confirm that data "governance" [34, 41], "relevancy and representativeness" [3, 34, 47], along with data "collection" and "preparation" [3, 32] are embedded within national regulatory frameworks to safeguard data quality metrics. This analysis underscores that identified regulatory principles pay close attention to underlying data quality and data privacy concerns [34, 40, 41]. Because this second iteration validated the aforementioned dimensions and characteristics, no structural modifications to the taxonomy (Figure 2) were deemed necessary (Step 6e).

As a direct outcome of this second iteration, we can verify that the taxonomy in its current form remains concise and robust, as the extracted dimensions effectively characterize European regulatory frameworks, including those of the top six nations by GDP. We can further confirm that the identified characteristics align with country-specific regulatory tenets, given that no additional dimensions or characteristics emerged. The taxonomy is thus considered comprehensive, extendible, and explanatory, with its existing dimensions and characteristics proving sufficient for the objects under study. Nonetheless, because certain objective ending conditions remained unfulfilled following this stage, moving to a third iteration is required (Step 7).

 Third iteration—C2E—final taxonomy

To critically reassess the current configuration of the regulatory principles taxonomy, a conceptual-to-empirical strategy was implemented (Step 4c). We determined that the "approach" dimension could be meaningfully reconfigured based on the country-specific regulatory principles compiled in Table 2: specifically, the characteristics "development", "training", "testing", "deployment", and "validation" represent the foundational phases of engineering an AI-driven service, allowing them to be consolidated under the designation of "design". Concurrently, regarding the "relevancy and representativeness" of data, it is assumed that this primarily dictates the overall caliber of the underlying dataset; thus, we opted to retitle this characteristic as "quality" (Step 5c).

The finalized taxonomy of regulatory principles following this third iteration (Step 6c) is illustrated in Figure 3. We conclude that the current taxonomy is comprehensive, extendible, and explanatory, negating the need for subsequent iterations. Ultimately, both the subjective and objective ending conditions have been satisfied following this phase of analysis (Step 7).

Our identified limitations can serve as a foundation for prospective investigations into regulatory tenets and the deployment of AI-driven utilities within the financial sector. Initially, we mapped the regulatory bodies across Europe alongside dominant European economies categorized by their GDP. The regulatory frameworks, including their respective publications regarding AI integration in financial workflows, were evaluated to contextualize the background of these regulatory doctrines. The foremost limitation encountered in this research stemmed from the fragmented and disorganized architecture of the regulatory tenets, which impeded a straightforward comprehension of expectations and objectives. Consequently, addressing supervisory anxieties and developing or refining suitable protocols for novel AI-driven applications remains a complex task. Furthermore, we noted that the European Commission's legislative proposal had already been assimilated by national regulatory doctrines as a baseline strategy for AI deployment in finance. Nonetheless, these national principles frequently prioritize case-specific examples and practical scenarios over formalized rules and explicit directives [52]. This characteristic posed a constraint during the synthesis and restructuring of our taxonomy. Even so, we validated that the taxonomy aligns with sovereign expectations and accurately maps country-specific regulatory architectures during the second iteration. Accordingly, we argue that our taxonomy is practical and reflects supervisory priorities, offering enhanced clarity for both industry professionals and academics. Still, a constraint persists regarding subjective interpretation and the exploratory design, meaning the taxonomy requires long-term empirical validation.

The finalized taxonomy highlights critical regulatory themes and supervisory priorities that financial institutions must address across five primary dimensions. The mapped objectives indicate that supervisory entities expect concrete solutions for these domains from both academic researchers and financial organizations. These targets must be balanced alongside the identified methodologies to fulfill regulatory expectations. Furthermore, financial institutions are obligated to verify, demonstrate, and maintain the resilience of AI-driven applications. This factor is recognized as a vital pillar for a risk-insulated framework to protect consumers and maintain operational stability [53]. Through the proposed taxonomy of regulatory tenets, we mapped frameworks that account for diverse methodologies. For each of these methodologies, subsequent investigations are required to formulate an explicit framework containing precise directives for AI utilization in financial contexts. Additionally, the final taxonomy demonstrates that risk management must be integrated with monitoring architectures, which are vital for identifying, supervising, and mitigating potential hazards. Regulators expect financial entities to engage in iterative enhancements and modifications to defend and elevate the quality of AI-driven operations.

While the taxonomy yields valuable insights into regulatory focus areas and the priorities of supervisory bodies, definitive compliance criteria structured as concrete use cases are currently lacking in both industry practice and academic literature. Both domains can be explored more exhaustively using this taxonomy as a baseline. Due to the convoluted, redundant, and cyclical architecture of regulatory principles, interpreting overlapping sections and organizing subsequent research remains difficult. However, with the European Commission's AI Act entering into force in 2024, the structural frameworks for compliant AI-driven applications still demand rigorous analysis; here, the taxonomy can streamline and advance this trajectory by offering an organized mapping of regulatory priorities. Additionally, the taxonomy distills the objectives of regulatory doctrines to guide prospective academic inquiries aimed at iteratively defining compliance parameters.

A primary area of focus centers on the explainability of both the deployed AI models and the underlying lifecycle from conceptualization to market integration. Consequently, it is necessary to analyze specific interventions and relevant variables on a case-by-case basis, as delineated by the taxonomy's dimensions (e.g., within monitoring and risk mitigation). Given the idiosyncratic nature of each AI-driven asset, the taxonomy can be applied to isolate the traits of compliant operations across corresponding clusters of use cases [15, 20]. Within this framework, subsequent research must organize and assess thematic domains, such as credit underwriting, transaction surveillance, and insolvency prediction. For instance, a compliant framework for risk estimation and evaluation within AI-driven credit underwriting can be precisely articulated. In this manner, the taxonomy offers a structured map of compliant mechanisms mapped to relevant dimensions and traits across various financial sector use cases. Furthermore, operational insights from AI deployments in alternative industries can be extracted and structurally customized for the financial domain. The taxonomy can foster and streamline collaboration between financial institutions and supervisory bodies by explicitly outlining expectations and corresponding interventions. This collaborative relationship, particularly regarding the compliance approval pipeline, can be organized via the taxonomy’s dimensions and expanded with supplementary traits matching the specific use case.

Moreover, the stated targets remain a central focus for regulatory authorities. We noted a deficiency in robust criteria and explicit directives concerning metrics like explainability, accountability, and accuracy; as a result, institutions must adopt individualized strategies and maintain open dialogues with regulators [54]. The proposed taxonomy demonstrates that the foundational workflow adopted by financial services firms plays a decisive role for regulators, spanning both structural and engineering phases. As an operational workflow gains complexity, the framework for alignment with supervisory bodies must be more rigorously organized [21]. In this context, systemic complexity represents a barrier to implementing AI-driven financial services due to the mandates for human intervention and specialized managerial training [27].

AI is poised to fundamentally reshape the financial landscape, with AI-driven applications being deployed across numerous operations, including fraud mitigation, risk modeling, client relations, and algorithmic trading. Legislative structures such as the AI Act, the Network and Information Security Directive (NIS/NIS2), the Digital Operational Resilience Act (DORA), the General Data Protection Regulation (GDPR), and the Cyber Resilience Act (CRA) all seek to govern AI usage within the financial domain. These statutory frameworks are uniformly intended to champion responsible AI engineering, protect consumer interests, and preserve financial systemic stability. Conversely, they could simultaneously introduce friction for financial entities attempting to deploy AI utilities. Consequently, financial organizations must meticulously evaluate the risks and strategic prospects linked to these legislative mandates to construct an ethical and effective AI strategy.

Additionally, to preserve the uninterrupted functionality of AI-driven utilities, it is essential to build and embed continuous process monitoring protocols. These systems are not merely intended for consumer protection; they also enhance service quality over time by highlighting latent vulnerabilities. Furthermore, these monitoring frameworks assist in clarifying and auditing system mechanics. Regulatory doctrines focused on monitoring aim to improve operational transparency, thereby streamlining the technical and functional evaluations conducted by supervisory authorities. We also observe that regulatory frameworks are disproportionately concentrated on data management, given that an appropriate dataset is a foundational prerequisite, and the core regulatory infrastructure is already established via the GDPR. Nevertheless, current supervisory concerns and perceived risks extend past data considerations to encompass the total operational pipeline, including all components required for secure service delivery. We suggest that our taxonomy can function as a structured framework of regulatory principles, enabling future investigations to mitigate the potential risks and liabilities connected to AI development, testing, and deployment within the finance sector [55].

This paper introduces a practical taxonomy of existing European regulatory principles designed for researchers and financial institutions to isolate and address paramount regulatory themes and priorities. The objective is to foster a deeper understanding of these mandates and provide a guide for engineering compliant AI-driven utilities. Against this backdrop, we evaluated the regulatory frameworks of major European nations to validate and reconstruct the taxonomy. Consequently, we constructed a hierarchical taxonomy comprising six distinct dimensions, adhering to the iterative taxonomy engineering methodology outlined by Nickerson et al. [23] and utilizing two empirical-to-conceptual phases alongside one conceptual-to-empirical phase. This study contributes to the active literature surrounding AI implementation in financial applications from the perspective of supervisory bodies. We executed a structured literature review and market assessment to map European regulators and their corresponding principles governing AI usage in finance. However, we identified fragmented and inadequate measures targeting existing risks. Through our discussion, we demonstrated that the taxonomy offers researchers and practitioners a holistic map of existing vulnerabilities to aid in their identification and remediation. We argue that illuminating regulatory priorities and traits via our taxonomy can assist in formulating further interventions that satisfy supervisory frameworks.

We also determined that country-specific regulatory tenets are less mature than broader European frameworks, as they primarily consist of practical use cases and illustrative methodologies [10]. These case-based exploratory accounts contain potential baseline interventions to avoid severe regulatory sanctions, meaning financial enterprises must account for them when developing equivalent AI-driven utilities. To this end, our research offers a unified perspective on European regulatory doctrines, allowing subsequent studies to focus on deriving practical interventions and encouraging further innovative AI-driven tools in finance. Having highlighted the challenges surrounding explicit legal frameworks and institutional anxieties, future inquiries can target both the formulation of a transparent statutory basis and the provision of compliant technical interventions grounded in suitable workflows. This can support the advancement of AI in the financial sector by offering technical and organizational blueprints [22]. Similarly, the identified objectives within our taxonomy indicate the core anxieties framed as targets that must be interrogated in subsequent research to realize compliant and innovative applications. Moreover, given the fluid nature of AI-driven utilities, the mandate for ongoing communication with regulators introduces another crucial challenge [56]. In this regard, future studies must examine whether the competencies of regulators and corporate managers are adequate for these demands and determine how they should be upgraded [13]. Likewise, it is necessary to audit the entire operational life cycle, including commercial deployment and post-market tracking, to establish an efficient supervision and certification workflow.

We would like to thank the reviewers for their thoughtful comments and efforts toward improving our manuscript.

None

We acknowledge support by the Open Access Publication Funds/transformative agreements of the Göttingen University.

None

Ethan Wright, Chloe Bennett, Jack Turner & Olivia Harris contributed to this work.

Authors and affiliations

Department of Financial Services AI Regulation, Faculty of Law, University of Leeds, Leeds, United Kingdom
Ethan Wright & Jack Turner

Department of Compliance and Regulatory Principles, Faculty of Law, University of Sheffield, Sheffield, United Kingdom
Chloe Bennett

Department of AI Governance and Financial Compliance, Faculty of Law, University of York, York, United Kingdom
Olivia Harris

Corresponding author

Correspondence to Ethan Wright

Open Access The author(s) retain copyright. This article is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. It may be shared and adapted for non-commercial purposes with appropriate attribution, an indication of changes, and distribution of adaptations under the same license. Third-party material may be subject to separate terms identified in its credit line. View the license at https://creativecommons.org/licenses/by-nc-sa/4.0/.