The FD’s AI dilemma: opportunity, accountability and the governance gap
For finance directors (FDs), working at the heart of data analysis and strategic decision making, AI has opened a new world of possibility but also uncertainty. What governance steps should you be taking to prepare your team, treat the risks responsibly, and turn worry into optimism?
With the right advice in place to implement robust financial controls, governance frameworks and practical support, finance teams can adopt AI with confidence, strengthening decision-making while staying accountable.
Be clear about usage
The upsides of AI – from saving time to identifying patterns – are apparent throughout businesses. AI’s use of powerful algorithms to iteratively extract, examine and analyse data, often from different sources, hasn’t been widely accessible until relatively recently in most people’s careers.
The downside is that algorithms are also largely a black box. The outputs can be checked but the methods and decisions used to create them can’t, and the audit trail can be patchy. Selecting the correct tool, writing and refining queries, and fact-checking the outputs is a skill that many of us are still honing.
The AI conundrum comes with a side dish of questions for FDs around data sharing and management:
- What assumptions are built in?
- What information is excluded?
- Is there any bias?
- What is the exact reference data set?
- Have any controls been bypassed during extraction?
- Has there been any data leakage along the way?
- Do business users have appropriate training?
- Which tools are best?
- Are there controls in place to protect data and the company?
As the associated risks become more pressing, communicating how AI is approved for business use is a must. If there is a guidance vacuum, employees could inadvertently share confidential information or make inappropriate decisions. Companies need accessible, plain English guidance that is useful.
Understand regulation and its principles
The growing use of AI in finance and reporting risks creating an accountability gap. AI doesn’t take responsibility when things go wrong. Human in the loop (HITL) is a governance and control idea requiring that a human remains actively involved in AI-supported decision-making. HITL is becoming more prominent among both internal policies and external regulators.
Under the regulatory position taken by the Financial Conduct Authority (FCA), errors or unintended outcomes produced by automated tools are treated as a failure of governance rather than a technology problem. In regulated environments this can lead to direct scrutiny of senior management, for example senior managers in financial services could be investigated under the FCA’s Senior Managers and Certification Regime (SM&CR).
With the Treasury Select Committee reporting that 75% of UK FS firms are now using AI, MPs are putting pressure on the FCA. FDs should be prepared for the FCA to take further steps.
The EU AI Act, which comes fully into force in August 2026, applies to providers operating within the EU. It could have a significant effect on non-EU companies. There are specific requirements, e.g. for AI used in employment, training or biometrics, with fines for violations reaching into the €millions or a percentage of global turnover.
Regulation is reinforcing the principle that accountability sits with the people running the business. For FDs, the challenge is ensuring the right governance frameworks are in place, so automation supports good decision‑making.
Allow for greater accountability
Through the people impact of AI, FDs should expect accountability to increase. As routine back office work (transaction processing, reconciliations, standard reporting) gets an AI-driven overhaul, the need for an FD stays. Boards, auditors and regulators will still expect management to evidence how outputs were produced, what controls operated and what was challenged.
Finance teams should focus on upskilling around data quality and governance, controlling design and validation of automated outputs, and strengthening commercial judgement.
It’s understandable that many FDs will be daunted by these challenges, especially if they don’t have the internal resources or budget to address them. Fractional finance support from experienced professionals enables businesses to meet that need.
How BKL can help
Our fractional finance directors have experience supporting businesses through change. We embed into teams without the commitment of a full-time hire. We can help you to:
- Identify and document AI-related risks within formal risk registers
- Design and implement appropriate financial and operational controls
- Draft clear, practical policies and guidance on acceptable AI use
- Ensure there is a robust audit trail and HITL oversight for automated outputs
- Embed responsibility clearly across finance teams and senior management
In regulated or investor-facing environments, this becomes even more important. Our specialists in the financial services sector can help you interpret existing FCA rules and expectations through the lens of emerging technologies. By keeping you ahead of future AI-specific regulation, you’ll gain certainty that your controls, policies and governance arrangements already stand up to regulatory scrutiny.
AI has the potential to strengthen decision-making without diluting accountability. With the right financial controls and regulatory understanding in place, your business can adopt new technologies with confidence, while protecting its directors, investors and clients.
For a chat about how we can help you, get in touch with Vicki Johnson using the form below.
Contact Vicki
Frequently asked questions: Finance directors and AI risks
What are the main AI risks finance directors need to manage?
The core AI risks for finance directors sit around governance, data integrity, supplier exposure and accountability.
AI systems can produce outputs without clear audit trails, embed hidden assumptions or bias, and increase the risk of data leakage if used improperly. There are also questions around how third-party tools handle data, whether inputs are reused to train wider models, and how much visibility the business really has over outputs.
In practice, the challenge is less about the technology itself and more about how it is controlled, understood and relied upon within the business. Finance leaders need to ensure outputs are accurate, data is protected, and decisions remain properly evidenced and challengeable.
Who is responsible if an AI-driven decision is wrong?
Responsibility always sits with the business, not the AI tool.
Regulators such as the FCA and FRC are clear that AI supports decision-making but doesn’t replace accountability. If an AI-generated output leads to errors or poor decisions, this is treated as a governance failure. For regulated firms, this can expose senior managers to scrutiny under frameworks such as the Senior Managers and Certification Regime (SM&CR).
Do UK businesses need to comply with AI-specific regulation right now?
There is currently no standalone AI regulation in the UK, but existing rules still apply.
Regulators expect firms to apply existing governance, risk, and control frameworks to AI use. However, businesses operating in or interacting with the EU should be aware of the EU AI Act, which comes fully into force in August 2026 and introduces stricter requirements and potential financial penalties.
What data and GDPR risks should finance teams be aware of?
Data risk is often the least visible but most immediate concern.
AI tools may store or process data outside expected jurisdictions, retain it longer than intended, or use it to improve underlying models. In some cases, personal or commercially sensitive information is shared without full visibility over how it is handled.
From a GDPR perspective, the key issues are transparency, control and accountability — particularly around where data sits, how it is used, and whether it can be properly secured or removed.
How do large language models (LLMs) change the risk profile?
Large language models introduce specific considerations around confidentiality and data ownership.
Some platforms may use submitted inputs to train broader models. This means financial data, business logic or commercially sensitive information could unintentionally become part of a wider system. Even where that risk is limited, it is not always well understood by users.
The critical distinction is whether a tool isolates your data or learns from it — and that is not always obvious without careful review.
How should finance teams approach AI supplier selection?
AI suppliers should be assessed with the same rigour as any provider handling sensitive financial information.
This includes understanding security standards, GDPR compliance, where data is processed and what happens to information at the end of a contract. Questions around encryption, certifications and contractual protections are not technical detail, but part of core risk management.
In many cases, the same level of scrutiny applied to auditors or outsourced providers applies here.
How can businesses prevent staff misusing AI tools?
Clear policies and training are essential to prevent inappropriate use. Without guidance, employees may input confidential or commercially sensitive data into public AI systems.
Businesses should define approved tools, set rules on data sharing, and provide practical training in plain English. Embedding this into wider risk management and IT policies helps avoid accidental breaches and poor decision-making.
What does “human in the loop” mean in practice?
Human in the loop (HITL) means a person must actively review and take responsibility for AI outputs.
It is not enough to rely on automation alone. Finance teams should validate calculations, sense-check outputs, and document decision-making processes. This ensures there is clear oversight, reduces the risk of errors, and provides the audit trail expected by auditors, regulators and stakeholders.
What controls should finance teams put in place for AI?
Finance teams should implement controls similar to those used for financial reporting systems.
This includes documenting AI usage in risk registers, validating inputs and outputs, maintaining audit trails, restricting access to approved tools and regularly reviewing performance.
Controls should focus on data quality, model oversight and ensuring decisions can be justified and explained if challenged.
Will AI reduce the need for finance teams?
AI will change the role of finance teams, not remove the need for them.
Routine tasks such as reconciliations and reporting are likely to become more automated. However, the need for judgement, oversight, and accountability increases. Finance professionals will be expected to focus more on analysis, governance and commercial insight, rather than pure processing.
What happens if AI outputs can’t be properly explained or evidenced?
Unexplained outputs create audit, compliance, and reputational risk.
Boards, auditors, and regulators expect businesses to demonstrate how decisions were reached. Where AI outputs can’t be traced or justified, this can lead to challenges during audits or regulatory reviews. This makes it critical to maintain documentation and ensure transparency in processes.
Are smaller businesses or startups exposed to the same AI risks?
Yes. AI risks apply regardless of business size.
While smaller businesses may adopt AI tools more informally, they are still responsible for data protection, decision accuracy, and governance. In some cases, the risk can be greater due to fewer formal controls.
Introducing proportionate policies and oversight early can prevent more significant issues as the business grows.
How can BKL support businesses navigating these risks?
BKL help businesses bring structure and control to evolving technology use within finance functions.
This includes identifying risks, reviewing supplier arrangements, strengthening financial controls and developing clear, practical guidance for teams. Support from experienced advisers, including BKL’s fractional finance directors, helps businesses move forward with confidence while maintaining strong governance and accountability.
