The fines are no longer theoretical. Supervisors are alreadypenalising weak reporting controls, inadequate governance and fragile operating models. Not for misconduct. For failure to demonstrate control. And this is before large-scale AI supervision has fully arrived.

AI pilots are moving into production across capital reporting, AML, surveillance and resilience. The legal and technical obligations governing accountability, outsourcing, and operational control are already on the books. When supervisors begin testing AI-driven systems at machine speed, “it was just a pilot” will not be a defence.

This episode confronts the uncomfortable reality: if you cannot evidence control now, escalation is not a question of if, but when.