Which pattern fits data & privacy in a bank?

Augmented call. The task is well defined and the output can be checked. Most bank use cases should start here. Material but recoverable. The model may prepare and, within limits, act, with a person approving anything that leaves the bank or touches a customer.

What will an examiner ask?

Where is this system in your inventory, what tier did you assign, and who signed it off? What counts as a model here, and what does your validation cover for the parts that are not? Show me the data lineage behind the retrieval set and the training or tuning data. What can the system do without a person, and where is that written down? How do you know it is still working: which evals run, how often, and what happened the last time one failed? What did you do about the vendor: due diligence, contract, exit plan, concentration? Walk me through one wrong output from production and what the customer, if any, saw. Who can switch it off, and has that been tested?

Data & privacy: AI Design Brief for Banks

Q: Which steps belong to a person, the model and a system?

1. Discover and classify: the model. Data types and sensitivity against the bank's schema, with a confidence. 2. Validate classifications: a system. Rules and sampling; low-confidence items to a person. 3. Record lineage and ownership: a system. Structured writes to the catalogue from validated results. 4. Draft assessments and responses: the model. Impact assessments, access-request replies, from the register. 5. Own the register: a person. The data owner signs; the privacy officer reviews assessments.

Data work is where the older standards bite hardest on the newest systems: a training set, a feature store and a retrieval corpus are risk data under BCBS 239, and personal data under privacy law. The useful patterns are chained and code-checked: classify documents and fields against a schema, propose lineage and ownership records, draft data-protection assessments and handle access requests, with every output validated by rules and a person accountable for the register.

adjust the answers for your bank →every document for this use case →

The call

Augmented callTier 2: act with approvalautonomy level 1

Data & privacy: The model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone. One model call with retrieval, tools and a structured output, inside code you control. Material but recoverable. The model may prepare and, within limits, act, with a person approving anything that leaves the bank or touches a customer.

PatternAugmented call. The task is well defined and the output can be checked. Most bank use cases should start here.KnowledgeRetrieval over the governed document set, with a citation on every answer and a refusal when nothing relevant is found. Tool calls to the system of record for anything live. Never retrieval for a balance, a case status or a limit. Documents to reason with, systems to check against: the workflow decides which question goes where before the model answers.Delivery routeProvider API: one third party to diligence; residency and retention terms are yours to negotiate.

Decomposition

Which steps belong to a person, the model and a system?

#	Step	Owner	Note
1	Discover and classify	The model	Data types and sensitivity against the bank's schema, with a confidence.
2	Validate classifications	A system	Rules and sampling; low-confidence items to a person.
3	Record lineage and ownership	A system	Structured writes to the catalogue from validated results.
4	Draft assessments and responses	The model	Impact assessments, access-request replies, from the register.
5	Own the register	A person	The data owner signs; the privacy officer reviews assessments.

Architecture

Which control layers carry the weight?

Each layer is described, with its controls and documents, on the control plane page.

Governance and accountability: core for this design.
Identity and entitlements: core for this design.
Action gateway: core for this design.
Data and knowledge: core for this design.

Documents

Which rules and guidance does this design answer to?

Document	Authority	Why it applies here	Status
BCBS 239	Basel Committee	Risk data must be owned, traceable, complete and current; training data is risk data.	In force
Regulation (EU) 2024/1689	EU AI Act	Article 10: documented data governance for high-risk systems.	In force
GDPR Article 22	EU AI Act	Rights around solely automated decisions with legal or similar effect.	In force
CPPA ADMT, risk-assessment and cybersecurity-audit regulations	California CPPA	California: notice, opt-out and risk assessments for automated decision-making technology.	In force
SR 26-2	Federal Reserve	US model risk management.	In force
PRA SS1/23	UK (BoE / PRA / FCA)	UK: the widest model perimeter.	In force
FSB AI sound practices consultation (June 2026)	FSB	The cross-border baseline the FSB is converging on.	Proposed
SR 23-4	Federal Reserve	The model provider is a third party: due diligence, contract terms, monitoring, exit.	In force
FSB AI monitoring report (Oct 2025)	FSB	Concentration on a small number of model suppliers.	Final
OCC Bulletin 2026-13	OCC	For a national bank, the OCC's copy of the 2026 model-risk guidance.	In force
NIST AI RMF 1.0	NIST	The voluntary Govern, Map, Measure, Manage frame for everything model-risk guidance leaves out.	In force

Evals

How will you know it works, before and after launch?

A golden dataset of at least 150 real cases with expected outputs, including adversarial inputs: wrong documents, unusual formats, prompts that try to change the task.
Code-based checks on every output: schema conformance, required fields, reconciliations against the system of record. Threshold: 99% or better before launch, every run in production.
Citation checks: every factual claim resolves to a passage in the governed set; unsupported claims below 2% of answers.
The same suite reruns on every prompt change, model version change and retrieval change; a regression blocks the release. That is what ongoing monitoring and outcomes analysis mean in model-risk terms.

Human gates

Where must a person be in the loop?

Per-action approval by a competent reviewer for anything customer-facing or irreversible; sampled review for the rest.
Validation proportionate to materiality, with monitoring for drift on inputs and outputs.
An escalation route to a person that the customer can reach in one step.
Monthly review of the evals and the exception log by the accountable owner.

Pitfalls

AI datasets assembled outside the governed perimeter.
Lineage the model asserts but the catalogue cannot reproduce.
Automated responses to data-subject requests without review.

Examiner questions

What will a validator or an examiner ask?

Where is this system in your inventory, what tier did you assign, and who signed it off?
What counts as a model here, and what does your validation cover for the parts that are not?
Show me the data lineage behind the retrieval set and the training or tuning data.
What can the system do without a person, and where is that written down?
How do you know it is still working: which evals run, how often, and what happened the last time one failed?
What did you do about the vendor: due diligence, contract, exit plan, concentration?
Walk me through one wrong output from production and what the customer, if any, saw.
Who can switch it off, and has that been tested?

For the board

What it does: classifies, governs and answers questions about personal and risk data; the model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone.

Pattern: augmented call; tier 2: act with approval.

Rules it answers to: 4 documents across several jurisdictions, each linked in the brief.

How we know it works: a golden dataset, automated checks on every release, and human review at the level the tier demands.

What could go wrong and who answers: the accountable owner, the kill switch, the escalation route.

Peer evidence

Which of the 100 largest US banks have put this use case on the record?

Other briefs

Data & privacy: a design brief for banks.