# Building a system that classifies, governs and answers questions about personal and risk data inside a bank

Source: https://www.bankingnewsai.com/agentic-banking/build/data-privacy
Last updated: Sep 17, 2026

Data work is where the older standards bite hardest on the newest systems: a training set, a feature store and a retrieval corpus are risk data under BCBS 239, and personal data under privacy law. The useful patterns are chained and code-checked: classify documents and fields against a schema, propose lineage and ownership records, draft data-protection assessments and handle access requests, with every output validated by rules and a person accountable for the register.

## The brief (default answers)

| Choice | Answer |
| --- | --- |
| Who is affected | Staff only |
| Reversibility | With cost |
| Stakes | Material |
| Knowledge | Both |
| Verifiability | By a rule or a test |
| Steps | Known |
| Jurisdiction | More than one |
| Delivery route | Provider API |

- **Pattern:** Augmented call — One model call with retrieval, tools and a structured output, inside code you control.
- **Tier:** 2, Tier 2: act with approval — Material but recoverable. The model may prepare and, within limits, act, with a person approving anything that leaves the bank or touches a customer.
- **Workflow shapes:** 
- **Human involvement:** The model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone.
- **Knowledge:** Retrieval over the governed document set, with a citation on every answer and a refusal when nothing relevant is found.; Tool calls to the system of record for anything live. Never retrieval for a balance, a case status or a limit.; Documents to reason with, systems to check against: the workflow decides which question goes where before the model answers.

## Decomposition

| Step | Owner | Note |
| --- | --- | --- |
| Discover and classify | model | Data types and sensitivity against the bank's schema, with a confidence. |
| Validate classifications | system | Rules and sampling; low-confidence items to a person. |
| Record lineage and ownership | system | Structured writes to the catalogue from validated results. |
| Draft assessments and responses | model | Impact assessments, access-request replies, from the register. |
| Own the register | human | The data owner signs; the privacy officer reviews assessments. |

## Control layer weights (0–4)

| Layer | Weight |
| --- | --- |
| governance | 1 |
| identity | 1 |
| actions | 0.9 |
| data | 1 |
| models | 0.55 |
| runtime | 0.4 |
| observability | 0.7 |
| oversight | 0.6 |

## Documents that apply

- [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239) — Risk data must be owned, traceable, complete and current; training data is risk data.
- [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Article 10: documented data governance for high-risk systems.
- [GDPR Article 22](https://www.bankingnewsai.com/ai-regulation/documents/eu-gdpr-article-22-automated-decision-making) — Rights around solely automated decisions with legal or similar effect.
- [CPPA ADMT, risk-assessment and cybersecurity-audit regulations](https://www.bankingnewsai.com/ai-regulation/documents/ca-cppa-admt-risk-cyber-regulations-2025) — California: notice, opt-out and risk assessments for automated decision-making technology.
- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — US model risk management.
- [PRA SS1/23](https://www.bankingnewsai.com/ai-regulation/documents/pra-ss1-23-model-risk-management) — UK: the widest model perimeter.
- [FSB AI sound practices consultation (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-consultation-2026) — The cross-border baseline the FSB is converging on.
- [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — The model provider is a third party: due diligence, contract terms, monitoring, exit.
- [FSB AI monitoring report (Oct 2025)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-monitoring-ai-adoption-vulnerabilities-2025) — Concentration on a small number of model suppliers.
- [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13) — For a national bank, the OCC's copy of the 2026 model-risk guidance.
- [NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1) — The voluntary Govern, Map, Measure, Manage frame for everything model-risk guidance leaves out.

## Evals

- A golden dataset of at least 150 real cases with expected outputs, including adversarial inputs: wrong documents, unusual formats, prompts that try to change the task.
- Code-based checks on every output: schema conformance, required fields, reconciliations against the system of record. Threshold: 99% or better before launch, every run in production.
- Citation checks: every factual claim resolves to a passage in the governed set; unsupported claims below 2% of answers.
- The same suite reruns on every prompt change, model version change and retrieval change; a regression blocks the release. That is what ongoing monitoring and outcomes analysis mean in model-risk terms.

## Human gates

- Per-action approval by a competent reviewer for anything customer-facing or irreversible; sampled review for the rest.
- Validation proportionate to materiality, with monitoring for drift on inputs and outputs.
- An escalation route to a person that the customer can reach in one step.
- Monthly review of the evals and the exception log by the accountable owner.

## What an examiner will ask

- Where is this system in your inventory, what tier did you assign, and who signed it off?
- What counts as a model here, and what does your validation cover for the parts that are not?
- Show me the data lineage behind the retrieval set and the training or tuning data.
- What can the system do without a person, and where is that written down?
- How do you know it is still working: which evals run, how often, and what happened the last time one failed?
- What did you do about the vendor: due diligence, contract, exit plan, concentration?
- Walk me through one wrong output from production and what the customer, if any, saw.
- Who can switch it off, and has that been tested?

## What the board should hear

- What it does: classifies, governs and answers questions about personal and risk data; the model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone.
- Pattern: augmented call; tier 2: act with approval.
- Rules it answers to: 4 documents across several jurisdictions, each linked in the brief.
- How we know it works: a golden dataset, automated checks on every release, and human review at the level the tier demands.
- What could go wrong and who answers: the accountable owner, the kill switch, the escalation route.

## Pitfalls

- AI datasets assembled outside the governed perimeter.
- Lineage the model asserts but the catalogue cannot reproduce.
- Automated responses to data-subject requests without review.

Change any answer on the interactive map: https://www.bankingnewsai.com/agentic-banking/build/data-privacy

---

Canonical page: https://www.bankingnewsai.com/agentic-banking/build/data-privacy
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (19 authorities, 166 documents) and AI-strategy profiles of the 100 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.